Readstow
Trust and security
How your account and your library are looked after, in plain words.
Hosted in Australia
Readstow is run by DexWorks Pty Ltd, an Australian company, and the server that holds your account is in Australia.
A database of your own
Each account’s library is its own PostgreSQL database. Your saved items, reading progress and feeds are not rows in a table shared with other people.
Passwords and sessions
Passwords are hashed with bcrypt. We never store them in a form that can be read back.
When you sign in, the app gets a random session token. The server keeps only a hash of it, so a copy of the database cannot be used to sign in as you. Any session can be revoked. You can sign out your other devices from the app, and changing your password signs them out too.
Encrypted on the way
Every connection to readstow.com and to the API at api.readstow.com uses TLS, through Cloudflare.
No ads, no tracking
The app has no ads, no tracking and no third-party analytics. This website counts visits with Cloudflare Web Analytics only if you accept it in the cookie banner. The cookie policy lists everything the site stores.
Backups
Your data is backed up every night, and each backup is kept for 14 days.
Deleting your account
Deleting your account in the app removes your database and your stored files straight away. Copies in backups age out within 14 days. Support has the steps.
Reporting a vulnerability
If you find a security problem in Readstow or on this site, email security@readstow.com. Our security.txt has the details.
The policies
The privacy policy and the terms of use have the full detail.