Privacy Policy

When you use ReadNextList, we may collect:

• Email address — to send you a magic sign-in link, deliver our newsletter (if you subscribe), or respond to your messages
• Display name — if you choose to set one when creating an account
• Reading preferences and poll responses — to personalize your experience and improve our curation
• Session data — stored in an encrypted, server-side cookie to keep you signed in (see Cookie Policy below)
• Standard server logs — IP address, browser type, pages visited, and referrer. Logs are retained for a limited period for security and diagnostics purposes only.

We do not collect payment information. We do not currently display advertising on ReadNextList, though we may use advertising and social platform measurement tools to understand how readers find us — see the Cookie Policy below.

We use the information we collect to:

• Authenticate you and maintain your session
• Send transactional emails (magic links, account notices)
• Deliver the newsletter you signed up for via MailerLite
• Improve site content and editorial curation
• Respond to questions or support requests you send us
• Detect and prevent abuse or unauthorized access

We do not use your information for automated decision-making or profiling in ways that produce legal or similarly significant effects.

We use a small number of trusted third-party services to operate ReadNextList:

• MailerLite — newsletter delivery. If you subscribe, your email address is shared with MailerLite. You can unsubscribe at any time via the link in any newsletter email, or by emailing us. See MailerLite's Privacy Policy.
• Google reCAPTCHA Enterprise — bot and abuse protection on our sign-in and registration forms. When you visit those pages, Google receives your IP address, browser and device characteristics, and interaction data in order to score whether the request is automated. We receive only a risk score, never the underlying data. See Google's Privacy Policy.
• Analytics, advertising, and social platforms — we use, or may use, measurement services from providers including Google, Facebook/Meta, and X. These help us understand how readers find and use the site. See the Cookie Policy below for how to opt out.
• Hosting provider — our VPS host processes data in order to deliver the site to you. Traffic is encrypted in transit (TLS).

We do not share your personal information with any other third parties beyond those listed above, except as described in Section 4 below.

We do not currently sell your personal information. However, we reserve the right to share or sell certain data — including survey responses, poll results, reader preference data, and contact information — with third parties in the future. If we do so in a manner that includes personal identifiers, we will update this Privacy Policy before doing so.

Under the California Consumer Privacy Act (CCPA) and similar laws, you have the right to opt out of the sale of your personal information. To exercise this right at any time, email us at hello@readnextlist.com with the subject line Do Not Sell My Information.

We may also share or transfer your information in connection with a merger, acquisition, or sale of all or part of Cora Press or ReadNextList. In that event, user information may transfer as a business asset, subject to this Privacy Policy.

ReadNextList uses cookies to operate the site, to protect it from automated abuse, and to understand how the site is used.

The cookies we and our partners set:

• rnl-session — an encrypted, HttpOnly session cookie that keeps you signed in. It is set when you authenticate and expires when you sign out or after a period of inactivity. It is never accessible to JavaScript and is not used for tracking.
• _GRECAPTCHA — set by Google on our sign-in and registration pages as part of reCAPTCHA's bot protection, to tell automated traffic from real visitors. It is set only on those pages, not while you browse stories or reviews.
• Analytics and measurement cookies — we use, or may use, services such as Google Analytics to understand which pages and stories readers find useful. These record things like pages visited, time on page, and general location, and help us decide what to publish next.
• Advertising and social media cookies and pixels — we may use measurement tools from advertising and social platforms, including Google, Facebook/Meta, and X, to understand how readers find us and to reach people likely to enjoy the books we recommend.

Managing or removing cookies. You can block or delete cookies at any time through your browser settings. Guidance for every major browser is available at allaboutcookies.org. You can also opt out of Google Analytics specifically using Google's opt-out browser add-on.

Please note that blocking cookies may stop parts of the site from working properly. In particular, you will not be able to stay signed in to your account, and our sign-in and registration forms may not work, because both depend on cookies.

We retain your account information for as long as your account is active. If you request deletion, we will remove your personal information within 30 days, except where retention is required for legal or security purposes. Server logs are retained for no longer than 90 days.

Depending on where you are located, you may have rights including the right to access, correct, or delete your personal data, or to object to or restrict how we use it.

To exercise any of these rights, email us at hello@readnextlist.com. We will respond within 30 days.

ReadNextList is not directed to children under 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of this page when we do. If changes are material, we will note them in the newsletter.