Sign-in cookie
leafread_session contains a random session token. It is HTTP-only, SameSite=Lax and Secure in production, and lasts up to 30 days. The server stores a digest rather than the raw token. Signing out removes the cookie and revokes that session; a password reset revokes all sessions.
Reading position on your device
The IndexedDB database leafread-positions-v1 stores account/document identifiers, sentence positions and pending sync operations. It does not store the source text or an offline audio library. Entries persist to recover progress after a reload; signing out clears the current account’s local positions. Browser storage controls can also remove them.
Cookie-free usage analytics
LeafRead uses PostHog cookieless measurement without analytics cookies or a persistent browser identifier. It does not create account-linked profiles. Privacy settings lets you turn this measurement off. Existing refusals and browser privacy signals are respected. The separate first-party page counter keeps totals by normalized page, day, country and device type; its daily rotating visitor pseudonyms expire after 32 days. See the Privacy policy for details.
Language preference
The leafread_language cookie remembers your chosen interface language (en or de) in this browser for up to one year. It is a first-party SameSite=Lax cookie, marked Secure over HTTPS, and contains no account or tracking identifier. Public pages use the language in their URL; your chosen language is carried into the library and reader.
Your privacy preference
Privacy settings lets you change usage statistics and diagnostics. Your choice is stored locally in this browser, not as permission for unrelated processing. It applies to future collection; clearing browser storage removes this saved preference. No separate acknowledgement is required to read or use the service.
Your browser controls
Blocking the session cookie prevents sign-in. Clearing site storage removes locally pending positions and can lose changes not yet synced. Fonts and the public audio example are served as site files; the example does not request new speech generation.