VONORA LLC

Privacy notice

Last updated October 12, 2026

This notice describes the data used by Vonora LLC to operate Vonora and Reader. Contact support@myvonora.com with privacy questions or requests.

Local reading

Books prepared from files, reading profiles, settings, and progress are stored in your browser. Student reading profiles, preferences, and saved reading progress stay in this browser; Reader does not synchronize them to our servers. Cloud book uploads exclude these profiles and progress. Creating an account does not automatically upload your library. A backup you choose to export can include local profiles and progress, so keep it private. Website addresses such as myvonora.com and www.myvonora.com have separate browser storage. Use Backup & restore before moving your library or clearing browser data.

Account information

When you register or sign in, your email address, user name, password, and verification information are sent to our account service, Amazon Cognito. Your account can also contain a full name and telephone number if you choose to add them. We use account information to authenticate you, maintain your profile, and connect you to your plan. Sign-in information is held in browser session storage.

Importing and reading materials

Local file preparation runs in the browser. If you import a public link, the link is sent to our download service, which requests the material from the source website. That website receives a request from the service. Do not use links containing private access tokens or confidential information.

OCR downloads software and language resources from external hosts, including jsDelivr; those hosts receive normal network request information such as your IP address. OCR recognition runs in the browser. Device voices are provided by your browser or operating system; their processing and network behavior depend on the voice provider.

Optional cloud storage and narration

Integrated Plus cloud storage and Polly narration are not currently enabled in production. When enabled, choosing Upload to cloud sends a prepared book and its metadata to private storage on Amazon Web Services (AWS). Downloading retrieves that copy. Local edits do not automatically change an earlier cloud copy.

Choosing Polly narration sends the text to our narration service and Amazon Polly to generate speech. Generated audio and timing information can be cached privately for your account, with a 30-day expiration policy. Usage records track your allowance. The Free trial usage record is retained for the lifetime of your account so its one-time 1,000-character allowance does not reset. Manual connections to separate speech endpoints are disabled on this website.

Payments and service providers

Stripe processes subscription payments and billing-portal activity. Payment details entered on Stripe are handled by Stripe. Our services use customer, subscription, payment-status, refund, and dispute information to determine access and handle billing. AWS provides hosting, account, storage, and processing services. See Stripe’s privacy policy and AWS’s privacy notice.

Technical records and browser storage

AWS hosts this website. The private deployment uses CloudFront and private S3 storage; earlier deployments used Amplify. Requests involve technical information such as IP addresses, request dates and times, requested URL paths and query strings, and response status codes. Do not include personal details, credentials, or other sensitive information in URLs.

Our backend services also produce operational records, such as errors, request identifiers, and service metrics. We use technical records to deliver the service, investigate failures, and protect accounts. Keeping reading profiles and progress in your browser does not prevent this technical logging. Browser storage also supports sign-in, saved books, and preferences. Private access requires an internet connection. An essential Secure, HttpOnly cookie authorizes website requests and expires after at most one hour. Administrators keep an approval record containing your account identifier, invited email address, access status, and the time that status changed. We check that record to allow or deny access. Revoking access does not remove books already saved on your device.

Production backend Lambda logs have a 30-day retention setting. Logs from earlier Amplify hosting follow a separate policy: AWS retains them until the hosted app is deleted, and our 30-day backend log setting does not apply to them. Deleting a book or account does not automatically remove these hosting logs. See AWS’s Amplify access-log documentation.

Retention and deletion

You can remove local books in Reader or clear browser data. Deleting a local book does not delete a separate cloud copy. When cloud storage is available, use Cloud library to delete cloud copies. After Plus ends, the normal download recovery period is 30 days; the account’s deadline is shown in Cloud library. Payment review can delay deletion to preserve your books. Automated expiration does not guarantee physical deletion at an exact moment.

Account, billing, support, and operational records can remain after book deletion. Their retention depends on the record and operational or legal needs. Contact us to request access, correction, or deletion of account data. We may need to verify account ownership and may need to retain records for legal requirements, payment disputes, or security. Logging out does not delete your account or cancel billing.

Family accounts and parent permission

Adults may use Reader only for themselves, or as parents or legal guardians of children using Reader, including children under 13. Adult-only accounts do not require parental consent and must switch to family setup before child use. Before Reader opens for child use, the adult completes family setup, reads the direct parental notice, chooses services, and returns a signed consent form for manual review. Optional cloud storage and cloud narration require separate choices. An invitation alone does not establish parental consent.

We record the adult account identifier, family declaration, notice version, selected services, request and review dates, approval or withdrawal status, and an internal review reference. The signed form includes the adult account email, parent or guardian name, signature, and date. Do not include a child’s name, birthday, school, diagnosis, photo, or identity document in the form. We use this information to verify and manage permission and handle privacy requests.

Signed forms and their backup copies are deleted within 30 days after review. Unapproved requests expire after 14 days. Consent event records are scheduled for deletion after one year; automated deletion can take additional time. The current permission record remains while needed to enforce your choices. Other retention exceptions are described above. Access to signed forms is restricted to the operator reviewing them.

Parents can review status, turn off optional services, withdraw permission, and request a data copy or deletion through Parent permission. Requests are handled manually after verification. Withdrawal stops new authorized use; it does not erase device copies or recall material already downloaded. Contact support@myvonora.com for help, including if you cannot sign in. Children’s information is not authorized for advertising, sale, public sharing, or model training.

Reading and your privacy

Reader is designed for learners with visual impairments or dyslexia. Account holders prepare books and manage their accounts; students use the prepared books to read or listen. Students do not need a separate account to read books prepared in the same browser. Avoid including unnecessary identifying or sensitive information in account fields or materials sent to network services. Contact support@myvonora.com with questions about your information.

Copyright reports

Copyright reports and responses contain contact details and information about disputed material. We use them to investigate and handle claims and may share relevant details with affected parties, advisers or authorities. Statutory counter-notices are forwarded to the complainant, including required contact information. Do not include children’s information. See our Copyright reporting process.

Updates

We will update this notice as practices change and show the revision date. Contact us if you need help understanding how a particular feature handles your information.