Privacy policy

Your reading stays yours.

Last updated 28 October 2026

Who we are

Ponder is published by Bukhari Ventures Ltd, a company registered in England and Wales. It decides how your personal data is used and is responsible for it under UK data protection law (the UK GDPR and the Data Protection Act 2018). “We” on this page means Bukhari Ventures Ltd. You can reach us at the address at the end of this page.

Your account

To read Ponder you create an account, so your reading is never lost: if you change phones, or delete and reinstall the app, everything carries on where you left it. There are no passwords. You sign in with Apple, with Google, or with a six-digit code we email to you.

For your account we keep:

• Your email address, to send you sign-in codes and to recognise your account. If you sign in with Apple and choose to hide your email, we receive a private relay address from Apple instead and never see your own. If you sign in with Google, Google shares your email address and your name with us, and nothing else.
• Your first name, so editions, your shelf and your gifts are prepared for you.
• Your date of birth, to confirm you are 13 or over (see Children below). We use it for nothing else, and it is never shown to anyone.
• How you signed up (email, Apple or Google) and, if you used Apple or Google, an identifier that company gives us for your account. It's a random string, not your Apple ID or Google password.
• When your account was made and last changed.

We use these to provide the account you asked for. In law, that is because they are necessary for our agreement with you to provide Ponder. We check your age because we have a legitimate interest in, and a duty of care for, keeping Ponder to readers old enough to agree to these terms.

Your reading

Your account keeps a copy of your reading, so it can be restored on any phone:

• which editions you have opened and finished, and when;
• your guesses, the stars you give and the lines you save;
• the letters Ponder writes to you;
• your settings, such as the time your edition arrives each morning.

This is part of providing Ponder to you. Some things stay only on your phone, such as how the app looks and whether you have added a widget.

Emails from Ponder

We email you sign-in codes when you ask for them. They are part of keeping your account secure, so you will always receive them.

We will only send you anything else, such as news of new editions or the year’s bound book, if you choose to hear from us. You can stop at any time with the link in any such email or by writing to us. Whether you hear from us never affects your account.

Anonymous reading feedback

When you open or finish an edition for the first time, or rate one, Ponder sends us which edition it was (and your stars, if you rated it), the app version, the kind of device you read on (iPhone, iPad, or an Android phone or tablet, never its model) and which update stream the app follows.

This feedback is kept apart from your account. It contains no name, email or device identifier, and we do not record your IP address with it, so it cannot be traced back to you. It goes to a private spreadsheet, hosted by Google, that only the editor can open. We use it for one thing: to learn which editions readers value most, and to make the next ones better.

The year’s book

If you ask to be told when the year’s bound edition is ready, Ponder sends us the email address you enter and your first name. We use them only to write to you about that book, and keep them in a private spreadsheet, hosted by Google, that only the editor can open. You can change the address in the app at any time, or ask us to remove it.

Gifts

When you send an edition as a gift, Ponder hands a link to your phone’s share sheet, and you choose who receives it. Your name, theirs and your note travel in the part of the link after the “#”, which browsers keep to themselves: it is never sent to our website, and we never see it. Gift pages are hidden from search engines.

If you are signed in, we also record that you sent a gift (which edition, and when) under a random code that travels in the link. If your friend opens it in Ponder, we record that it was opened, and whether it brought them to Ponder for the first time, so we can thank you with a ribbon on your reader’s card. We never record who a gift was for, and you can’t see who opened it, only that someone did. These records are deleted with your account. If you send a line as a card, the picture is made on your phone, and we never see it.

On your phone

• Notifications. If you allow them, Ponder schedules them on your phone to tell you your edition has arrived. We don’t run a notification server, and your phone never sends us a notification token.
• Widgets. Ponder passes today’s line to its widget through storage on your phone. It never leaves your device.
• Photos. Ponder asks to add to your photo library only when you save a wallpaper. It cannot see the photos already on your phone.
• Staying signed in. Your sign-in is kept in your phone’s secure keychain (the iPhone Keychain, or Android’s Keystore), not in ordinary storage.

Who helps us

A few trusted companies run parts of Ponder for us. They may use your data only to provide their service to us, under written agreements that require them to keep it secure:

• Supabase runs our accounts database and sign-in. Your account and your reading are stored in its data centre in London.
• Resend sends our emails, such as your sign-in codes.
• Apple, if you choose Sign in with Apple. Apple’s own privacy policy covers what Apple does.
• Google, if you choose Sign in with Google. Google’s own privacy policy covers what Google does.
• Google hosts the private spreadsheets for anonymous feedback and the year’s book.
• Expo delivers new editions and app updates, and hosts our website. As with any download, this involves standard technical details, such as your IP address, app version and type of device, which are needed to deliver the right files. We do not use them to identify you.

Some of these companies are based in, or may reach data from, outside the UK. Where that happens, your data is protected as UK law requires: the country is recognised by the UK as protecting data adequately, or the company has signed the UK’s approved data transfer terms.

How we keep it safe

• Everything travels over encrypted connections, and your account data is encrypted where it is stored.
• The database itself makes sure each account can reach only its own data. Nobody using the app, even someone who takes it apart, can see anyone else’s.
• There are no passwords to steal or reuse. Sign-in codes work once, for ten minutes, and repeated wrong guesses are blocked.
• Only the editor can see the databases and spreadsheets behind Ponder, and only to run and improve it. The editor’s own dashboard shows counts only, such as how many readers finished an edition, never who.

No system can be perfectly secure. If something ever went wrong that put your data at risk, we would tell you, and the Information Commissioner’s Office, as the law requires.

How long we keep it

We keep your account and your reading for as long as you have an account. If you delete your account, it is removed from our live database straight away. Any copy in our backups is overwritten within 30 days. Sign-in codes expire after ten minutes. Anonymous feedback is kept for as long as it helps us improve Ponder; it can’t be linked to you.

Deleting your account

You can delete your account at any time in the app: Settings, then Your account, then Delete my account. This removes your account, your profile and your reading from Ponder on every phone, at once. If you signed in with Apple or Google, Ponder is also removed from the apps that can use your Apple or Google account. It can’t be undone. You can also write to us and we will do it for you.

Your rights

Under UK data protection law you have the right to:

• see the personal data we hold about you, and have a copy of it;
• have it corrected if it is wrong;
• have it deleted;
• receive your account data in a common format, to take elsewhere;
• object to, or ask us to limit, how we use it;
• withdraw any consent you have given, such as to hearing from us.

Write to us at the address below and we will reply within one month. It costs nothing. If you are unhappy with how we have looked after your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113.

Children

Ponder is for readers aged 13 and over. We ask for your date of birth when you sign up, and the app does not let anyone younger create an account. If you believe a child under 13 has an account, write to us and we will delete it.

We never sell your data

We do not sell, rent or trade your personal data, and we don’t use it for advertising. If Ponder or Bukhari Ventures Ltd were ever sold or merged with another company, your account and reading would pass to the new owner so they could keep providing Ponder to you. They would have to look after it as this policy describes, and we would tell you before it happened.

Changes to this policy

If this policy changes, we will update this page and the date at the top. If the change is significant, we will also tell you in the app before it takes effect.

Contact

Questions about privacy, and requests about your data, are always welcome:

hello@readponder.app