Privacy

Effective date: 31 October 2026.

Panda is a cultural reading app for iPhone, Mac and Web, published by Luke Bradford. You can browse bundled native content without a Panda account. Optional accounts provide saved-post syncing and link subscription access across platforms. The website currently requires separate private-preview access.

Information on your device

The apps store feed selections, guest saves, reading positions, library organisation and appearance preferences locally. The Mac app also stores personal EPUBs and writing drafts locally. The website stores reading progress, tags, guest saves and preferences in that browser. These features do not synchronise reading positions, writing drafts or personal-library organisation through your Panda account.

Deleting an app or clearing browser data can remove local information and changes that have not yet synced. Device backups may include app data. Keep your own copies of personal books and writing.

Panda accounts and saved posts

Optional Sign in with Apple identifies your Panda account. Panda's server stores Apple's account identifier, an internal Panda account identifier, account/session records, encrypted sign-in grant information and subscription verification records. The current account database does not store your Apple-provided name or email address as account profile fields, and Panda does not merge accounts by email. Apple processes information you choose to share during sign-in.

When you sign in, saved feed-post IDs and save/unsave operation records sync through Panda's account service between the apps and website. The service stores these IDs and sync bookkeeping, rather than uploading the text of your posts, your EPUB files or reading positions. Offline changes are queued locally until they can be sent. Signed-out saves remain separate from account saves.

Native sessions are stored in Keychain; the website uses a secure session cookie. The private website also uses a separate preview-access cookie. Local browser storage retains account-specific save caches and pending changes. Signing out separates the guest collection from your account's local cache.

Account deletion

Use Delete account in Panda's Account controls. After successful confirmation, Panda removes the account identity, saved posts, saved-operation records, sign-in grants and sessions from its active account database and disconnects the stored Apple sign-in grants. A minimal record of the deleted internal account ID and deletion time remains to reject stale requests. Subscription records can remain without the account link, including the original Apple transaction identifier, purchase environment, expiry/status and last check time, to prevent a previously linked purchase being assigned again.

Account deletion does not cancel an Apple subscription, erase other devices' local files or delete books from your private iCloud transfer storage. Manage the Apple subscription separately before deleting your Panda account if you want to stop renewal.

Subscriptions

Apple processes purchases and billing. Panda verifies subscription information with Apple and stores the account association and entitlement records needed to provide access and prevent purchase reassignment. Panda does not receive your payment-card information. Manage or cancel your subscription in your Apple Account settings. The current private test service uses Apple's Sandbox purchase environment.

Personal books and iCloud

Send to Device transfers selected personal EPUBs through the existing private CloudKit database associated with your iCloud Apple Account. Sending and receiving devices need access to that same iCloud account. This is separate from Panda account sign-in and saved-post syncing. Removing a book from a device does not imply deletion of its cloud transfer copy.

Content, sources and other services

The native apps include offline content and can check Panda for verified content updates. Wikipedia/Wikimedia requests supply verified biographies, portraits and book synopses, with local caches and source/licence credits. Opening source links visits those external services. Sharing sends the selected content to the app or service you choose. Panda does not include advertising or third-party analytics SDKs.

The Panda website/account service uses Render hosting and Neon PostgreSQL. Those services process technical requests and the account records needed to operate Panda. Apple, Wikipedia/Wikimedia and hosting providers handle their services under their own policies. Panda's support-information pages are hosted on GitHub Pages.

Requests to Panda and its providers can include technical information such as your IP address, browser/app information and the resource requested. Panda temporarily uses connection addresses to limit abusive requests. GitHub Pages also receives technical requests when you visit these support pages. These pages have no analytics scripts, advertising, contact forms or embedded tracking tools.

Service-provider information: Apple, Render, Neon, Wikimedia, GitHub, Google and Namecheap. Providers may process information in countries other than yours. Contact the privacy address below for questions about Panda's providers and international processing.

Why information is used and how long it is kept

Account identifiers, saved-post records and subscription information are used to supply the account, syncing and subscription features you request. Sign-in security records, request limits and purchase/deletion safeguards protect accounts, prevent abuse and prevent purchases being reassigned. Support correspondence is used to respond to your enquiry. Where data-protection law requires a lawful basis, these purposes rely on providing the requested service and legitimate interests in security, fraud prevention and responding to support, as applicable.

Active account and synced-save records remain while you keep the account; signing out does not delete them. Account sessions expire after 30 days and sign-in challenges after 10 minutes. Expired records are removed during subsequent session/challenge creation. Purchase-protection and deleted-account records are not automatically erased when an account is deleted or a subscription expires; they are retained for the safeguards described above. Local files and browser caches remain until removed through the app, browser or device controls. Provider logs and backup copies follow the relevant provider's retention arrangements; deleting an active account does not promise immediate removal from every backup.

Support and diagnostics

If you contact support, we use your email address, message and any attachments to respond. Support email is handled through Gmail. Please send only what is needed to explain your issue, and never send passwords, account tokens or payment details.

Support correspondence is deleted within 12 months after your issue is resolved, except records that must be retained by law. Information kept for a legal requirement is retained for the required period. You can request access to, correction of or deletion of support correspondence using the contact below.

Apple may process diagnostics under your device settings. During beta testing, TestFlight can make feedback and crash information available under Apple's TestFlight practices.

Your choices and privacy requests

You can use bundled native content without signing in, sign out, remove saved posts, delete your Panda account, and manage local information through your device or browser. If you need help accessing, correcting, obtaining a copy of, or deleting information held by Panda, contact the privacy address below. Where applicable law provides these rights, you can also request restriction or portability and object to processing based on legitimate interests. Requests may require enough information to verify the account involved; never email passwords or session tokens.

You can raise a concern with your local data-protection authority. Information about UK rights and complaints is available from the Information Commissioner's Office; EU authorities are listed by the European Data Protection Board.

Publisher and contact

Publisher and data controller: Luke Bradford.
Email the privacy contact.