Privacy Policy

When you use Fable, we may collect the following information:

• Account information — full name, email address, and password (or Google profile details if you sign in with Google).
• Profile & role data — whether you register as a Reader or Writer, and any profile picture you upload.
• Content data — ebook details, cover images, descriptions, and pricing submitted by writers.
• Transaction data — purchase history, sales records, and payment confirmations processed via Stripe.
• Usage data — pages visited, bookmarks, and reading history within your account.

We use the information we collect to:

• Create and manage your Reader, Writer, or Admin account.
• Authenticate you securely using JWT tokens and, where selected, Google OAuth.
• Process ebook purchases and writer verification payments.
• Display your published ebooks, sales history, and purchase history within your dashboard.
• Send essential account and transaction notifications, and, if you opt in, newsletter updates.
• Improve platform performance, security, and features.

All payments on Fable — including ebook purchases and one-time writer verification fees — are processed securely through Stripe. Fable does not store your full card details on its own servers; Stripe handles all sensitive payment information in accordance with PCI-DSS standards. We only retain transaction metadata such as amount, date, and status to maintain your purchase and sales history.

Fable relies on trusted third-party services to operate:

• Stripe — payment processing for purchases and verification fees.
• imgBB — hosting for ebook cover images and profile pictures.
• Google OAuth (via BetterAuth) — optional social login.

These providers only receive the information necessary to perform their function and maintain their own privacy and security practices.

Fable uses cookies and local storage to keep you signed in, remember your preferences, and maintain a secure session. Disabling cookies in your browser may limit certain features, such as staying logged in across visits.

We take reasonable technical and organizational measures to protect your data, including password hashing, JWT-based authentication, and environment-secured credentials for our database and API keys. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.