Privacy Policy
This Privacy Policy describes how The Founders Ltd ("we", "us", or "our") collects, uses, processes, and discloses your personal information when you use the Scrolls mobile application and our marketing website (the "Service").
Last updated: 2 November 2026
The short version (for younger readers too)
We collect what we need to run Scrolls: your account, what you read, and what you post in book clubs. We do not sell your data or show you targeted ads. Every profile starts as visible to friends only, and you choose in Settings who can see yours. You can delete your account at any time. Questions? Email privacy@thefoundersgroup.co.uk.
1. Who we are
The Founders Ltd, trading as Scrolls ("we", "us"), is the controller of your personal data. We are registered in England and Wales (company number 17035648), at 22 Villiers Gardens, London, E20 1GW, United Kingdom. Contact: privacy@thefoundersgroup.co.uk.
This policy covers the Scrolls App for iPhone, our website thescrollsapp.com, and our dealings with authors and publishers (section 13).
If you join our newsletter on the website, we store your email address and a signup timestamp in Supabase, with the consent you give by ticking the consent box. We do not use a newsletter provider and have not sent a newsletter. If we start a newsletter, we will ask for your consent first. To be removed from the list, email support@thefoundersgroup.co.uk.
2. What we collect
| Category | What it includes |
|---|---|
| Account | From Google, your name, email and profile picture; from Apple, your name and email (which may be a private relay address); username; optional display name and avatar |
| Age | We ask for your birth month and year. We store only your age band (under 13, 13–17 or 18 and over) and the date you move into the next age band, never your full date of birth |
| Reading activity | Library, reading progress, bookmarks, XP, streaks, daily scroll counts, reading sessions and completed books |
| Reading preferences | The genres you pick when you start (for example mystery or poetry). They are kept on your device and saved to your account when you sign in. Your daily reading goal and reminder time stay on your device |
| Social | Friends, friend requests, blocked users, book club memberships and roles |
| Your content | Book club posts, bookmark labels and reports you make (including the reported user, the reason and context) |
| Purchases | Which titles and subscriptions you have, from Apple (or Google, if we make Scrolls available on Google Play) and RevenueCat. We never see your full card details |
| Device and usage | A random installation ID, app events (such as which book was opened and session length), device type, IP address and request data |
| Settings and cache | Theme, font size and reading preferences; downloaded book text and poems stored on your device |
| Newsletter | Your email address and signup timestamp, if you join on our website |
| Feedback | Feedback answers, age range and optional comments or email |
| Support | Emails and messages you send us |
3. How we use it and why
| Purpose | Legal basis |
|---|---|
| Creating and running your account, syncing your library and progress | Contract |
| Suggesting books that match the genres you picked | Contract |
| Giving you access to titles you bought or subscribed to | Contract |
| Book clubs, friends, posts and other social features | Contract |
| Checking your age band and applying protections for under-18s | Legal obligation and legitimate interests (keeping young people safe) |
| Moderating content, handling reports and keeping Scrolls safe | Legitimate interests and legal obligation |
| Understanding how Scrolls is used so we can improve it (analytics) | Legitimate interests |
| Keeping your newsletter signup | Consent (you can withdraw at any time) |
| Replying to feedback when you ask us to | Consent (you can withdraw at any time) |
| Answering support requests and complaints | Contract and legitimate interests |
| Keeping records for tax, accounting and legal claims | Legal obligation and legitimate interests |
We do not show advertising or use your data for targeted advertising, and we do not sell or rent your data. Books we feature in the App are chosen by us, and no one pays for them to appear. If we later let authors or publishers pay to promote their books, we will label promoted books clearly, will not use under-18s’ data to target them, and will update this policy before it starts.
4. What other users can see
Other users can see your username, display name and avatar. Friends can see your connected profile. Members of a book club can see your posts in that club, and your reading progress there if your profile settings allow it. Profiles start as visible to friends only; you can change this to everyone or no one in Settings. Other signed-in users can find you by username.
5. Who we share it with
We share data only with service providers who process it for us under contract or under their published terms:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Sign-in, database and file storage (including newsletter signups and feedback answers) | London, UK |
| Apple and Google | Sign-in; app distribution and payments (Apple, and Google if we make Scrolls available on Google Play) | Worldwide, including the US |
| RevenueCat | Confirms which purchases and subscriptions are active | US |
| PostHog | App usage analytics | EU |
| IONOS | Hosts our website | Germany |
| Google Fonts | Website fonts (receives your IP address when you visit) | US/worldwide |
| dictionaryapi.dev and PoetryDB | Supply word definitions and poems (they receive your IP address and the word or poem requested) | Their own servers, which may be outside the UK |
| Project Gutenberg | Source of some public-domain book files (receives your IP address and the book requested) | Its own servers, which may be outside the UK |
We may also share data if the law requires it, to protect someone’s safety, to prevent fraud, or with a buyer if our business is sold (we will tell you first).
6. Keeping your data secure
Data is encrypted in transit (HTTPS) and at rest. Database access is restricted so users can only see what they are allowed to. We do not store passwords. Data saved on your device is protected by your device’s own security.
7. How long we keep it
| Data | How long |
|---|---|
| Your account and reading data | While your account is open |
| Deleted accounts | Recoverable for 30 days, then permanently deleted automatically, or immediately if you choose permanent deletion. Posts in other people’s clubs are removed or shown as from a deleted user |
| Age band date | While your account is open |
| Purchase records | 6 years, for tax and accounting |
| Analytics events | 24 months |
| Newsletter signups | Until you ask us to remove you |
| Feedback answers | While useful to improve Scrolls; optional emails until you withdraw consent |
| Reports and moderation records | Up to 2 years, or longer if needed for a legal claim |
| Support emails | 2 years after the issue is resolved |
8. Analytics
We use PostHog, on its EU servers, to understand how the App is used. You control this with the ‘Share anonymous usage data’ switch in Settings > Privacy. It is on by default for guests and adult accounts, and off by default for accounts aged 13–17 and accounts declared under 13. Your own choice always takes precedence and is stored per account on your device. Analytics does not start until your choice or the applicable default is known.
Events are linked to a random installation ID, not your name or email, and include things like which book was opened, session length and which features were used. A book identifier can reveal which book you read, so this data is pseudonymous rather than anonymous. Person profiles and session recordings are turned off, and we do not send book text, dictionary queries or message bodies. Network requests expose your IP address to the receiving service. We have set PostHog to discard IP addresses, and the App asks PostHog not to use them to work out location.
Our legal basis is legitimate interests (improving Scrolls). You can switch analytics off at any time in Settings > Privacy, or object by emailing privacy@thefoundersgroup.co.uk.
Our website has no analytics and no advertising trackers. It loads fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so when you visit, your browser sends your IP address to Google. Our newsletter signup and feedback questionnaire use a hash derived from your IP address and request timestamps to limit repeated submissions.
Cookies: our website does not set cookies, and the App does not use cookies. If that changes, we will ask for your consent first and update this policy.
9. International transfers
Some of our providers process data outside the UK, including in the US. Where they do, we rely on UK adequacy regulations (for example for the EU and for US companies certified under the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Agreement or Addendum. You can ask us for details.
10. Children and teenagers
Scrolls is for people aged 13 and over. Signed-in users are asked for their birth month and year; we store only the age band and the date you move into the next age band, not your full date of birth. Users under 13 cannot create an account; anyone can read free books as a guest without an account. There is no parental-consent flow. If we find an account belonging to someone under 13, we delete it.
For users aged 13 to 17, we apply extra protections by default: profiles start as visible to friends only (as they do for everyone), analytics is switched off, we do not show advertising or profile them for marketing, and we take reports involving young people especially seriously. We design Scrolls with the UK Information Commissioner’s Age Appropriate Design Code in mind.
11. Your rights
You can ask us to:
- give you a copy of your data;
- correct it;
- delete it;
- restrict or object to how we use it;
- send it to you or another service in a portable format; and
- stop processing based on consent (for example, asking us to stop contacting you about feedback).
Email privacy@thefoundersgroup.co.uk. We will reply within one month. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or, in the EU, your local data protection authority.
California residents have the right to know, delete and correct their personal information, to limit use of sensitive information, and not to be discriminated against for using these rights. We do not sell or share personal information for targeted advertising.
12. Device permissions
The App uses internet access for sign-in, syncing, book content, dictionary definitions and poems.
If you choose a daily reading reminder, the App shows it as a local notification scheduled on your device. Your phone asks for permission only when you turn the reminder on, and you can turn it off at any time in Settings > Daily reminder or in your phone’s notification settings. We do not send push notifications from our servers.
The App does not play audio in the background and does not use your camera, microphone, location, contacts or calendar.
13. Authors and publishers
If you distribute your work on Scrolls, we also process the following, as described in your Author Distribution Agreement:
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Name, pen name, contact details, company and agent details | Managing your agreement | Contract | Agreement term + 6 years |
| Bank details | Paying royalties | Contract | Agreement term + 6 years |
| Tax residency, tax ID, tax residence certificate | Tax obligations and treaty relief | Legal obligation | 6 years after the tax year |
| Proof of rights documents | Checking you own the rights to each title | Legitimate interests | Agreement term + 6 years |
| Bio, photos, videos, interviews, testimonials | Promoting you and your titles | Contract and legitimate interests | Until you ask us to stop; archive copies may remain |
| Royalty, payout and overpayment records | Paying and reporting to you | Contract and legal obligation | Agreement term + 6 years |
| Author Portal login and activity | Running and securing the portal | Legitimate interests | Account life + 12 months |
We share author data with our bank and payment providers, accountants and legal advisers, HM Revenue & Customs where required, and Supabase. Bank details are collected only through our secure form or encrypted email.
14. Changes to this policy
If we make important changes, we will tell you by email or in the App before they take effect. The date at the top shows when this policy was last updated.
15. Contact us
The Founders Ltd (trading as Scrolls), 22 Villiers Gardens, London, E20 1GW, United Kingdom. Company number 17035648.
Privacy: privacy@thefoundersgroup.co.uk · General: support@thefoundersgroup.co.uk · Authors and publishers: authors@thefoundersgroup.co.uk