Privacy policy — updated 22 October 2026

Novelkora is an English-language free reading and author publishing service. The site processes account email addresses, display names, salted password hashes, account roles, reading history, library selections, reviews and content supplied by authors to operate the service.

Login sessions are typically valid for up to 14 days. Necessary session and CSRF cookies help authenticate users and protect forms. The site keeps registration and publishing records in Supabase hosted in the United States and related uploads in Supabase Storage. Service providers may process technical request metadata for hosting and security.

Account security: Authenticator two-factor verification is optional and must be enabled by the account holder. Authenticator setup keys are encrypted on the server and recovery-code verifiers are stored as one-way hashes. If transactional email is connected, we send single-use confirmation links that expire after 24 hours. A legacy account may not have gone through confirmation.

Optional advertising: Google AdSense is loaded only after the visitor allows optional ad cookies, when an advertising account is configured. Visitors can decline and change their choice using Cookie choices. Advertising technology, vendors, and geographic consent requirements may change; a Google-certified consent management platform may also be required before serving personalized advertising in regulated regions.

Data requests: account holders may request access, correction or deletion of personal data via the operator contact channel when configured. Limited records may be retained for legal obligations, abuse prevention and dispute resolution. Actual retention schedules, cross-border transfer notices and any jurisdictional rights must be finalized by the operator before commercial operation.

This document currently lacks a verified legal operator name, postal address and confirmed support inbox. The site operator must provide accurate details before commercial launch; no information should be assumed from the domain name.

Operator contact details are being prepared; a verified contact email must be added before ad monetization or public submissions.