Privacy Policy

Last updated: September 5, 2026

This policy describes what personal data MakaronHub collects, why we collect it, how long we keep it, and what you can do about it. Our aim is to collect as little as possible and to be specific rather than vague about the rest, so that you can judge for yourself whether you are comfortable with it.

MakaronHub is run by an independent creator, not a large company. If anything here is unclear, if you want to know what we hold about you, or if you want your data removed, contact us through the Contact page and we will respond.

1. Information We Collect

When you log in via Patreon to access exclusive chapters, we collect basic profile information provided by Patreon. This includes your:

• Patreon ID
• Email address
• Full name (as listed on Patreon)
• Avatar image URL
• Your membership status and tier for each creator you support on MakaronHub (for example, whether a membership is active, free, or cancelled)
• The date your earliest Patreon membership began, which Patreon returns alongside that membership status — a date only, with no amount attached to it
• IP Address and User Agent (collected strictly to prevent account sharing and bot attacks)
• A record that your account opened a chapter, and when
• How long a chapter page was actually open and being read, and how far down it you scrolled — a number of seconds per chapter, nothing more (see “Automated access” below)
• What you write on the platform: comments, typo reports, suggestions and bug reports, and your biography if you set one
• Error logs from the site itself, kept by our hosting provider so we can find and fix faults. When something breaks in your browser we also record the fault itself — the error message, the page it happened on, and the size of your window, your browser and the theme you were using, because a layout fault usually cannot be reproduced without them. These are grouped by fault rather than by person: we count how many times each distinct problem happened, not who ran into it, and no account, address or browsing history is stored alongside them. We do not use a third-party error-tracking service, and nothing records your screen or your session.

How your membership data reaches us. There are two ways:

• When you log in with Patreon, which tells us which creators you currently support.
• A periodic background check: creators connect their Patreon campaign to MakaronHub, and we use that connection to refresh the membership list for their campaign on a schedule. This is what lets a series you just subscribed to on Patreon appear in your library without logging out and back in. It only ever covers campaigns belonging to creators who have connected their account to MakaronHub.

What we deliberately do not collect. Patreon's permissions are not fine-grained, so both of its consent screens grant MakaronHub broader access than we use, and this is the gap between what those screens say and what we actually take.

When you sign in as a reader, the narrowest membership permission Patreon offers is one it describes as covering pledges “including status, amount, and history”. There is no narrower version of it to ask for. What we then request from Patreon is your membership status, the tiers you are entitled to and the date that membership began — and nothing else, so no pledge amount ever reaches us.

When a creator connects their Patreon campaign, the same thing happens with that campaign's membership data:

• We ask only for each member's membership status and which tiers they are entitled to, and we match members by their Patreon account ID.
• We do not request or store pledge amounts, payment history, or billing details for any reader.
• Members of a connected campaign who have never signed in to MakaronHub are not recorded by us at all — if a Patreon account ID does not match an existing MakaronHub account, we skip it and keep nothing.

We do not have access to your credit card numbers or payment credentials. All authentication is securely handled by Patreon's OAuth service, and all payment processing for creators is securely handled by Stripe (a PCI-DSS Level 1 certified provider). We do not store, process, or transmit credit card details on our own servers.

1b. Age and Children

MakaronHub is intended for adults and older teenagers. It is not directed at children, no part of it is designed or advertised for them, and we do not knowingly collect personal data from anyone under 13.

The only way in is signing in through Patreon, and Patreon's own terms require you to be at least 13, so that is our floor as well. Depending on where you live you may need to be older than that, or to have a parent or guardian's permission, before you can agree to a service like this one or before your data can be processed at all — in the EEA and the UK that age is set country by country and falls somewhere between 13 and 16.

If you are a parent or guardian and you believe a child under 13 has created an account or sent us personal data, contact us through the Contact page and we will delete the account and everything held against it. You do not need to prove anything to us first; we would rather remove it and ask questions afterwards.

2. How We Use Your Information

We use the information we collect solely for the following purposes:

• To verify your active Patreon subscription tier, and to keep that verification current as your memberships change.
• To grant or restrict access to advanced and exclusive web novel chapters.
• To show creators who is subscribed to their own campaign, and to display your tier name next to your comments on that creator's series.
• To enforce our Terms of Service and maintain the security of our platform, including telling readers apart from automated scripts that download chapters in bulk.
• To diagnose technical issues, track errors, and monitor outages to improve user experience.

2b. What Other People Can See

Some of what we hold is shown publicly, and it is visible by default — you do not have to switch anything on. Anyone who opens your profile page can see:

• your display name, avatar and biography, and the date you joined;
• the comments you have written, with the series they were written under;
• your reading progress and how much you have read;
• which creators you support and at which tier.

Each of those can be hidden from the settings on your own profile page, and your profile shows you exactly what a stranger sees rather than a preview with your own extras added. Your email address, your Patreon ID and your reading history are never public.

Separately, a comment or a suggestion you post is public where you posted it, under your display name. Suggestions are also forwarded to the MakaronHub Discord server, with your display name attached, so that they can be discussed and voted on there.

A suggestion can be posted anonymously. Your display name and avatar are then left off the suggestion board and off the Discord message, and no other reader can see who wrote it. It is not invisible to us: the account that posted it is still recorded, so that our rules can be enforced against abuse of the option. Closing your account clears that link, as described below.

2c. Why We Are Allowed to Use Your Data

If you are in the EEA or the UK, the law asks us to name a specific reason for each use rather than rely on a general permission. Ours are:

• To provide what you signed up for. Checking your Patreon membership, unlocking the chapters it entitles you to, remembering your place in a series and your reading settings, and publishing your comments. Without this there is no service to give you.
• Our legitimate interest in keeping the platform running and its content protected. Preventing account sharing and bulk downloading, tracing a leaked chapter back to the account it was served to, moderating comments, and diagnosing errors and outages. We have weighed that against your privacy rather than assuming it wins: each use is limited to what its purpose needs, deleted on the schedule set out in section 6, and none of it is used to profile you, to advertise to you, or to follow you to other sites.
• Legal obligation. Where we have to keep or hand over something to comply with the law — responding to a valid copyright notice, for example.

Connecting a Discord account is the one part of this that is genuinely optional and asked for on its own. You can leave it unconnected. To undo it once connected, ask us through the Contact page and we will remove the link. There is a Disconnect button on your profile and it is switched off for now — we would rather tell you that than let you press something that does nothing. Deleting your account removes the link as well.

3. Silent Watermarking and Leak Tracing

Leak Attribution: Invisible digital identifiers unique to your account may be embedded into the member-only chapters served to you. They do not change what the chapter says, and they do not block or prevent copying by themselves.

The identifiers are invisible to read and are not reversible on their own: they are keyed values, not your name in disguise, and nobody can turn a leaked chapter back into your account without a secret held on our servers.

Who can run the check, and what they see. The tool that performs it lives in the author dashboard, so the person who runs it on their own chapters is the author of that series, not only MakaronHub staff. When a copy is traced, that author is shown the display name, avatar and Patreon user ID of the account it was served to, and when it was served. They are not shown your email address; only MakaronHub staff can see that. Every run is recorded — who ran it, on which series, what the result was, and which account it named — and those records are kept for 24 months, as set out in Retention below.

A trace is not treated as proof. A watermark says which account a copy was served to, which is not the same as who redistributed it. The tool cross-checks each result against independent signals and refuses to name anyone at all when they disagree — for example when a copy has been edited to carry another reader's identifier. Where it does name an account, the limits of that finding are shown alongside it, and section 11 of the Terms of Service says the same thing: identification is assessed by a person before anything is acted on.

3b. Detecting Automated Access

Every chapter on MakaronHub sits behind a paid membership, and the way that content gets taken is a script signed in with a real account. To tell that apart from ordinary reading we analyse the pattern of requests made by an account, using the access records already listed in section 1 — nothing is collected for this that is not named there. We do not publish which of those signals weigh most, because that would be a guide to working around them.

What this is not. It is not an analytics or advertising product, it is never shared with anyone outside MakaronHub, and it does not read what you write, which chapters you enjoy, or anything about you as a person. The reading-time measurement records a number of seconds and a scroll depth per chapter — it does not record where your mouse went, what you selected, or what was on your screen.

No account is ever restricted automatically. The result of this analysis is a list shown to our moderators, together with the measurements behind it and a plain statement of what those measurements cannot prove. A person decides, and if they do restrict an account you are told what was decided and why, as described in the Terms of Service.

One automatic protection does exist, and it is not an account action. Our hosting provider (section 7) sits in front of every request, and it will briefly refuse a network address that sends far more requests in a few seconds than any browser does. Its own error page uses the word “banned”, which is misleading: the limit applies to an address rather than to an account, it lifts itself within seconds, it is not recorded against you, no person is notified, and it has no bearing on your membership or on anything above. If you meet it while reading normally, that is a fault on our side — please tell us.

Reading-time measurements are kept for 90 days and then deleted — see Retention below.

4. Cookies and Analytics

MakaronHub does not use advertising cookies, and does not sell or share data with ad networks. We use three cookies and one visitor-counting tool, all strictly to run, size and debug the site — and nothing else:

5. Data Security

• Traffic to the site is encrypted, and the database is encrypted at rest by our hosting provider.
• Your session cookie is encrypted and marked so that scripts on the page cannot read it. There is no MakaronHub password to steal — sign-in goes through Patreon.
• Nothing in our database can be read with the public key that ships in your browser; every read is made and authorised by our own servers.
• The tools that can name an account — the leak-tracing check and the moderation panels — record who used them, so that their use can be reviewed afterwards.

The credentials behind a creator's Patreon connection are kept apart from the database. The access tokens that let us read a creator's membership list are stored encrypted, and the key that decrypts them is not held in the database alongside them — it lives with the running application. A copy of the database on its own therefore does not yield a working Patreon credential. No such token is ever sent to a browser.

One limitation we would rather state than imply. That separation protects against the database being read; it cannot protect against someone taking over the running service itself, because anything able to use those tokens must also be able to decrypt them. No system is perfectly secure, and we do not claim otherwise.

If something does go wrong. If we discover a breach that has exposed your personal data and is likely to put you at risk, we will tell you directly — by email to the address Patreon gives us, and with a notice on the site — without undue delay, and we will say what was taken rather than only that “an incident occurred”. Where the law also requires us to report it to a data protection authority, we will, within the deadline that law sets. We will not wait until we have a complete picture before telling you that one exists.

6. Data Retention and Deletion

We keep your profile data for as long as your account exists. Access logs expire on a schedule, whether or not your account is still active:

• IP address and browser information attached to a chapter view are erased 90 days after that view. They exist to catch account sharing and bots as it happens, which an old record cannot do.
• The record that an account opened a chapter (account, chapter, timestamp) is kept for 24 months, then deleted. It is kept this long because it is one of the signals used to trace a leaked chapter back to its source.
• Records of leak-tracing checks (who ran the check, on which series, the result, and the account it named, if any) are kept for 24 months, then deleted. They exist so that use of the tool described in section 3 is itself on the record.
• How long you spent reading each chapter (a number of seconds and a scroll depth, used to tell readers apart from automated downloading) is kept for 90 days, then deleted. It is kept for a shorter time than the records above because it has only one use and nothing looks at it after that.
• Reports of faults in your browser (the error message, the page, and the window size, browser and theme of the most recent time it happened) are kept for 30 days, then deleted. It is the shortest period for stored records here because a fault nobody has seen in a month is either fixed or no longer worth fixing, and the record cannot help either way. These are stored per fault, not per person.
• Which devices you read on (a device identifier, the address you connected from and your browser’s description of itself) is kept for 48 hours after that device last opened a chapter, then deleted. It is the shortest period here because it has one purpose — the limit on how many devices can read at once — and once a device’s slot has expired the record does nothing. You can see this list yourself under the gear on your profile.
• Records of staff role changes (who granted or withdrew an author, moderator or reader role, on whose account, and when) are kept for 24 months, then deleted. They exist so that a change to what someone is allowed to do on the platform can be traced to the person who made it.
• Records of changes to a series’ protection settings (when leak tracing was switched on or off for a series, and when each chapter was published, returned to drafts, archived or withdrawn) are kept for 24 months, then deleted. They apply to authors rather than readers, and they exist so that a question about whether a chapter was protected when a copy of it went out has an answer on the record instead of resting on anyone’s recollection. They record what the setting was and when it moved; they do not record who changed it.
• Your reading position is kept while your account exists — it is a feature, not a log, and losing it would lose your place in a series.
• Moderation records — where a comment of yours was removed, or your account was restricted or suspended — are kept for 24 months, or for as long as the restriction is still in force if that is longer. Each record includes a copy of the comment it was taken over, because a record that cannot show what was actually said cannot be reviewed for fairness afterwards. This copy is kept even if the comment itself is deleted, and it outlives the deletion of your account.
• Discord support ticket transcripts — if you open a support ticket through our Discord bot in the MakaronHub server, the conversation can be saved by the support team as a transcript containing the messages, the names of everyone who took part, and the times they were sent. Transcripts are kept for 12 months, then deleted. They are stored privately and are reachable only through a link that expires 15 minutes after a member of the team requests it. Tickets opened in other people's Discord servers are never stored by us.

You can delete your account yourself at any time from the “Delete Account” button on your Profile page. That erases your profile, your comments and reactions, your reading history and progress, your typo reports, and your membership records. Once it is gone, the periodic membership refresh described above can no longer match you and will not recreate any record of your subscriptions. Authors are offered a second option first — archiving, which hides everything and erases nothing, so that closing an account is not the only way to step away.

Three things deliberately survive deletion, and you should know which.

• Suggestions you posted stay on the board they were posted to, still showing the display name you had when you wrote them — or no name at all, if you posted them anonymously — because other readers have voted on and replied to them. The link back to your account is cleared, so an anonymous suggestion becomes unattributable once the account is gone. Ask us and we will remove the suggestions themselves.
• Moderation records and leak-tracing records stay for the periods above, no longer linked to your account. They exist so that action taken against someone can be reviewed afterwards, which is not possible if closing an account erases it.
• Your Patreon ID, as described immediately below.

Backups are the one place a deleted copy lingers, and not for long. Deleting removes your data from the service straight away, but we take an encrypted backup of the database every night and keep each one for 14 days so that a fault or a mistake on our side can be undone. A copy of what you deleted can therefore sit in an unopened backup until that backup expires, at which point it is gone with it. Backups are never used for anything but recovery, and if we ever do restore from one we re-apply any deletion made since it was taken.

What you can ask us for: you can ask what personal data we hold about you, ask us to correct it, or ask us to delete it, by contacting us through the Contact page. Most of what we hold comes from Patreon, so corrections to your name, email or avatar are best made on Patreon itself, from where they will flow through to us. Deleting your MakaronHub account does not cancel or affect any Patreon membership — that relationship is between you and the creator on Patreon, and you manage it there.

Exception for abuse prevention: we keep your Patreon ID after deletion, on its own, so that a suspended account cannot be remade by signing up again. If you were an author and left an invoice unpaid, the amount owed is kept with it and is reattached if you register again with the same Patreon account — closing an account is not a way to shed a fee already charged, as section 2 of the Terms of Service sets out. Nothing else is kept with it, and it is not used for anything else.

6b. Your Rights Over Your Data

These rights come from the GDPR if you are in the EEA or the UK, and similar laws elsewhere give you most of them too. We do not check where you live before honouring one — if you ask, you get it.

• Get a copy. Ask what we hold about you and we will send it to you in a form you can read and reuse, so you can take it elsewhere.
• Correct it. See section 6 — most of it comes from Patreon, so that is usually the faster place to fix it.
• Delete it. The Delete Account button on your profile, or ask us. Section 6 lists the three things that deliberately survive and why.
• Object. You can object to anything we do on the legitimate-interest basis in section 2c. We will stop unless we can show a reason that overrides your objection, and we will explain which it was rather than just refusing.
• Pause it. You can ask us to stop using your data while a complaint or a correction is being sorted out, instead of deleting it outright.
• Withdraw the optional part. Ask us to remove a connected Discord account at any time, with no effect on the rest of your account. See section 2c for how.
• Complain. You can complain to the data protection authority in your own country without going through us first. In the EEA that is your national authority; in the UK it is the Information Commissioner's Office.

Ask through the Contact page. We will answer within 30 days, and if a request is one we cannot fully grant we will tell you which part and why, rather than letting it go quiet. We may need to confirm you control the Patreon account in question before acting on a request about it, because otherwise the request itself becomes a way to reach someone else's data.

We do not sell your personal information, and we do not share it for advertising. There is no “do not sell” switch here because there is nothing to switch off.

Nothing on this site restricts an account automatically. The bot-detection described in section 3b and the leak-tracing in section 3 both produce a list for a person to look at. A human decides, every time, and you can ask for a decision to be looked at again. The single automatic measure anywhere here is the temporary, address-level request limit described at the end of section 3b, which acts on a network address rather than on an account and is gone within seconds.

7. Third-Party Services

Our website relies on the following third-party services. Please refer to their respective privacy policies for more information on how they handle your data.

• Patreon — authentication and membership verification.
• Cloudflare — website hosting and delivery, the visitor counts described in section 4, and, since 2 September 2026, storage of the nightly encrypted backup described in section 6. Every request to the site passes through our hosting provider before it reaches us, so it necessarily sees your IP address and browser information. The backup is encrypted before it leaves the machine that made it, so Cloudflare cannot read its contents.
• Supabase — database and file hosting. Your data is stored on their infrastructure, which may be located outside your country.
• Oracle Cloud — runs our Discord bot. It is only involved if you use Discord with MakaronHub: messages in a support ticket pass through it on their way to the transcript described in section 6. It holds nothing of its own about readers who do not use Discord.
• Stripe — payment processing for authors only. Readers never enter payment details on MakaronHub.
• Discord — optional. If you choose to connect a Discord account, we store your Discord account ID so that server roles and chapter notifications can be linked to your MakaronHub account. You can leave it unconnected, and you can ask us to remove the link at any time (section 2c).
• Resend — sends the few emails we send. It is used for notices to authors about their own subscription, such as the advance warning before a price changes. If you are a reader, nothing here emails you and your address is not added to any mailing list. We do not use open or click tracking on anything we send.
• GitHub — runs the automated jobs that build, test and back up the site. The nightly backup is produced on their machines, so a copy of the database passes through them before it is encrypted and sent on, and a copy can rest there for the same 14 days stated in section 6. GitHub cannot read it, and nobody reads it in the ordinary course of things — it exists only to restore from.

7b. Where Your Data Is Processed

Your data does not stay in one country. The companies in section 7 are all based in the United States and run infrastructure across several regions, so your data is processed outside your own country and may move between regions as part of how those services normally work. Ordinary internet traffic also crosses borders on its way to us, which no website controls.

For readers in the EEA and the UK, this means data leaves that area. The protection for it comes from the data processing terms each of those providers applies as standard, which carry the European Commission's Standard Contractual Clauses and the UK addendum for exactly this purpose. We rely on those terms rather than on separate agreements of our own; MakaronHub is run by one person and has not negotiated bespoke arrangements with any of them, and we would rather tell you that than imply a level of contractual control we do not have.

We do not move your data anywhere beyond what running the service requires, and we do not transfer it to anyone who is not listed in section 7.

8. Changes to This Policy

We may update our Privacy Policy from time to time. Any changes will be posted on this page. Your continued use of the website after any changes indicates your acceptance of the updated policy.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us via the Contact page on this website.