Privacy notice

Honakari privacy notice

Version 2026-10-25. This notice describes the local reader, website and payment service when the relevant features are used. Website: https://honakari.pages.dev/. The former pandareads.pages.dev address retains Sandbox receipt recovery routes.

Who is responsible

Controller: Zehan Hussain, trading as Honakari, 7 Kenton Street, Oldham, Greater Manchester, OL8 2DB, United Kingdom. Privacy and support contact: Zehanhussain@live.co.uk.

Local reader and optional online features

The Windows reader stores imported copies, notes, highlights, progress, settings, local audio and licence material on your computer. It has no app login, cloud library, cloud sync, app telemetry service or shared online playlists. Your imported reading files and library searches are not intentionally uploaded. A token-protected loopback server may stream audio within your own device. Optional speech uses voices marked local by the browser engine. Local storage is not encrypted by the app; protect the device and keep backups. Uninstall preserves the local library; after backing it up, you can remove it using Windows file management. The seller cannot remotely erase your computer.

Optional discoveries request predefined factual catalogue metadata from Wikidata and may retrieve separately checked, credited Commons thumbnails. Providers receive ordinary connection information such as IP addresses; your imported files, reading history and library searches are not sent. Unsupported image licences use original category artwork. Disable online discoveries to stop new requests; existing local caches may remain. Reward outcomes/cooldowns and the publisher-trailer timer stay locally on the device. Trial activation records a hashed Windows installation ID and original dates as described under Online trial activation below. The publisher trailers use no third-party advertising SDK or advertising telemetry. Active Premium, trials and rewards are ad-free.

Website and reviews

Cloudflare hosts the website, Worker and D1 databases and processes ordinary connection/request information to deliver and protect the service. The current site has no third-party analytics script or advertising tracker. A note saved in a website demonstration stays in browser local storage and can be cleared there. Payment providers may use their own essential storage and security measures when checkout opens; their notices also apply.

Reviews are optional and moderated. With your consent, the seller collects the nickname, rating and text you submit, moderates them and publishes approved entries. Pending entries are private to authorised moderators. Reviews are self-reported experience, not verified purchases. Do not submit sensitive information or another person's private details. Withdraw publication consent or request removal through the privacy email; withdrawal does not undo earlier lawful processing.

The service uses legitimate interests in preventing spam to store a salted, rotating daily connection hash. Raw IP is not stored in the review database. On later submissions, hashes older than seven days are cleared and non-approved entries older than thirty days are deleted. Approved entries remain while published, until removed or a review shows they are no longer needed. Cloudflare hosting/security records are separate from these application tables and are governed by the applicable service settings and provider safeguards.

Payments, delivery and support

PayPal Sandbox is used separately for testing. Real payments use the Live merchant service with a separate Live database and webhook when checkout is opened. PayPal handles payment credentials under its own privacy notice. The seller does not collect card details, PayPal passwords or account verification codes.

For a purchase, Cloudflare D1 stores the product, total, order/capture references and status, seller/terms snapshot, digital-supply consent record and signed codes for delivery and recovery. A one-way PayPal buyer reference limits introductory friend-bundle eligibility. Checkout attempts use a rotating daily connection hash; records older than two days are removed on subsequent attempts. Raw IP is not stored in the payment application tables. A private receipt token is kept in browser session storage. Protect receipts, codes and private recovery tokens.

Contract performance supports order handling, verified delivery, activation assistance and re-supply. Legal obligations support required accounting records. Legitimate interests support proportionate fraud prevention, resolving disputes and keeping relevant evidence. Support correspondence contains the contact information, order references and fault details you provide. Send only what is needed; do not send passwords or card details. No automatic gift email or marketing email is configured.

Retention and recipients

Transaction, contract and refund evidence is retained for six years after the relevant tax year's end, and in any event for at least five years after the applicable 31 January tax-return submission deadline. A late return, actual legal obligation or active dispute may require longer retention. Routine support correspondence is retained for two years after resolution; material contract/dispute evidence follows its applicable longer period. The seller reviews retained data manually at least annually and on relevant rights requests. Accounting/support deletion is not currently automated. Records no longer needed for the stated purposes are deleted or anonymised. Credentials and private signing keys must not be placed in support correspondence or public records.

Cloudflare receives hosting/application data as the infrastructure provider. PayPal receives payment data and also uses information for its own payment, fraud, legal and account purposes under its own notice. These global services may process information outside the UK using applicable contractual and other lawful safeguards; see their current privacy/data-processing information or contact the seller for details of the arrangements relevant to your data. This notice does not claim that every provider record stays in the UK or that hosting keeps no logs.

Your choices and rights

Contact the privacy email for access, correction, erasure, restriction, objection or portability where applicable, to withdraw review-publication consent, or to ask about processing safeguards. Required accounting or dispute evidence can limit erasure. Requests are handled within applicable legal deadlines; the routine 14-day support target does not extend them. You may complain to the UK Information Commissioner's Office at https://ico.org.uk/.

No customer reading content is used for advertising profiles or marketing messages. Changes to analytics, advertising, payment providers or other processing require an updated notice before the affected processing starts.

Provider information: https://www.cloudflare.com/privacypolicy/ ; https://www.cloudflare.com/cloudflare-customer-dpa/ ; https://www.paypal.com/uk/legalhub/paypal/privacy-full .

Online trial activation

Starting or recovering the optional seven-day trial requires one internet activation. Honakari sends only a product-specific SHA-256 hash of the Windows installation ID, plus original trial dates when migrating an existing trial, to https://honakari.pages.dev. It does not send the raw Windows ID, documents, titles, notes or reading history. The server retains the hashed device identifier and original start/end dates while this trial offer is operated, to prevent repeated trials after app-data deletion. This pseudonymous record is processed for our legitimate interest in preventing trial abuse. A salted daily connection hash limits new activations; it is cleared after seven days on subsequent activations. Cloudflare receives ordinary connection information to host and protect the service. Contact Zehanhussain@live.co.uk for data rights, including objection or deletion requests, subject to applicable exceptions. A signed receipt then permits reading offline. Existing expired trials stay expired; verification of an active older trial keeps its original expiry. Free reading and valid paid licences do not need trial activation. Replacing Windows, spoofing identifiers or modifying the executable is outside this protection.