Legal
Last updated: July 31, 2026
Novelmint is a product of TeamLesh LLC, a Washington limited liability company.
Three kinds of cookie and script run on Novelmint: strictly necessary cookies for authentication (Supabase session tokens and PKCE OAuth verifiers); cookieless analytics via Vercel Analytics; and, for some visitors, advertising and measurement tags delivered through a Google Tag Manager container.
These maintain your login session and handle OAuth flows. They cannot be disabled without breaking authentication, and they set no third-party identifiers. No consent is required for strictly necessary cookies under ePrivacy regulations.
Two kinds of measurement run without a cookie for every visitor: Vercel Analytics, which collects anonymized page views, and our own reading counts, which record that a book page or chapter was opened, from which country, and how far it was read. Neither sets a cookie, and our reading counts use a code that changes every day, so no visit can be linked to another.
One analytics cookie is optional. If you allow usage measurement, we set a first-party cookie, nm_rid, holding a random code and nothing else. It lets us recognize your browser on a later visit, so an author can see that a reader came back, or that a link they shared led to a chapter read days later. It lasts up to a year. Where we are required to ask first, it is set only after you say yes; elsewhere it is set unless your browser sends Global Privacy Control. Withdrawing your answer deletes the cookie and removes the code from our records.
We run paid advertising on Google, Microsoft (Bing), Reddit and X, and we use their measurement tags to see which campaigns lead to signups and purchases. These tags set third-party cookies and can be used for retargeting. They are delivered through a single Google Tag Manager container, and the events we send it are limited to signup and purchase signals — never the content of your work.
In the EU, EEA, United Kingdom, Switzerland and India, the tag manager does not load until you have answered a notice. Not loaded and hidden: absent from the page. You can accept everything, accept analytics alone, or decline entirely, and the answer holds for a year or until you change it. Declining leaves the container permanently unloaded rather than loaded and told to behave.
Two cases where no notice appears and no advertising tag loads either. If your browser sends a Global Privacy Control signal, we treat that as your answer and never ask again, wherever you are, because asking someone to re-consent to something they have already refused is precisely what that signal exists to prevent. And in India, where the law prohibits behavioural tracking of under-18s outright rather than allowing it with permission, we do not ask, and load nothing, unless there is an adult date of birth on the account.
When you answer the notice we store a record: a random identifier held in a cookie on your own browser, which options you chose, which version of the notice you were shown, and the country the request came from. No IP address, no browser fingerprint, and no link to your account. It exists so we can show what was asked and what was agreed, and for no other purpose.
Change your answer at any time from Your Privacy Choices, where the same options are available as a button. Enable Global Privacy Control in your browser and we will not load advertising tags for you, anywhere. You can also block or clear cookies via your browser settings — note that blocking strictly necessary cookies will prevent you from logging in.
Other legal documents