# Privacy **Built, Hosted and Operated by [REVA Digital LLC](https://reva.faith).** REVA is responsible for site administration. Reading the site needs no account. Writing, voting and reporting require sign-in using the options available on the sign-in page; REVA sign-in is used when it is configured. This page describes public information, private service records and role-based access. ## Participating-company access Representatives with assigned moderator or organization-administrator roles can inspect submitted reviews, reports, appeals, proposals and relevant moderation records, including review text that is not public yet. This enables monitoring and participation in moderation approvals. Those roles do not automatically grant REVA's operating functions: account administration, private support and maker request inboxes, or seller-link agreements. These remain operator responsibilities. Company names shown only as collaboration placeholders do not establish that access has been granted. Public organization and moderator counts describe assigned access, not a completed independent audit. ## What becomes public with a review Your text, the meters, where it helped and where it got in the way, the edition, your badges (counted or not, verified use or self-reported use, vetted, insider), and your tradition and role line only if you chose to show them. Your name and photo appear only if your REVA web profile is switched on; otherwise the byline reads "REVA reader". Anyone can read a review, search engines index it, and it stays public until you withdraw it. ## Automated screening When automated screening is enabled, a submitted review's text (the title, the body, the "helped" and "got in the way" points, and the connection note if you wrote one) may be sent to a third-party classifier, OpenAI's moderation endpoint, which returns labels such as harassment or hate. The request does not separately attach your account name, email, user id, pseudonym, tradition or reading facts. The submitted review text can still contain information you wrote yourself. The labels are kept with the review for the moderators, counted in aggregate on the [transparency page](/trust/transparency), and never published or written to the public log; the log records only that a screen happened and its result. A label puts the review first in the human queue and does nothing else. The screening provider handles the submitted text under its applicable service terms and retention policy. Screening is optional; a disabled screening service does not imply that a provider received the review. ## What is never published Your email or phone, your reading record, the content of any note, highlight or bookmark, any evidence used for verification, and your REVA user id. Tradition segments appear only at 5 or more reviewers, so a tradition you choose to show cannot single you out on a listing with few reviews. Nothing about a child is ever published. ## Sign in with REVA When REVA sign-in is configured, it uses OpenID Connect with id.revabible.com. You are sent there, you sign in, and you are brought straight back. This site never sees your password. REVA tells us who you are by a stable identifier and, with your consent, the facts below. If you decline the reading consent, you can still sign in, write and vote; the activity rule is off at launch, and verified use will simply not be shown on your reviews. ## The facts we read from REVA, with consent The counting rule uses account age, and later may use reading activity, to keep fake reviews out without a paid gate or a phone check. For that we read three things from your REVA account: - When the account was created. - How many distinct chapters you have read, as a count. - How many notes, highlights and bookmarks you have, as counts. We read counts only, never the content: not which chapters, not what a note says, not what you highlighted. The counts are refreshed when you sign in. The token that lets us read them is encrypted at rest and kept only for that purpose. None of these counts is published, and none is in the public log; the log records only whether a review counted and, if not, the printed reason. ## Pseudonyms in the public log Every vote, review, helpful click and account creation writes an event to the [public vote log](/trust/verify), which anyone can download. The log never contains your name, email, user id or text. Instead: - Each vote carries a pseudonym made from your user id and the listing with a keyed hash (HMAC-SHA256), so the log shows that one person voted once on that listing without showing who. Your pseudonym differs on every listing, so your votes cannot be joined across listings. - Your account creation carries a second pseudonym made with a different key, so account events cannot be joined to votes by anyone outside. The join is ours to assert when a review starts counting, and nobody outside can make it. - Review text is hashed with a per-review salt (SHA-256). The hash reveals nothing about the text. The two keys are server-side configuration secrets and are not sent to browsers. Stable keys preserve pseudonym continuity; rotating them would make an existing voter appear under a different pseudonym. Tradition appears in the log only as the display value you chose to show, which is already public on the review. ## Withdrawal and erasure You can withdraw a review at any time from My reviews. The text is deleted from our database and from the page. The log keeps the event with its hash, which reveals nothing about the text: a verifier can see that a review existed, counted from a date, and was withdrawn by its author on a date. That is the same outcome the [moderation policy](/trust/moderation) already promises for removals, made unforgeable. A legal right to erasure is honored the same way, for every review and vote on the account: text deleted, name and email deleted, account closed, hashed events kept. The events cannot be deleted, because the chain and its anchors would no longer match, and they contain nothing that identifies you. The outcome is listed, without your name, in the [takedown log](/trust/takedowns). ## What else we keep - Your email, for sign-in and for notices about your own reviews, appeals and requests. Never published, never sold, never used for marketing. - Sessions, with the IP address and browser they were started from, for security. You can sign out everywhere from your account. - Rate-limit counters by IP address, for a short period. - Reports you file, and requests you send, with your name and email if you give them. A private person named in a report is never published. - Maker contacts from the [maker form](/makers/add). A maker contact's name and email are never published. We use no third-party analytics or advertising trackers. Cookies are used for your session and your preferences only. ## Makers A maker account or seller agreement does not grant moderation or administrative access. Authorized representatives of a participating company can separately receive a moderation role; that access is for review-process duties and is subject to conflict disclosure and recusal. It is not an entitlement attached to being a listed maker, and criticism alone is not grounds for removing a review. ## Your rights Ask us for a copy of what we hold about you, to correct it, or to erase it, from your account page. We answer within 30 days. The parts that cannot be erased, the hashed events in the public log, are listed above, and they are the same for everyone, including us. ## Support and seller-link requests Support messages can contain your name, reply email, company or organization, the resource and destination you want reviewed, and your message. These details are kept in the staff request inbox rather than public reviews or listings. An approved seller destination and its public commercial disclosure may appear on the resource page; contact details and private approval notes do not. Approved seller links take you to an external destination. The destination handles its own accounts, purchases and privacy practices. You can inspect resource details and reference citations without using a seller button.