Security & Privacy
Why Security Scanners Flag This Site
Some automated security scanners may flag ReaderWrangler as suspicious. Here's why these are false positives:
"Obfuscated Scripts"
We use React and Tailwind CSS from CDN (unpkg.com, cdn.tailwindcss.com). These libraries are minified for performance, which looks like "obfuscation" to scanners. Our own code is fully readable.
"Suspicious HTML Elements"
Bookmarklets use javascript: URLs, which look like XSS attacks to automated tools. This is standard bookmarklet technology used by many legitimate tools (Pocket, Pinterest, etc.).
"Newborn Domain"
readerwrangler.com was registered in November 2025. New domains are flagged by some services simply for being new. This is a legitimate project under active development.
Privacy & Data Security
- No Account Required: No sign-up, no login, no personal information collected.
- Your Library Lives on Your Devices: All book data (titles, covers, folders, tags) is stored in your browser. If you use cloud sync, an end-to-end encrypted copy is stored on the sync service — encrypted before it leaves your browser, unreadable to the server or anyone else.
- Encrypted Data Transfer: When syncing between the bookmarklet and the app, your library data is encrypted end-to-end (AES-256-GCM) before it leaves your browser. The relay server stores and returns encrypted data it cannot read. Your encryption keys never leave your devices.
- Encrypted Cloud Sync, Not Readable Cloud Storage: The sync service holds only ciphertext it cannot decrypt. Your encrypted library persists there so your devices stay in sync; temporary transfer packets clean themselves up automatically. Regenerating your credentials in the app revokes the old channel and deletes its data from the server.
- Privacy-Focused Analytics: We use GoatCounter for basic traffic statistics (page views, referrers) and anonymous usage events (e.g., how often imports and backups occur) to improve the site. GoatCounter uses no cookies, collects no personal data, and does no cross-site tracking. Your book library data is never included in analytics.
- Open Source: All code is visible on GitHub. Security rests on encryption, not obscurity.
How the Bookmarklet Works
The bookmarklet is a small piece of JavaScript that runs on Amazon.com pages. Here's exactly what it does:
- Shows a navigation dialog with options
- When you click "Refresh Library Data", it loads the fetcher script
- The script reads your book data from the Amazon page you're viewing
- Your data is encrypted in the browser using your personal encryption keys
- The encrypted data is uploaded to the relay (a Cloudflare Worker)
- The ReaderWrangler app downloads and decrypts it using the same keys
The relay server only ever sees encrypted data. Your encryption keys are generated on your device and never sent to the server.
Run It Locally
Don't want to use our hosted version? ReaderWrangler is open source under the MIT License with Commons Clause. Download the source from GitHub (Code → Download ZIP), unzip, and open readerwrangler.html in your browser. No installation required.
The app runs entirely from your machine. The only external dependency is the relay for syncing data between the bookmarklet and the app — self-hosted users still use our Cloudflare relay for this, or can deploy their own using the source in the relay/ directory.
Contact
Questions or security concerns? Contact us: