Privacy Policy

1. About This Policy

This Privacy Policy (the "Policy") explains how Bookleap collects, uses, stores, shares, and protects information about you when you use the Bookleap mobile apps for iOS and Android, widgets and Live Activities, the Bookleap website, server sync, online book search, data import, public links, the Premium subscription, advertising, website forms, and support (together, the "Service").

This Policy covers both using Bookleap without an account (when most data stays only on your device) and cloud features that send data to the servers of Bookleap or our providers.

This Policy does not apply to third-party websites, services, or apps that Bookleap may link to (for example, the App Store, Google Play, Google Books, Open Library, or Rork). Their data practices are governed by their own policies.

By using the Service, you confirm that you have read this Policy. If you do not agree with it, please do not use features that require the relevant data processing, or stop using the Service.

2. Definitions

• Personal data: any information that directly or indirectly identifies you as an individual, such as your email, name, account identifier, IP address, or advertising identifier.
• Processing: any operation on personal data, including collection, recording, storage, modification, use, transfer, de-identification, and deletion.
• User content: everything you add to Bookleap yourself: books, ratings, notes, quotes, characters, covers, images, categories, tags, and goals.
• Local data: data stored only in the app's storage on your device and not sent to Bookleap servers.
• Synced data: data sent to Bookleap servers for backup, recovery, and sync across devices.
• Provider (processor): a third-party company that processes data on our behalf or provides infrastructure to us, such as hosting, file storage, analytics, or subscription processing.
• Controller: the party that determines the purposes and means of processing personal data. For the Bookleap Service, the controller is Bookleap.

3. Who Is Responsible for Your Data

The controller of personal data processed within the Service is Bookleap, the owner and operator of the Bookleap apps and website. In this Policy, "we", "us", and "our" mean Bookleap.

Contact for all privacy and data protection matters: bookleap.tracker@gmail.com. You can send requests for access, correction, export, restriction, or deletion of data, withdrawal of consent, complaints, and security vulnerability reports to this address.

Some third-party services, such as Apple, Google, RevenueCat, or ad networks, may act as independent controllers in certain scenarios for data they receive directly from your device or account. Their own privacy policies also apply in those cases.

4. Quick Summary

5. Data We Collect: Overview

We receive data from three sources: (1) directly from you, when you create an account, add books, write notes, or contact support; (2) automatically from your device, when you use the app or website; (3) from third parties you choose, such as Apple, Google, the App Store, Google Play, RevenueCat, or a service you import data from.

We do not intentionally collect precise geolocation, address book contacts, biometric data, health data, financial account details, or payment card data.

6. Account and Sign-In Data

When you create an account or sign in to Bookleap, we process your user identifier, email, name (if provided), login, password hash, access and refresh tokens, account creation date, last update date, session state, linked sign-in method, and technical records needed for secure authentication.

Sign in with Apple. If you choose Sign in with Apple, we receive a stable Apple user identifier, your email (or an Apple private relay address if you chose "Hide My Email"), and your name if you allow it to be shared. We do not receive your Apple ID password.

Sign in with Google. If you choose Google sign-in, we receive your Google account identifier, email, email verification status, name, and, if available, a profile picture URL. We do not receive your Google password and have no access to your Gmail, contacts, or Google files.

Login and password. Passwords are stored only as salted cryptographic hashes. We do not store passwords in plain text and cannot view or send them to you.

Authentication tokens are stored on your device in the platform's secure storage (such as the iOS Keychain) or in the app's storage, and are used only to confirm your session with our servers.

7. Your Library and Reading Content

Bookleap processes the data you add to your library: book titles, authors, translators, publishers, ISBNs, page counts, language, format (print, ebook, audio), reading status, start and finish dates, ratings, reviews, tags, genres, categories and shelves, favorites, a "books to buy" list, reading goals, streaks, and other fields used to organize your library.

Reading sessions: the related book, start and end time, duration, pages read, starting and ending page, activity history, and the statistics, calendar, and forecasts calculated from them.

Notes, quotes, characters (name, gender, role, age, traits, description, photo), note pages, and other book-related records are your user content. You keep all rights to it. We use it only to display, store, sync, and restore it for you.

We do not manually read your user content, analyze it for advertising, or use it to train artificial intelligence models. Staff access is possible only in the cases described in "Bookleap Team Access to Data".

8. Covers, Images, and File Import

If you add book covers, character photos, or other images, Bookleap processes the file and its metadata: name, type, size, checksum, storage key or path, linked record, upload date, and update date. For synced accounts, files are stored in cloud object storage and accessed through temporary signed links rather than public URLs.

File import (PDF, EPUB, FB2, including ZIP archives). When you import a book file, the app reads its metadata (title, author, language, page count) and cover to create a library record. We use the file only for this purpose, do not publish it, and do not share it with third parties.

Please upload only images and files you have the right to use, and do not add photos of other people without their consent.

9. Device Permissions

Some features need access to device resources. Bookleap requests permission only when it is needed for a specific action, and you can deny or revoke it at any time in iOS or Android settings. Without a permission, the related feature will be unavailable, but the rest of the app continues to work.

10. Online Book Search and External Metadata Sources

When you search for a book online or scan an ISBN, the query or ISBN is sent to Bookleap servers and then to external metadata sources such as Google Books and Open Library, as well as Bookleap's own catalog. These sources return the title, author, cover, description, page count, categories, ISBN, and other bibliographic data.

We send external sources only the query text or ISBN, without your email, name, or account identifier. These services may still see our servers' IP address and technical request data under their own rules.

Covers obtained from external sources may load directly from those sources' servers, so they may see your device's IP address.

11. Shared Book Catalog and Moderation

To make search faster and more accurate, Bookleap maintains a shared catalog of bibliographic data: titles, authors, ISBNs, publishers, languages, page counts, descriptions, and book covers.

When you add a book that is not yet in the catalog or correct its bibliographic data, this de-identified bibliographic data may be submitted for moderation and, after review, added to the shared catalog. Your ratings, statuses, notes, quotes, characters, sessions, email, and other data that identifies you are never added to the catalog.

Bookleap moderators may review, correct, merge duplicates, replace covers, or reject catalog records. If you do not want the bibliographic data of a book you added manually to enter the catalog, contact us.

12. Public Links and the "Books to Buy" List

Bookleap lets you share the list of books you want to buy through a public link. The page at that link is available to anyone who has the link, without signing in.

The public page shows only data about the books on the list: title, author, ISBN, publisher, language, page count, and cover. The link contains a technical identifier of your account, but the page does not show your email, the rest of your library, notes, quotes, or statistics.

Anyone you share the link with can forward it to others. To stop access, turn off public sharing or clear the list in the app, or contact support. We mark these pages with directives that tell search engines not to index them, but we cannot guarantee that third parties will not save a copy of the page.

13. Importing Data from Other Services

The Bookleap website offers a tool for moving data from other reading services (currently Rork). To retrieve your data, you enter the login and password for your account on that service. These credentials pass through the Bookleap server to that service only to sign in and retrieve your data once.

We do not store your third-party service password or use it for any other purpose. A temporary access token is kept in your browser's local storage until you sign out of the tool or clear the site's data.

The retrieved data (profile, books, progress, collections, reading sessions, and activity) is used only to build an export file or move it into your Bookleap library. By using import, you confirm that you have the right to access that account and that using the tool does not violate that service's terms.

14. Website, Forms, and Communications

You do not need to register to visit the Bookleap website. The site's server and hosting provider automatically process standard request data: IP address, browser type, language, requested page, referring URL, and date and time.

Early access and Android tester forms (now closed). If you submitted your email, we received the address, the page language, and the form source. We use this only to send you a testing invitation or launch notice, and we do not add you to marketing emails without separate consent.

Website form submissions are delivered to our team through a secured bot in the Telegram messenger. Telegram therefore technically processes the content of these messages as a delivery provider.

Support requests. When you email us, we process your address, name, the content of your message, attachments (such as screenshots), and any device information you provide. We use this data only to respond and resolve your issue.

15. Cookies, Local Storage, and Similar Technologies

The Bookleap website uses a minimal number of cookies and browser local storage entries. The iOS and Android apps do not use cookies in the usual sense, but may store settings and identifiers in app storage.

The website does not use advertising or retargeting cookies. Google Analytics 4 loads only after you allow analytics cookies. It measures public page views, campaign sources, and store clicks. We send only supported UTM campaign labels, not other query parameters, private page addresses, account identifiers, or form values. You can change your choice using Analytics settings on public pages.

You can delete or block cookies and local storage in your browser settings. Blocking necessary entries may break some site features. Where required by law, optional cookies are set only after your consent.

Do Not Track and Global Privacy Control. We treat a Global Privacy Control signal as a request to opt out of sharing data for targeted advertising where the law provides for it. Because there is no common standard for Do Not Track, the website may not respond to it separately.

16. Technical Data, Device Data, and Logs

When you use the app or website, we process technical data: device model and type, operating system and version, app version, language, theme, time zone, IP address, network state, error codes and stack traces, sync events, diagnostic messages, request URL, request date and time, and response code.

This data is needed for security, stability, detecting and fixing errors, preventing abuse (such as password guessing or automated requests), measuring performance, and supporting users.

We try not to write the contents of your notes, quotes, or library into technical logs. If such content is needed to investigate a specific error, we use it only for that purpose and for no longer than necessary.

17. Analytics

In the app, Bookleap may use Firebase Analytics (Google) and similar tools to understand how features work: app launches, screen views, tab switches, creating or editing books, sessions, and quotes, search and import events, errors, paywall interactions, Premium status, language, and theme.

On the website, we may record clicks on App Store and Google Play buttons, clicks on the support email, and form submissions, together with the language and button placement.

Analytics is not designed to collect the contents of your notes, quotes, or book titles. Events may include pseudonymous identifiers (such as an app instance identifier), technical parameters, and aggregated values.

You can limit analytics in your device settings (for example, by turning off analytics sharing on iOS or resetting your advertising ID on Android), through a consent dialog if one is shown in your region, or by contacting us.

18. Advertising

In the free version, Bookleap may show ads, including through Google AdMob. To do so, ad SDKs may process your advertising identifier (IDFA on iOS, Android Advertising ID), IP address, approximate location derived from IP, device model, OS, language, app information, and ad impressions and clicks. This data is used to show and measure ads, cap frequency, prevent fraud, and comply with legal requirements.

iOS. Personalized ads are shown only if you allow tracking in the App Tracking Transparency system prompt. You can change your choice in Settings → Privacy & Security → Tracking.

Android. You can reset or delete your advertising ID and turn off ad personalization in your device's Google settings.

EU, EEA, UK, and Switzerland. Before showing personalized ads, we ask for your consent through a certified consent management platform (such as Google UMP under the IAB TCF framework). You can change your choice at any time in the app settings.

We do not give ad networks the contents of your notes, quotes, or library, or your email or name. Premium users do not see ads, and no ad requests are made for them.

19. Subscriptions, Purchases, and Premium

Purchases, subscriptions, trials, purchase restoration, and Premium status are processed through the App Store (Apple), Google Play (Google), and RevenueCat. We receive and store a RevenueCat user identifier, active entitlements, product identifier, subscription status and dates, store country, and technical information needed to provide Premium features.

Bookleap does not receive or store your payment card number, expiry date, CVV, or billing address. Payment is processed entirely by Apple or Google under their own rules.

Cancellations, refunds, and payment method changes are handled in your Apple ID or Google Play settings. Deleting your Bookleap account does not cancel your subscription automatically.

20. Sync, Backups, and Server Processing

If you are signed in, your library, sessions, notes, quotes, characters, categories, files, and settings, together with technical identifiers, are sent to Bookleap servers. This is needed to keep a backup, sync multiple devices, resolve conflicting changes, and restore data after reinstalling the app or changing devices.

Sync uses record revisions, deletion markers, timestamps, and change queues. Deletion markers are kept for a limited time so your other devices learn that a record was deleted.

Data between your device and our servers is transmitted only over encrypted connections (HTTPS/TLS).

Without an account, data is stored only locally. It may be permanently lost if you delete the app, clear device data, lose your device, or switch to a new one without transferring data.

21. How We Communicate with You

We may send you service messages related to your account: replies to your requests, confirmations of data requests, notices of material Policy changes, security incidents, or important Service changes. You cannot opt out of these while you have an account, but we send them only when necessary.

We send marketing emails and news only with your consent. You can unsubscribe at any time using the link in the email or by contacting us.

The app may show banners about updates, new features, or Premium offers. These are based on the app version and subscription status, not on the contents of your library.

22. Bookleap Team Access to Data

Only authorized Bookleap team members who need it for their duties have access to server data. Access is protected by authentication and granted on a least-privilege basis.

We view a specific account's data only when: (1) you contact support and ask for help with your account; (2) we need to investigate a sync error, outage, or data loss; (3) we need to fulfill your access, export, or deletion request; (4) there are signs of abuse, fraud, or illegal activity; (5) the law requires it.

We do not view notes, quotes, or other private content out of curiosity, for marketing, or for any purpose unrelated to the cases above.

23. How We Use Data

• Providing the Service: library, reading journal, timer, statistics, calendar, goals, quotes, notes, characters, widgets, Live Activities.
• Account: registration, sign-in, access recovery, sync across devices, backups.
• Search and catalog: book search, ISBN scanning, metadata autofill, maintaining the quality of the shared catalog.
• Premium: verifying purchases, granting access to paid features, restoring purchases.
• Advertising: showing and measuring ads in the free version.
• Support: replying to requests, helping with data, import, and recovery.
• Security: protecting accounts, preventing fraud, spam, and abuse.
• Improvement: diagnosing errors, measuring performance, developing new features based on aggregated analytics.
• Legal obligations: complying with law, accounting requirements, and requests from competent authorities, and protecting the rights of Bookleap and users.

We do not use data for purposes incompatible with those listed above without prior notice and, where required, your consent.

24. Legal Bases for Processing

We process personal data only when we have a legal basis. For users in the EU, EEA, UK, and Ukraine, these bases are: performance of a contract with you (the Terms of Service); your consent; our legitimate interests, where they are not overridden by your rights; and compliance with a legal obligation.

Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect processing carried out before it, but may limit some features. Where processing is based on legitimate interest, you can object to it as described in "Your Rights".

25. Who We Share Data With

We share data only to the extent needed for a specific purpose and require providers to maintain an appropriate level of data protection.

We may also disclose data: (1) when required by law, a court order, or a binding request from a competent authority, after checking the request's legality and only to the minimum extent necessary; (2) to protect the life, health, safety, or rights of users, Bookleap, or third parties; (3) in a reorganization, merger, asset sale, or transfer of the Service to another operator, provided the new operator follows this Policy or notifies you of changes; (4) with your explicit consent.

26. We Do Not Sell Your Data

Bookleap does not sell personal data or exchange it for money or other value. We do not give data brokers access to your library, notes, quotes, or statistics.

Showing personalized ads through ad SDKs in the free version may count as "sharing" data for targeted advertising under the laws of some U.S. states. You can opt out as described in "Advertising" and "Additional Information for U.S. Residents".

27. International Data Transfers

Bookleap and our providers may process data in various countries, including the European Union and the United States. The level of data protection in those countries may differ from that in your country.

When we transfer data from the EU, EEA, UK, Switzerland, or Ukraine to countries without an adequacy decision, we rely on lawful mechanisms: the European Commission's Standard Contractual Clauses (SCCs), the EU-U.S. Data Privacy Framework (for certified providers), the UK Addendum to the SCCs, and supplementary technical and organizational measures such as encryption in transit and at rest.

To learn which safeguards apply to a specific transfer, email bookleap.tracker@gmail.com.

28. How Long We Keep Data

We keep personal data no longer than needed for the purpose it was collected for, or than the law requires. After that, data is deleted or de-identified.

29. Deleting Your Account and Local Data

You can delete your account in the app settings (if this feature is available in your version), through the account deletion page on the website, or by emailing bookleap.tracker@gmail.com from your account email with the subject "Delete Bookleap account". We may ask you to verify that the account belongs to you.

After verification, we delete the server account and all related records: library, categories, sessions, notes, quotes, characters, files and images, public links, linked sign-in methods, tokens, and sync settings. De-identified bibliographic data that has already entered the shared catalog is not linked to you and is not deleted.

Deleting the server account does not erase data that remains on your device. To remove it, use the in-app data clearing feature or delete the app. Also cancel any active subscription separately in the App Store or Google Play.

Deletion is irreversible. We recommend exporting your data before deletion if you may need it later.

30. Your Rights

Depending on where you live, you have the following rights regarding your personal data:

• Right to be informed: to know what data we process, why, on what basis, and who receives it. This Policy provides that information.
• Right of access: to confirm whether we process your data and receive a copy of it.
• Right to rectification: to correct inaccurate data or complete incomplete data. Most data can be changed directly in the app.
• Right to erasure ("right to be forgotten"): to have data deleted when there is no lawful basis to keep it.
• Right to restriction: to temporarily stop processing, for example while the accuracy of data is being checked.
• Right to data portability: to receive your data in a structured, machine-readable format (such as JSON or CSV) and move it to another service.
• Right to object: to object to processing based on legitimate interest, including profiling for advertising.
• Right to withdraw consent: at any time, without affecting processing before withdrawal.
• Right not to be subject to decisions based solely on automated processing that have legal effects.
• Right to lodge a complaint with a data protection supervisory authority.

How to make a request. Email bookleap.tracker@gmail.com from your account email and state which right you want to exercise. To protect your data, we may ask you to verify your identity and account access. You may act through an authorized agent if you provide proof of authorization.

Timing. We respond within 30 days of receiving your request. In complex cases, this may be extended by up to 60 more days; we will tell you and explain why. Requests are free, unless they are manifestly unfounded or excessive.

If we cannot fulfill a request fully (for example, because of a legal obligation to keep certain data), we will explain why. We will not discriminate against you for exercising your rights.

31. Additional Information for Users in the EU, EEA, UK, and Switzerland

If the General Data Protection Regulation (GDPR), UK GDPR, or the Swiss FADP applies to you, you have all the rights listed in "Your Rights", and the legal bases for processing are described in "Legal Bases for Processing".

You have the right to lodge a complaint with the data protection authority in the country where you live, work, or where an alleged infringement occurred. A list of European authorities is available on the European Data Protection Board (EDPB) website. We would appreciate the chance to address your concern first, and we will try to resolve it quickly.

The age of digital consent in EU countries ranges from 13 to 16. If you are below that age, consent-based processing must be authorized by your parent or legal guardian.

32. Additional Information for U.S. Residents

This section applies to residents of California (CCPA/CPRA) and other U.S. states with consumer privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and Oregon).

• Categories of data collected in the past 12 months: identifiers (email, account identifier, IP address, advertising identifier); commercial information (subscription status); internet activity (app and ad interactions); approximate location from IP; user content you add.
• Sources: you, your device, Apple, Google, RevenueCat, and the other providers described above.
• Purposes: the same as described in "How We Use Data".
• Sale: we do not sell personal data for money.
• Sharing for targeted advertising: possible only in the free version through ad SDKs, and only if you have not opted out.
• Sensitive personal information: we do not use it to infer characteristics about you.

You have the right to know, access, correct, and delete data, to opt out of sharing for targeted advertising, and to non-discrimination. To opt out, turn off ad personalization on your device, enable Global Privacy Control in your browser, or email bookleap.tracker@gmail.com with the subject "Do Not Sell or Share". If we deny your request, you may appeal by replying to our email.

33. Additional Information for Users in Ukraine

For users in Ukraine, processing is carried out under the Law of Ukraine "On Personal Data Protection". Under Article 8 of that Law, you have the right to know the sources of collection, location of your data, purposes of processing, and recipients; to access your data; to submit a reasoned request to prohibit processing or to change or destroy data; to protection from unlawful processing; to withdraw consent; to know how automated processing works; and to complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.

Information about the composition of data, the purposes of collection, and the persons to whom data is transferred is contained in this Policy and constitutes notice within the meaning of Article 12 of the Law.

34. Sensitive Data and Private Content

Book titles, quotes, or notes may indirectly reveal your interests, views, health, religious or political beliefs, sexual orientation, or other sensitive information. Bookleap does not require such information, does not draw conclusions about you from it, and does not use it for advertising.

Bookleap is not intended for storing medical, financial, government identification, or other highly sensitive records. Please do not add such information, or personal data about other people without an appropriate basis.

35. Security

We use technical and organizational safeguards appropriate to the nature of the data and the risks:

• Encryption in transit (HTTPS/TLS) between the app, the website, and our servers.
• Encryption at rest at the infrastructure provider level.
• Passwords stored only as salted cryptographic hashes.
• Short-lived access tokens with refresh and revocation.
• Temporary signed links for private files instead of public URLs.
• Separation and control of access to server records; team access only when needed.
• Regular backups and infrastructure monitoring.
• Dependency updates and vulnerability fixes.

No method of transmission or storage is completely secure. Data security also depends on you: use a device passcode, keep the OS and app updated, protect your Apple ID or Google account with two-factor authentication, and never share your password.

If a security incident occurs that may put your rights at risk, we will act to contain it, notify the competent supervisory authority where the law requires (within 72 hours under the GDPR), and notify you without undue delay if the risk is high.

If you find a vulnerability, please email bookleap.tracker@gmail.com with the subject "Security" and do not disclose it publicly until we have fixed it.

36. Children

Bookleap is not intended for children under 13, and we do not knowingly collect their personal data. If you are 13 or older but below the age of digital consent in your country (13 to 16 in the EU), use consent-based features only with permission from your parent or legal guardian.

Accounts we believe belong to children under 13 should not be shown personalized ads. If we learn that we have received a child's data without appropriate consent, we will delete it.

If you are a parent or legal guardian and believe your child has given us personal data, email bookleap.tracker@gmail.com.

37. Automated Decisions and Profiling

Bookleap automatically calculates statistics, reading streaks, goal progress, book and year completion forecasts, feature availability, Premium status, and sync state. These calculations are needed for the app to work and have no legal or similarly significant effects on you.

Personalized ads in the free version may rely on profiling performed by ad networks. You can opt out as described in "Advertising".

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

38. Links to Third-Party Resources

The website and app may contain links to third-party resources: the App Store, Google Play, book pages on Google Books or Open Library, social networks, and others. We do not control these resources and are not responsible for their privacy practices. We recommend reading their policies before providing any data.

39. Changes to This Policy

We may update this Policy when Bookleap features, providers, legal requirements, or data processing practices change. The latest update date is shown at the top of the page.

We will announce material changes (such as new processing purposes or new categories of recipients) in advance in the app, on the website, or by email. If changes require your consent, we will ask for it separately. Previous versions of this Policy are available on request.

40. Contact

For any questions about this Policy, privacy, data access, correction, export, deletion, advertising, analytics, sync, or subscriptions, email bookleap.tracker@gmail.com.

To help us respond faster, include your Bookleap account email, platform (iOS or Android), app version, country of residence (if relevant to your request), and a short description of your question. Never send us your password.