Privacy Policy

Information kept on your device

Books, reading positions, highlights, bookmarks, notes, searches, and library contents are not sent by the optional statistics or feedback features.

On iOS, the app stores privacy settings, drafts, and pending privacy requests in protected local storage excluded from device backups. Installation credentials are held in the device-only Keychain and are not synced through iCloud.

On Android, the app stores privacy settings, drafts, and pending privacy requests in app-private storage that is not included in Android cloud backups or device-to-device transfers. Installation credentials are encrypted with a key kept in the Android Keystore, and the encrypted values are likewise not included in Android backups or transfers. None of this information is included in Paper Reader library backup files.

A reinstall creates new installation identities; it cannot automatically act on records from the previous installation. On Android, restoring the app from a backup or moving it to a new device also starts without the earlier statistics or feedback identities.

Optional installation statistics

Statistics are off by default. On a new installation, the app offers a one-time first-launch prompt with Share basic statistics and Not now. Choosing Share basic statistics enables sharing after your choice is saved; choosing Not now leaves it off. You can change your choice later in Settings by turning Share basic installation statistics on or off. App updates preserve existing users’ saved choices and do not automatically enable sharing. Once a choice is saved, the first-launch prompt is not shown again. The app creates no statistics identity and sends no statistics request before you explicitly opt in. While you remain opted in, reports are sent only when the app is in the foreground. The service accepts an update at most once per server UTC day; a retry or time resynchronization may result in more than one foreground request that day.

On Android, the first-launch prompt is offered only when the app finds no earlier Paper Reader data on the device. If you update from an Android version without this feature, statistics stay off, the prompt is not shown, and you can turn statistics on in Settings. The prompt appears on the library screen, not over an open book. Pressing the Android Back button or closing the prompt dismisses it without saving a choice, so it may appear again on a later launch.

Each accepted report contains a random app-installation ID, device model, operating-system version, app version and build number. On iOS, the device model is the hardware model identifier (for example, iPad14,5) and the operating-system version is the iOS version. On Android, they are the model name and Android version reported by the device (for example, Pixel 8 Pro and 15), shortened if unusually long. Reports do not include a separate platform field, although these values may show whether a device runs iOS or Android. The service adds its own first-reported and last-seen timestamps. A separate random credential proves ownership of the installation; the service stores a hash of that credential. The ID links reports from the same installation, so the information is pseudonymous, not anonymous. It is not connected to an account.

We use these reports to count installations that chose to report and to understand which app versions are in use. They do not count every physical installation, person, or lifetime download. This feature does not collect book titles or files, reading positions, highlights, bookmarks, notes, searches, library contents, contacts, advertising identifiers, Android ID, device serial numbers, locale, or your device clock.

You can turn statistics off in Settings. The app stops new reports and requests deletion of the statistics record. If it cannot reach the service, it keeps a minimal deletion request on the device and retries during a later foreground activation after its retry delay, or when you choose to retry. An earlier activation may not send the request. Until deletion reaches the service, the record may remain. If you remove the app before the request can be delivered, the service expires an inactive statistics record after 90 days without a successful report. A minimal revocation record remains for at least 30 days to reject older in-flight reports.

On Android, the app’s stored credential may in rare cases become unreadable on the device. If that happens, the app cannot prove ownership of the statistics record, so it turns statistics off (if they were on), sends nothing further for that installation, and tells you that removal could not be confirmed. You can then choose Clear on this device to stop tracking the request. The record on the service stops updating and expires after 90 days without a successful report. If you turn statistics on again later, the app creates a new installation ID.

Feedback you choose to send

If feedback is enabled, it does not require statistics consent. Opening the form or saving a draft sends nothing. A request is sent only when you press Send feedback. It contains the category you selected (Bug, Idea, or Other), the message you typed, device model, operating-system version (iOS or Android), app version and build, and a separate random feedback ID. These device details are the same kinds of values described for statistics above. A random submission ID lets the service recognize a retry of the same request. The feedback ID is separate from the statistics ID and account sign-in, but it links submissions from the same app installation while retained. It is pseudonymous, not anonymous.

The message is user-provided text. The app does not automatically attach books, reading positions, notes, highlights, screenshots, email addresses, or files. Do not include passwords or sensitive personal information.

The service accepts at most one new feedback message per feedback ID in a rolling 24-hour period. Retrying the same saved request does not count as a new message. This limit is enforced by the service and is not tied to an account. After a confirmed deletion, the app keeps the same feedback ID, so deleting feedback does not reset this limit.

You can delete feedback sent from this installation in Settings. The app clears its local draft and pending message, then asks the service to delete the submitted message and its device/app details. If deletion is offline, the app keeps a small deletion request locally and retries during a later foreground activation after its retry delay, or when you choose to retry. An earlier activation may not send the request. New sends stay blocked until deletion is confirmed. If you remove the app before that request reaches the service, the request cannot be retried from that installation; the feedback content expires after 365 days and is removed at the next scheduled cleanup. A reinstall creates a new ID and cannot automatically delete records from the old installation. The random feedback ID stays on your device and is not displayed in the app, so an email alone may not let us locate records from a removed installation. For questions, contact vimihi3@gmail.com.

On Android, if the app’s stored feedback credential becomes unreadable while a deletion request is pending, the app tells you that deletion could not be confirmed. You can choose Clear on this device to stop tracking the request; feedback already on the service then expires 365 days after it was sent. After you clear it, the next message you send uses a new random feedback ID.

Resetting privacy data on Android

In the Android app’s Privacy settings, Reset privacy data on this device removes the saved privacy choices, the feedback draft, pending requests and the private installation IDs and credentials from the device. Statistics stay off, and your books and reading data are not affected. A reset does not contact the service and does not delete records already there. If a removal or deletion request is still waiting, the app warns you before resetting that the request will be abandoned on the device; those records are then removed under the periods below (statistics after 90 days without a successful report, sent feedback 365 days after it was sent). Turning statistics on or sending feedback after a reset creates new IDs, so the 24-hour feedback limit of the earlier feedback ID no longer applies to the new one. If the app cannot load its privacy settings on the device, it sends nothing and offers this reset.

How long information is kept

These periods describe the service database. Cleanup runs when the service starts and hourly.

• Statistics expire after 90 days without a successful report and are removed at the next scheduled cleanup. When you opt out and the deletion request reaches the service, the statistics row is deleted; a minimal revocation record, containing the installation ID, a hash of its credential and the withdrawal time, remains for at least 30 days.
• Feedback message text and device/app details expire after 365 days unless deleted earlier, and are removed at the next scheduled cleanup.
• While feedback content is retained, its submission ID remains associated with it to prevent duplicate submissions. After deletion, minimal receipt, retry, and cooldown records remain for 30 days and are removed at the next scheduled cleanup. These records contain the submission and receipt IDs, the time a message was accepted, and a one-way digest of the original request used only to recognize a retry; they do not contain the message text or device/app details. The feedback credential hash is kept only while retained content or those records require it.
• Drafts and pending requests remain on your device until sent, deleted, or otherwise resolved. Pending deletions retry during a later foreground activation after the saved retry delay, or when you choose to retry. They are not sent automatically in the background.

How information is used and shared

Statistics are used to count installations that opted in and to understand app version use. Feedback is used to review what you chose to send and improve Paper Reader. We do not sell this information or use it for advertising or cross-company tracking. The app does not send it to advertising networks or third-party analytics services. Railway hosts the API and database as described below. We may also disclose information when required by law.

Service provider, location, and technical data

The Paper Reader API and its persistent database are hosted by Railway in its Southeast Asia region. Requests to the API use HTTPS. Railway may process connection and platform information, including a request's source IP address, to operate its service. Railway platform-log retention depends on the subscribed plan; see Railway's logging documentation for the current periods. Railway also says it may process or transfer customer information in the United States or other countries while operating its platform, even when a service is hosted elsewhere. See Railway's Privacy Policy.

Our API's application logs record route names and internal errors; they do not record feedback message bodies or bearer credentials. The service may use the connecting IP address temporarily in an in-memory rate limiter. It does not store that address in the application database. Provider platform logs and backup copies are separate from the application database. Deleting a record from the live database does not immediately remove every provider-held backup copy; backup retention follows the hosting terms and configuration that apply to the service. Railway's Data Processing Addendum describes daily backup practices and other controls for processing where that addendum applies; the terms for this service depend on its applicable subscription and agreement.

The service uses separate random credentials for statistics and feedback and stores only credential hashes. The iOS app keeps those credentials in the device-only Keychain; the Android app keeps them encrypted with an Android Keystore key in app-private storage excluded from backup and transfer. No method of transmission or storage can be guaranteed completely secure.

Contact and changes

You can turn statistics off and delete sent feedback at any time in the app’s Settings. For questions or privacy requests, email vimihi3@gmail.com. We may update this policy when the app or its data handling changes; the effective date above shows when the current version took effect.