Privacy Policy

Who is responsible

Reading Journey is provided by Vinh P. Dinh, the controller responsible for the personal information described here. Contact us at [email protected] about privacy or your data.

This policy covers the Reading Journey app and its supporting services. You can use the app without creating an account. Some features, including book recognition, imports, subscriptions, analytics and crash reporting, communicate with external services even when you are signed out.

When you sign in, your library synchronizes automatically with your Reading Journey account. This can include an existing library already on your device, along with its notes, reading history, saved photos and saved locations. Signing out or uninstalling the app does not delete information already stored by our services.

Accounts, sign-in and service emails

We use Supabase to create and authenticate accounts. Account information includes your account identifier, email address, linked sign-in providers, profile information supplied by those providers, and authentication and session records. Apple or Google may supply a name, email address, provider identifier and profile details; Apple may supply a private relay email address. Names supplied during Apple sign-in may be saved as your full, given and family name.

If you use email and password, Supabase processes your credentials. Session credentials are also stored on your device so that you can remain signed in. Linking a sign-in method associates that provider identity with your account; it does not make your reading library public.

Supabase and Cloudflare Email Service process email addresses, message content and delivery information to send account confirmation, password recovery and other account-related messages. Authentication links contain information needed to complete the requested action. Apple and Google also process sign-in information under their own policies.

Your library, photos and location

Your library is stored on your device. When signed in, account synchronization also stores library information with Cloudflare: books and their identifiers, reading progress and dates, history, ratings, reviews, private notes, shelves and collections, goals, imported records, and the technical identifiers and change records needed to synchronize devices. These include a device identifier that can persist when the app is reinstalled, together with the device model, which we use to recognize a reinstalled device and to diagnose synchronization problems. New reading-journal entries also record your device's time zone (for example Europe/Berlin) when you create them, and it is synchronized with the entry.

Saved custom covers and reading-journal photos can be uploaded to private Cloudflare storage as part of synchronization. Camera and photo-library access is used when you choose the relevant feature. Images can contain people or other personal information, so consider what is visible before uploading them.

Location is optional. If you allow location access and save a location to your reading journal, a location label and precise latitude and longitude may be stored with that entry and synchronized with your account. To show a saved location on a map or as a place name, your device's built-in geocoding service may send the saved coordinates, or the location label when no coordinates are saved, to its provider. You can manage camera, photos and location permissions in your device settings. Revoking permission prevents future access through that permission; it does not remove information you previously saved.

On some platforms, maps in the app, such as the map of places where you read and the location editor, are shown with the Google Maps SDK. Google then receives device and app information, your IP address, a pseudonymous SDK identifier, crash information from the map component, the map areas being loaded and, when you pan or zoom, map interactions. Google handles this information under its own policies.

Following other readers

The friends shelf shows what people you follow are currently reading. It is optional, and nothing described in this section happens unless you use it.

Following Reading Journey members. When you use the friends shelf with your account, we store a social profile with your account identifier and a display name, which is the name on your membership card. You follow another member by scanning or opening the follow code they show you; following is one-way. People you follow and people who follow you can see your display name, and the people who follow you can also see when they started following you. You can unfollow someone or remove a follower at any time. Unfollowing someone stops their updates reaching you; it does not stop them from following you. Removing a follower stops your updates reaching that person immediately, although what their app already showed may stay visible on their device until it next refreshes.

Sharing what you are reading is off by default. If you turn it on, your device sends us a small card with at most one book you are currently reading: its catalog identifier, its title and author as they appear in your library (including any changes you made to them), a public cover address, your progress as a whole percentage and the day of your last progress. Only your followers can see this card, and only while sharing is on. Your notes, reviews, ratings, locations, photos and the rest of your library are never part of it. Turning sharing off deletes the card from our services; as with removing a follower, a copy already shown on a follower's device may remain until it refreshes. Signing out of the app also turns sharing off and deletes your card; if you are offline when you sign out, this happens the next time you sign in to that account on the same device. Your followers' devices load the cover image directly from its public address, so the site hosting the image can see their IP address and when it was loaded.

A follow code works once and for five minutes. We store a one-way hash of each code, never the code itself, together with the account that created it and, once it is used, which account used it; these records are kept for at least an hour and are then deleted. To limit guessing, we briefly keep a record of failed attempts to use a code. If you report another member, we store your report, including the reason you give and that member's display name at the time, so that we can review it.

Goodreads. If you connect Goodreads to the friends shelf, the app uses your Goodreads sign-in on your device, and Goodreads' public profile feeds, to read the list of people you follow on Goodreads and the books they are currently reading: their names and profile pictures, book titles, authors, covers, identifiers and reading progress where Goodreads shows it. Goodreads receives these requests as it would from its own website and handles them under its own policies. This information is kept only on your device, in the app and its widget, and is not sent to our services. It is removed when you disconnect Goodreads, and it is left out of diagnostic exports you send to support. Adding a friend's book to your library searches for it like any other book search.

Book searches, scans and imports

Book searches send search terms, titles, authors or ISBNs through our Cloudflare services to book-information providers such as ISBNdb and, where enabled, Google Books. Search results and bibliographic information are cached to provide the service efficiently.

Cover scans and image imports send the selected images to Google Gemini for book recognition. Processing may produce extracted text and book suggestions. Images can contain information beyond the intended book cover. Google's handling of these requests depends on the Gemini service and account settings in use.

If you import a library file, our services process the records it contains, which can include ratings, reviews, private notes, shelves and reading dates. Social-media imports process the URL you provide and may download and send the associated media to our extraction service and Google Gemini. Those URLs may identify a social-media account or post.

AI assistants you connect

You can connect an AI assistant of your choice to your Reading Journey account through our assistant connector, so that it can read and update your library when you ask it to. Connecting one is optional, and nothing described in this section happens unless you do. You choose which assistant to connect; we do not share your library with an assistant you have not connected.

What the assistant receives. After you sign in on our connector page and allow access, the assistant can read the books in your account library with their titles, authors, ISBNs, reading statuses, start and finish dates, ratings, collections, Next Up, Top Four and reading goals, and can add books and change these details. It can also read and change your notes, reviews and journal entries, including the reading progress and the place names saved with them. It never receives the coordinates of a saved place or any photo: when you ask, it can add a photo you give it or replace or remove one, but it cannot see your photos. An assistant you connected before 1 November 2026 cannot read your notes, reviews or journal entries until you connect it again. What the assistant receives, and anything you tell it in your conversations, is handled by the company that provides the assistant under its own terms and privacy policy, not ours. Read that provider's privacy policy before you connect.

What we store. For each connection we store the assistant's registration (the name it gives and the address it returns to after sign-in), the access you allowed, and access tokens, which we keep only as one-way hashes. When an assistant changes your library, we record which assistant made the change, which kind of change it was and when, but not the values it wrote. To limit misuse, we briefly keep counts of sign-in attempts and requests per network address and per connection. We use these records to operate connections, prevent abuse and investigate problems. A connection that is not used for 60 days stops working.

Feedback through an assistant. If you ask a connected assistant to send us feedback, it sends only the message and any files you approved. We receive them in Slack, our team messaging service, together with your Reading Journey account identifier and the name of the assistant, so we can find your account and follow up. We handle this feedback like other support correspondence.

Ending a connection. You can remove the connector in the assistant at any time. Deleting your Reading Journey account revokes every assistant connection before your other data is deleted.

Plus subscriptions and your membership number

The app store you installed Reading Journey from, the App Store or Google Play, processes payments. RevenueCat processes purchase, transaction, subscription and entitlement information so that Reading Journey can provide and restore Plus access. We do not receive your full payment-card details from the app store.

RevenueCat uses a customer identifier even when you are signed out. When you sign in, we use your stable Reading Journey account identifier with RevenueCat to associate subscription access with your account. RevenueCat may retain related customer aliases and purchase history. Restoring purchases is also subject to the app store's and RevenueCat's purchase-transfer behavior.

Your membership number belongs to your Reading Journey account. When you use the app while signed in, we assign your account a number and store it with your account identifier, the date your account was created and, if the app reports one, the earliest date the app was installed on one of your devices, so that your membership card can show how long you have been a member. The number may be associated with your RevenueCat customer; it is separate from your sign-in credentials and is deleted when you delete your account. Earlier versions of the app also received a decorative number for each installation that was not linked to an account; we no longer issue those.

Usage information, diagnostics and support

Amplitude processes app usage events, such as feature interactions, scan or search outcomes, selected book identifiers and some error information, together with SDK-generated identifiers and device/app information. Firebase Crashlytics processes crash and nonfatal error reports, app/build and device information, and diagnostic details. These records help us understand usage, diagnose problems and improve reliability. Identifiers and diagnostic records are not necessarily anonymous, even when they do not contain your name or email.

Reading statistics. Our servers also keep statistics about books and reading, such as how many readers are reading, have finished or have rated a book. These statistics are not linked to your account, may be broken down by country, and do not contain your name, email, notes or reviews.

Our hosting and service providers also process connection and security information, which may include IP addresses, request details, timestamps and device or browser information, to deliver and protect the services.

If you contact support, we process your email address, message and attachments. If you choose to send the app's diagnostic export, it can include a copy of your full library database, including notes, reviews and saved coordinates, as well as logs, device details and your RevenueCat identifier. The diagnostic exporter does not copy the photo files themselves. Review what you share before sending it.

Why we process information

We use information to provide the features you request, authenticate and protect accounts, synchronize your library, recognize and find books, process imports, provide subscriptions, send service messages and respond to support requests. Where applicable under data protection law, processing necessary to provide those services is based on performing our agreement with you.

We also process information for our legitimate interests in operating a secure, reliable service and understanding and improving its use, subject to your rights. Where consent is required for a particular activity, we rely on that consent and you may withdraw it. We may retain or disclose information when required to comply with legal obligations or to establish, exercise or defend legal claims. This notice does not make use of the app blanket consent to every form of processing.

Service providers and processing locations

The services described above receive information needed for their functions; information sent to them can be personal or linked to an account or device. The principal providers are:

• Supabase — account authentication and account/profile storage.
• Cloudflare — APIs, account library and media storage, searches and imports, security and email delivery.
• Apple — Sign in with Apple, App Store payments and related platform services.
• Google — Google sign-in, Gemini recognition, Google Books, Firebase Crashlytics, Google Maps on some platforms, and Google Play payments and related platform services. See also Firebase privacy information.
• RevenueCat — subscription management and customer identifiers.
• Amplitude — app usage analytics.
• ISBNdb — book metadata lookups.
• Hetzner — website hosting and supporting server infrastructure.
• Slack — team messaging, including feedback you send through a connected assistant.

If you connect an AI assistant, the company that provides it receives the information described under “AI assistants you connect”. It is a recipient you choose, not a service provider working for us.

Processing is not limited to your country. Our current Supabase account project is hosted in Ohio, United States. Private synchronized media storage and account backups are configured in the eastern United States. Other Cloudflare services and our other providers may process information in the United States, Europe and other locations where they operate. Provider privacy and data-processing information explains their international operations and transfer safeguards. Contact us for information about safeguards applicable to your data.

Retention and deletion

Local library information remains on your device until removed. Synced account and library information is retained to provide your account and synchronization until you delete it or request deletion, subject to necessary security and legal records. Signing out, removing the app or cancelling Plus does not by itself delete your account or cloud library.

Account backups. While you are signed in, we keep automatic backups of your synchronized library and private media in private Cloudflare storage so that your library can be restored if it is lost or damaged. A backup is taken about once a day when your library has changed. Backups are kept on a rolling schedule: one for each of the last seven days, one for each of the last four weeks and one for each of the last twelve months, plus the most recent backup. A book, note, photo or other record you delete from your library can therefore remain in an earlier backup for up to a year before that backup expires.

You can request account deletion in the app's account settings or contact [email protected]. The account deletion process removes the account's synchronized library and private media and its membership number, requests deletion of the associated identified RevenueCat customer, and deletes the Supabase account. A minimal account-deletion marker is retained to prevent old sessions or devices from restoring deleted cloud data. The deleted account's backups are kept in private storage for 30 days after deletion and are then deleted. Deletion also revokes every assistant connection, and removes the account's friends shelf profile and card, its follows in both directions, its follow codes, and reports it filed or that concern it; until then, a report is kept for review. If deletion cannot finish, it may need to be retried or completed with support.

Deleting your Reading Journey account does not cancel a subscription bought through the App Store or Google Play. Manage or cancel subscriptions in the account settings of the app store you subscribed through.

Other information follows separate retention processes. Scan sessions normally expire after a short period of inactivity, and library-import sessions are scheduled for cleanup after 24 hours. Some lookup caches expire after one or seven days. These schedules do not cover every copy or service: some search and social-media import records, catalog/cache records and older diagnostic archives currently have no automatic deletion period. Support messages and diagnostic attachments also have no single automatic expiry. Contact us to request review and deletion of information associated with you.

Account deletion is not an immediate purge of all vendor logs, analytics, purchase records, backups, support correspondence or historical copies. Those records may remain under the applicable provider's retention processes or where needed for security, legal obligations or claims. We assess deletion requests across the relevant services. We do not promise one fixed retention period for all data.

Your choices and rights

You can choose whether to create an account, use scans and imports, save photos or locations, or send support attachments. Signing out stops synchronization for that account on that device, while previously uploaded information remains until deleted. Device permissions can be changed in your device settings.

Depending on applicable law, you can request access to, correction or deletion of your personal information, a portable copy, restriction of processing, or object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. You may also complain to your local data protection authority. Contact [email protected] to exercise your rights; we may need to verify that the request relates to your account.

Children, security and policy changes

Reading Journey is not directed to children under 13, and we do not knowingly solicit their personal information. If you believe a child has provided personal information, contact us so that we can investigate and address it.

We use access controls, authenticated account requests and private media storage to protect information. No system can guarantee absolute security. Keep your account credentials and exported files secure.

We update this page when our practices change and show the update date above. Where required, we will provide additional notice or obtain consent for a material change.