Privacy Policy

1. Who we are and what this covers

Librera applications are published by Ivan Ivanenko, an individual developer ("we", "us"). We are the data controller for the processing described here.

This policy applies to the website librera.app and to the following applications, on every platform each is distributed for:

• LibreraX — Android, with a Wear OS companion and Android Auto
• Librera Reader — Android, with Android Auto (Google Play, F-Droid, direct APK)
• Librera1 Reader — Android, iOS, macOS, Windows, Linux, Chrome extension, web, VS Code extension
• Sound Icon — macOS
• Menu Reminder — macOS
• Menu Screenshot — macOS

The apps differ from one another, and this policy does not pretend otherwise. The general sections below describe each kind of data we may handle and say which apps it applies to; section 19 restates the position for each app on its own. Where a general section and the annex differ, the annex governs for that app.

2. At a glance, per app

3. Our principles

• Local first. Every app works on the device in front of you. Nothing is uploaded because an app wants it uploaded — only because a feature you turned on needs it.
• We never sell your data, and we never share it with data brokers.
• We do not read your books, documents, screenshots or reminders. We have no ability to open the content you keep in these apps.
• The narrowest permission that works. Where a platform offers a scoped permission, we ask for the scoped one — see section 6 on Google Drive.
• No account unless a feature needs one. Three of the six apps have no sign-in at all, and in the three readers that offer one, signing in is optional and is what connects your own Google Drive — nothing else depends on it.

4. Data kept on your device

Applies to: all apps.

Every Librera app stores its own settings locally, in the private storage the operating system gives it. This data is not transmitted to us, and other apps cannot read it. Depending on the app it includes:

• your library: the books you have opened, your position in each, bookmarks, highlights, notes, tags and shelf marks such as favourite, finished and want to read;
• appearance and reading settings — theme, fonts, margins, scrolling mode;
• security-scoped bookmarks and file references, so an app can reopen the folders and files you previously chose;
• audio device preferences, starred devices and custom device icons (Sound Icon);
• your reminders — their text, due dates, order and done state (Menu Reminder);
• capture and export preferences (Menu Screenshot);
• a cached flag recording whether a paid entitlement is currently active, so the app does not misreport your purchase before the store answers.

Uninstalling an app removes this data, subject to how your operating system handles app backups. Section 13 explains how to remove it deliberately.

5. Account data

Applies to: the three readers, and in each of them only if you choose to sign in. Sound Icon, Menu Reminder and Menu Screenshot have no accounts and no sign-in.

In LibreraX and Librera Reader, signing in with Google does one thing: it connects your own Google Drive, so the app can keep a backup there and hold your reading in step between devices. The sign-in is handled by Google Play services; the app receives an access token for the narrow Drive scope described in section 6, and your account's email address and display name so it can show you which account is connected. None of it is sent to us — we operate no account system for either app, and there is no server of ours holding anything for you. Sign out, or revoke the app in your Google account permissions, and the connection ends; the app goes on working on local books alone.

Librera1 Reader can be used entirely without an account. If you choose to sign in — which is what enables syncing your library between devices — you sign in with Google, through Firebase Authentication. In that case we receive and store:

• your Google account's email address and, where Google provides it, your display name and profile picture;
• a user identifier (the Firebase UID) that ties your synced data to you;
• timestamps for account creation and last sign-in.

We never receive your Google password. Authentication happens with Google and returns a token; we see the result, not your credentials.

With an account active, the app stores your reading progress and book marks in Google Cloud Firestore, under a document path private to your user identifier (users/{uid}/books/{bookId}). The fields are the ones the app shows you: which book, how far through it you are, and the marks you set. Only your signed-in devices can read these documents. Sign out, and the app keeps working on local books alone.

6. Your books and files

Applies to: the Google Drive features of LibreraX, Librera Reader and Librera1 Reader. All other file handling in all apps is local.

Three of the apps can put something in your own Google Drive, in your own account, and only after you connect it:

• LibreraX — the backup of your library, and the sync that keeps it in step between devices: your shelves and tags, your reading positions, your bookmarks and highlights, and the app's settings, written as one JSON document. You choose when it is made and when it is restored.
• Librera Reader (Google Play build) — your reading progress, bookmarks and settings, and the book files you choose to synchronise, so a book you are halfway through on one device opens in the same place on another. The F-Droid build has no Drive feature at all.
• Librera1 Reader — books you explicitly choose to synchronise.

None of it is uploaded to us. We operate no book storage and no backup storage of our own, and we cannot read what is in your Drive.

Deleting a file from that Drive folder removes it. Disconnecting Drive, or revoking the app's access in your Google account permissions, ends the app's access immediately.

In every other case — books opened on your device, images captured by Menu Screenshot, reminders kept by Menu Reminder, audio files played by Sound Icon's local player — the files stay on your device and are opened only to be displayed, played or saved where you asked. They are never transmitted anywhere.

7. Purchases and subscriptions

Applies to: LibreraX (subscription), Librera Reader (paid version), Librera1 Reader (premium), Sound Icon (Sound Icon Pro). Menu Reminder and Menu Screenshot have no purchases of any kind.

All payments are handled by the store you bought from — Apple on the App Store, Google on Google Play. We never see, receive or store your payment card, billing address or store account credentials.

What reaches an app is a signed receipt or entitlement telling it whether a purchase is active. LibreraX asks Google Play Billing directly, with no intermediary: it receives the state of the subscription and caches one flag on the device saying whether it is currently active, so the app does not misreport your purchase before Play answers. No identifier of yours is sent anywhere else for this, and there is no account of ours attached to it. In Librera1 Reader, subscription entitlements are managed through RevenueCat, which acts as our processor: it receives a purchase identifier from the store together with an app user identifier — your Firebase UID when you are signed in, or an anonymous identifier when you are not — so that a subscription bought on one device unlocks on another. RevenueCat receives no payment details either.

Your purchase is also governed by the store's own privacy policy and terms, and refunds are handled by the store, not by us. See our Terms of Use for the subscription terms themselves.

8. Advertising

Applies to: the free edition of LibreraX, and the free version of Librera Reader for Android. Neither the F-Droid build of Librera Reader nor any other Librera app contains advertising of any kind.

Both display advertising supplied by Google AdMob. In LibreraX that means a banner, an occasional full-screen advertisement between screens, and — where a feature offers it — a rewarded advertisement you may choose to watch to open that feature for a while; nothing is asked of AdMob at all in the first hour after installing, or once you have subscribed or bought the app. To serve and measure ads, AdMob may process your device's advertising identifier, IP address, coarse location derived from it, and ad interaction events. This processing is Google's, under Google's policy for partner sites and apps; we do not receive the underlying data and use it for nothing.

You can limit it: on Android, use Settings → Privacy → Ads to delete or opt out of the advertising ID. In regions where consent is required, a consent prompt is shown before personalised ads are served, and you can change your answer later. Subscribing in LibreraX, or buying the paid version of Librera Reader, removes advertising entirely.

9. Analytics and diagnostics

Applies to: LibreraX, and the Google Play build of Librera Reader.

Both include Google Firebase Analytics, which reports aggregate, app-level events — that the app was opened, that a screen was shown, crash-adjacent diagnostics — together with the device model, OS version and a generated app instance identifier. We use it only to know which features are used and where the app fails.

In LibreraX the events are the screens you arrive at, and the points on the paid path: that the subscription was offered, that its button was tapped, that a rewarded advertisement was watched. Which edition you are running is recorded as a property of the app instance. That is the whole of it.

Neither app reports what you read. No title, no author, no file name, no path and no page ever leaves the device through analytics, and nothing carries the contents of a book.

• The F-Droid build of Librera Reader contains no analytics at all; the analytics component is replaced by a stub that does nothing.
• Librera1 Reader, Sound Icon, Menu Reminder and Menu Screenshot contain no analytics, no crash reporting and no telemetry.

10. Device permissions

Permissions are requested when a feature needs them, and you can revoke any of them in system settings. What each one is for:

11. Third parties we rely on

We use no third party beyond those listed here, and each receives only what its function requires.

12. Legal bases for processing

If you are in the European Economic Area or the United Kingdom, we process personal data on these bases under the GDPR:

• Performance of a contract — account creation, sync, and delivering a purchase or subscription you bought.
• Consent — personalised advertising where consent is required, and connecting Google Drive. You may withdraw consent at any time, without affecting processing already carried out.
• Legitimate interests — aggregate analytics in LibreraX and in the Google Play build of Librera Reader, to keep the apps working and to decide what to build; and preventing abuse. We balance this against your interests, and for Librera Reader the F-Droid build offers the alternative.
• Legal obligation — retaining what tax and consumer law requires of purchase records held on our behalf by the stores.

13. Retention and deletion

For LibreraX and Librera Reader there is no account of ours to delete, and the step-by-step instructions have a page of their own: Delete your data.

We keep account and sync data for as long as your account exists. Delete the account and the associated documents are deleted; we retain nothing afterwards except what a store keeps for its own legal purposes.

• Librera1 Reader account and synced data — use the account screen in the app to sign out and delete your account, or email us and we will delete it within 30 days. Revoke Drive access at myaccount.google.com/permissions.
• A Google Drive backup or sync (LibreraX, Librera Reader) — the files are in your own Drive and stay until you delete them there. Revoke the app's access at myaccount.google.com/permissions. We hold no copy and cannot delete anything on your behalf.
• Local data, any app — uninstalling removes it. On macOS you can also delete the app's container in ~/Library/Containers/.
• Advertising identifier — reset or delete it in Android settings.
• Purchases — subscriptions are cancelled in the store, not in the app, and deleting an app does not cancel one. See the Terms of Use.

14. Your rights

Depending on where you live, you have some or all of these rights: to access the personal data we hold about you, to correct it, to delete it, to restrict or object to its processing, to portability, and to withdraw consent. Under the CCPA/CPRA you also have the right to know what is collected and to not be discriminated against for exercising these rights — and we note that we do not sell or share personal information as those laws define it.

To exercise any of them, email librera.raeder@gmail.com. We answer within 30 days. For apps with no account, we hold nothing that identifies you, so there may be nothing for us to return — the data is on your device and under your control.

If you are in the EEA or UK you may also complain to your national data protection authority.

15. International transfers

Where sync, advertising or entitlement services are used, the providers named in section 11 may process data on servers outside your country, including in the United States. Those transfers rely on the safeguards those providers offer, principally the European Commission's Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. We operate no servers ourselves.

16. Security

Connections to sign-in, sync and store services use TLS. Sync documents are readable only by the account that owns them, enforced by server-side security rules. Desktop and mobile apps run inside the sandbox their platform provides, with the minimum permissions listed in section 10, and store builds are signed and — on macOS — notarized.

No system is perfect. The strongest protection here is structural: for five of the six apps we run no server that holds your data, so there is nothing of ours to be breached in the first place. Where a reader connects Google Drive, the files sit in that reader's own Google account, under that account's own protections, not in storage of ours.

17. Children

Librera applications are general-audience software and are not directed at children. We do not knowingly collect personal data from children under 13, or under the higher age of consent that applies where you live. If you believe a child has provided us with personal data, contact us and we will delete it.

18. This website

librera.app is a static site. It sets no cookies, runs no analytics, and has no tracking pixels or third-party scripts. Web fonts are self-hosted and served from librera.app itself, so viewing the site sends no request to any third party. Because nothing here stores data on your device or tracks you, no cookie or consent banner is needed — there is nothing to consent to. Our host keeps standard server logs. Links out to app stores and to GitHub take you to those companies' own sites, under their own policies.

19. Annex: app by app

The position for each app on its own. Where this annex differs from the general sections, the annex governs.

LibreraX

Android — Google Play; with a Wear OS companion and Android Auto

Account

Optional, and only for Google Drive backup and sync. Signing in connects your own Drive and nothing else; we run no account system for this app.

What stays on your device

Your library, reading positions, bookmarks, highlights, notes, tags, reading themes and all settings — and a cached flag saying whether the subscription is active.

What leaves your device

Advertising requests to AdMob (free edition only), aggregate analytics events to Firebase Analytics, Google Play Billing traffic for the subscription, and — only if you connect Drive — the backup document it keeps there and syncs between your devices. Nothing else.

Analytics, in full

Which screen you arrived at, that the subscription was offered or its button tapped, that a rewarded advertisement was watched, and which edition you are running. No title, no author, no file name, no page.

Purchases

A monthly auto-renewing subscription through Google Play, listed at $0.99 USD/month, which removes the advertising. Play handles the payment; we never see it.

Your books

Read from your device. Nothing is uploaded except the backup you ask for, to your own Drive.

The watch

What is being read is mirrored to a paired Wear OS watch so it can show it and drive playback. The messages pass between your own two devices and reach no server.

Librera Reader

Android — Google Play, F-Droid, direct APK; with Android Auto

Account

Optional, in the Google Play build only, and only for Google Drive synchronisation. We run no account system for this app.

What stays on your device

Your library, reading positions, bookmarks, highlights, notes, tags and all settings.

What leaves your device

In the Google Play build: advertising requests to AdMob (free version only), aggregate analytics events to Firebase Analytics, and — only if you connect Drive — your reading progress and the books you chose to sync, to your own Drive under the narrow drive.file scope. Nothing else. The F-Droid build sends none of it and has no Drive feature at all.

Purchases

The paid version is bought through Google Play and removes advertising.

Your books

Read from your device. Uploaded only to your own Drive, and only the ones you choose.

Librera1 Reader

Android, iOS, macOS, Windows, Linux, Chrome extension, web, VS Code extension

Account

Optional. Google sign-in via Firebase Authentication; we receive your email address, display name and a user identifier. Without signing in, the app is entirely local.

What leaves your device, if you sign in

Reading progress and book marks, stored per-user in Cloud Firestore; and books you explicitly choose to sync, uploaded to your own Google Drive under the narrow drive.file scope.

Purchases

Premium is sold by Apple or Google and managed through RevenueCat, which receives a purchase identifier and your app user identifier — never payment details.

Ads and analytics

None of either.

Deleting your data

Delete your account from the account screen, or email us. Revoke Drive access in your Google account permissions.

Sound Icon

macOS — App Store and direct download

Account

None.

What leaves your device

Nothing. No analytics, no crash reporting, no advertising, no third-party SDKs, no servers of ours. Its App Store privacy label is "Data Not Collected".

What stays on your device

Starred audio devices, custom device icons, bookmarks to music folders you selected, and a cached flag for subscription status.

Permissions

Audio input, to list and adjust input devices — no audio is ever recorded or transmitted. Accessibility, only if you use the media key features.

Purchases

Sound Icon Pro is sold by Apple through the App Store. The app receives only a signed entitlement saying whether it is active.

Menu Reminder

macOS — direct download

Account

None.

What leaves your device

Nothing. No analytics, no advertising, no network features.

Your reminders

Stored locally in the app's private storage (~/Library/Application Support/). Never uploaded, and we never see them.

Permissions

Notifications, to alert you when a reminder is due. Generated locally on your Mac.

Purchases

None. The app has no in-app purchase and no paid tier.

Menu Screenshot

macOS — direct download

Account

None.

What leaves your device

Nothing. No analytics, no advertising, no network features.

Your screenshots

Captured with ScreenCaptureKit, edited in memory and written only where you save or share them. We never see them.

Permissions

Screen Recording, required by macOS for any capture; and access to the folders you save into.

Purchases

None. The app has no in-app purchase and no paid tier.

20. Changes to this policy

We update this policy when an app's behaviour changes. The effective date and version at the top always reflect the current text. Material changes — a new category of data, a new third party, a new purpose — are announced in the release notes of the app concerned, and where the law requires it we will ask for your consent before the change applies to you.

21. Contact

For any privacy question, request or complaint:

Please say which app you are writing about — it is the first thing we need to know.