Reading Pal — Privacy Policy

Effective date: 2026-05-23 — Last updated: 2026-07-15

1. Introduction

Reading Pal is a reading tracker and pomodoro timer app operated by Darren Lin (solo developer, Taiwan). This Policy explains what personal data we collect when you use Reading Pal on Android or iOS, why we collect it, who we share it with, and the rights you can exercise over it.

This Policy applies to the Reading Pal mobile application and the backend API that supports it. It does not apply to third-party services you may link (e.g., Google) — those are governed by their own privacy policies.

2. Data We Collect

(a) Account Data

(b) Authentication Tokens

• Google OAuth: we store Google's user ID (sub), email, email_verified flag, and the raw id_token payload for verification audit. Retained at most until account deletion.
• Refresh token hashes: we store only a bcrypt hash of the refresh token on the server. The raw token lives exclusively in your device's SecureStore.

(c) Reading Activity

• Books on your shelf: book ID (linked to a public catalog), your reading status (reading / finished / want to read / etc.), your progress (page number or percentage)
• Reading session timestamps and duration (when you start, pause, and end a pomodoro session)
• Free-text notes you attach to books
• Status-change history (an audit trail used to compute reading statistics)

(d) Device Data

(e) Server Logs

Each request to our backend logs: - IP address (used for rate-limiting, security, and abuse detection — rotated automatically after 30 days) - HTTP method, URL path, response status code, response latency, request ID

We do not log request bodies in production.

(f) Audit Logs

We maintain an audit log for four event types only: deletion_requested, deletion_cancelled, deletion_executed, and export_requested. For each event we record: - Timestamp - Event type - Numeric user ID - IP address, device ID, and user-supplied deletion reason (if provided, capped at 2,000 characters) — these metadata fields are set to NULL at the moment of hard delete; only the event type, timestamp, and numeric user ID survive beyond that point

These records survive your account deletion and are retained indefinitely for compliance verification — to demonstrate that we honored your deletion or export request. After hard delete, the surviving records are fully de-identified: they contain only event type, timestamp, and a numeric user ID that no longer maps to any person (the account itself is gone). They hold no PII and no reading content.

(g) Crash and Error Reports (via Sentry)

When the app crashes or the backend encounters an error, we send a report to Sentry containing: - Stack trace - Your numeric user ID (not your email or display name) - App version and environment label - Request URL path (query strings stripped)

We explicitly do not send: your email address, display name, IP address, request body, cookies, refresh tokens, or any free-text note content.

Sentry retains these reports for 7 days (free tier default). Sentry data is hosted in the EU region (de.sentry.io). See Section 4 for Sentry's processor details.

(h) Settings and Preferences

• Theme selection
• Pomodoro work/break durations
• Biometric lock preference
• Individual notification toggles (each type stored separately)

(i) Gamification Data

• Earned achievements and the timestamps when they were unlocked
• Points ledger (in-app reward currency)
• Inventory of redeemed items (e.g., themes you've unlocked)

(j) Analytics Data (via Firebase Analytics / Google Analytics)

We use Firebase Analytics (a Google service) to understand aggregate usage patterns and improve the app. The events and parameters we send are limited strictly to the following:

What we do not send to Firebase Analytics: your email address, display name, book titles, note content, reading timestamps, precise reading durations, ISBNs, purchase tokens, or any free-text content.

Firebase Analytics also automatically associates events with an App Instance ID (a Firebase-generated per-install identifier, resettable by clearing app data or reinstalling) and, on Android, the Android Advertising ID (a resettable device-level ID managed by Google). These are collected by the Firebase SDK itself; we do not attach them manually.

Firebase Analytics data is processed by Google under Google's privacy terms. See Section 4.

3. How We Use Your Data

Email verification (email/password registration): When you register using email and password, we send a verification email containing a 6-digit code via Resend to confirm you own the email address. Signing in with Google does not trigger this flow.

In-app advertising (Google AdMob): Reading Pal displays ads served by Google AdMob (Android only; no ads on iOS). Three ad formats are used: a banner at the bottom of the book library list, a full-screen interstitial shown after a reading session of 13 minutes or more, and a rewarded ad that users can choose to watch in exchange for in-app points.

Data shared with AdMob for ad serving, measurement, and fraud prevention: the Android Advertising ID (AAID — a resettable device-level identifier managed by Google) and contextual/technical signals (app and device metadata). The AAID is already collected by the Firebase Analytics SDK (see Section 2(j) above); AdMob reuses the same identifier for advertising purposes.

For rewarded ads, we use AdMob's server-side verification (SSV): a pseudonymous numeric user ID and a custom data string are sent to AdMob solely to verify reward eligibility. This is not used for ad targeting.

We do not share with AdMob or any advertiser: your email address, display name, account data, book library, or reading content.

EEA / UK users: Google's User Messaging Platform (UMP) consent flow runs before ads are loaded. If you decline consent or applicable law requires it, only non-personalised ads are shown (or no ads at all). Ads are not loaded before consent is obtained (fail-closed).

Opt-out: Android Settings → Privacy → Ads → Reset or delete your Advertising ID.

4. Who Has Access (Sub-processors)

We do not sell personal data to any third party, ever.

5. International Data Transfers

All your account, library, and reading data is stored in DigitalOcean's Frankfurt (EU) data center (region: FRA1). EU users' data does not leave EU territory.

Sentry crash reports also use Sentry's EU region (de.sentry.io).

Some sub-processors (Google, AdMob) operate globally and may move data between regions for service reliability per their own privacy terms.

6. Your Rights

You can exercise most rights directly in the app without emailing us.

EU / EEA users: you also have the right to lodge a complaint with your national supervisory authority (e.g., your country's data protection authority).

Taiwan users: rights are grounded in the Personal Information Protection Act (個人資料保護法, PIPA).

We will respond to requests within 30 days of receipt.

7. Children

Reading Pal is not directed at children under 13. We do not knowingly collect personal data from users under 13. If you believe a child has created an account, email us at tn08869679@gmail.com and we will delete the account.

8. Cookies and Tracking Identifiers

Reading Pal is a mobile app — there are no web cookies. We use these identifiers:

9. Data Retention

10. Marketing Communications

Marketing push notifications default to OFF. You opt in explicitly: Settings → Notifications → "Marketing push". You can turn off any time in the same place.

We do not send marketing emails.

11. Changes to This Policy

Material changes (new data category, new sub-processor, expanded use of existing data) are announced via an in-app banner 30 days before taking effect. The updated version is dated.

Minor edits (typo fixes, clarifications that don't affect your rights) take effect immediately without prior notice.

Pre-disclosed upcoming changes:

• Apple Sign-In will be added when Reading Pal launches on the iOS App Store. When it does, your Apple-provided user identifier (relay email if you choose "Hide My Email") will be stored similarly to Google OAuth data described in Section 2(b).

Material changes (new data categories, new sub-processors, or expanded use of existing data) will be announced via an in-app banner at least 30 days before taking effect.

12. Contact

For privacy questions, complaints, or requests we cannot handle in-app:

• Email: tn08869679@gmail.com (This is an interim personal Gmail address. We will migrate to a dedicated domain email in a future update and revise this section accordingly.)

We aim to respond within 30 days.

13. Effective Date and Version History