Privacy policy

1. Controller

The controller responsible for processing your data (Art. 4(7) GDPR) is:

2. Account and sign-in

To use Chapterkeep, you create an account. You can use the app with a guest account without providing contact details, sign in with a link sent by email, or sign in with Google or – on the iPhone – with Apple. You can back up a guest account the same way later. We process:

• your email address (when signing in by email, Google or Apple; with Apple, an anonymous relay address from Apple if you choose)
• when signing in with Google, the profile data provided by Google (name, profile picture)
• when signing in with Apple, a user identifier assigned by Apple
• an account ID and the times of registration and sign-in

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

Sign-in with Google is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, sign-in with Apple by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. When you delete your account, we also revoke the sign-in with Apple.

We send the emails with the sign-in or confirmation link via Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France, acting as our processor (Art. 28 GDPR). This involves your email address, the content of the email and technical delivery data such as time and delivery status.

3. Library, notes and characters

For the core features of the app we process:

• the books of your library with their details (e.g. title, authors, ISBN, publisher, series, cover address) as well as genres, note mode and reading status, and your own shelves (name and which books are on them)
• your reading progress and when you started, finished and last opened a book, your rating, your verdict and whom you would recommend it to
• your chapter notes, quotes (with page, chapter and your thoughts), the entries of your lexicon (e.g. characters, places, terms) and the relations between them (kind, your own label, from which chapter)
• your flash cards (front and back, what you made them from) and your learning progress (box, when they are due next, number and time of the reviews)
• your reading sessions if you use the timer (start, duration, from which to which chapter); a running session stays on your device until it ends

Your notes contain whatever you write in them. We do not read or analyze them; they are only used to show them to you. Please do not write particularly sensitive information about yourself or others into them.

The data is first stored on your device and synchronized with our backend, so it is backed up and available on several devices. The backend is operated by Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992, as our processor (Art. 28 GDPR) on servers in the European Union (Ireland). Access from outside the EU, e.g. for support purposes, is only permitted on the basis of the EU Standard Contractual Clauses.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

4. Reminders

If you turn on reminders, the app schedules them on your device as local notifications and asks for your permission to do so. Which reminders you want and at what time stays on the device. We do not use a push service for this; no data is transmitted to us or to third parties. You can turn the reminders off at any time in the settings of the app or of the device.

5. Book search and covers (Open Library)

When you search for a book or scan a barcode, we send the search term or the ISBN and the language of your device to Open Library (openlibrary.org), a project of the Internet Archive, 300 Funston Avenue, San Francisco, CA 94118, USA. Cover images are loaded directly from their servers. Your IP address is transmitted, but no account ID, no notes and no other information about you.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). Data is only transferred to the USA when you start a search or a cover is shown, and the transfer is necessary for this feature you requested (Art. 49(1)(b) GDPR). When you enter a book by hand, no data is sent to Open Library.

6. Camera and photos (ISBN scan, quotes)

To scan a barcode, the app uses the camera after you allow it. The camera image is only analyzed on your device to recognize the ISBN. It is neither stored nor transmitted. You can revoke the permission at any time in the system settings.

For a quote you can photograph a page or pick a photo or screenshot. The text recognition runs on your device (with Apple’s Vision on iOS, with Google ML Kit on Android). The photo is only used for this, is not uploaded and is deleted as soon as you have taken the passage; only the text you save as a quote is stored. On Android, Google ML Kit may send information about the use and performance of the text recognition (e.g. device type, app version, processing time) to Google, but neither the photo nor the recognized text.

7. Voice notes (speech recognition)

When you speak a note, the app uses the microphone and the speech recognition of your operating system after you allow it (from Apple on iOS, usually from Google on Android). Chapterkeep does not record, store or transmit any audio to us; only the recognized text goes into your note.

Depending on the device, language and settings, the system recognizes the speech on the device or on the servers of Apple or Google. The privacy policy of the respective provider applies to this. You can revoke the permissions at any time in the system settings; you can still type your notes.

8. Chapterkeep Premium and export

You buy Chapterkeep Premium through Apple's App Store or Google Play. Payment and billing are handled by Apple Distribution International Ltd. or Google Ireland Limited (addresses in section 2) under their own responsibility; their privacy policies apply. We never receive your payment details.

So that the app knows whether Premium is active for your account and can assign your purchases to your account, we use RevenueCat by RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA, as our processor (Art. 28 GDPR). For this, the app signs in to RevenueCat with your account ID, even if you don't buy anything. We process:

• your account ID
• information about your purchases provided by the store: product, purchase and expiry date, transaction identifiers, store, price and currency
• technical data such as IP address, device model, operating system, app version and language

RevenueCat does not receive your books, notes or characters. The legal basis is the performance of the user agreement or of the agreement about Premium (Art. 6(1)(b) GDPR). RevenueCat stores the data at Amazon Web Services in the USA; the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The export of a book (PDF or Markdown) is created by the app on your device. Where you share or save the file afterwards is up to you; the terms of the chosen app or service apply.

9. Website (chapterkeep.de)

Our website chapterkeep.de is provided through GitHub Pages by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you visit it, GitHub processes technically necessary data such as your IP address, the date and time of the request and information about your browser and operating system, in order to deliver the pages and protect them against attacks, and stores it temporarily in server logs. The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR). GitHub is certified under the EU-U.S. Data Privacy Framework.

The website sets no cookies, uses no tracking and loads no content from other servers.

10. Contact by email

When you email us, we process your email address and the content of your message to answer your request. The legal basis is the performance of the user agreement if your request concerns the use of the app (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering your request (Art. 6(1)(f) GDPR). We delete your message once your request has been resolved and no statutory retention obligations apply.

Our mailbox is operated by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, as our processor (Art. 28 GDPR). The emails are stored in data centers in the EU.

11. Feedback in the app

If you send us a message in the app under Settings → Feedback (feedback, wishes, bug reports), we process:

• the chosen category and the text of your message
• your account ID, so we can assign the message to your account
• app version, operating system and app language, so we can reproduce bugs
• whether you agreed to be contacted by email about it

We use this information to improve the app and fix bugs. The legal basis is our legitimate interest in developing the app further (Art. 6(1)(f) GDPR). Please don't include passwords in your message.

Only if you agree, we may contact you about your message at your account's email address (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by emailing us; the section "Contact by email" then applies to our reply.

The messages are stored in our backend at Supabase (like your library). We delete them once we no longer need them to improve the app, at the latest when your account is deleted.

12. Retention and deletion

We store your account and library data as long as your account exists. You can delete your account at any time in the app under Settings → Profile → Delete account, or request the deletion by email. All your data on our servers, at RevenueCat and on the device is then deleted, unless statutory retention obligations apply; data at Apple or Google is not affected. A guest account can no longer be accessed after signing out or deleting the app.

13. Sharing of data

We only share your data with the service providers named in this policy, as far as this is necessary for the respective purposes, or if we are legally obliged to do so. We do not sell data and do not use it for advertising. The app contains no usage analytics and no tracking. There is no automated decision-making, including profiling (Art. 22 GDPR).

14. Your rights

You have the right to:

• access your data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw any consent given, with effect for the future (Art. 7(3) GDPR)
• lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

To exercise your rights, contact the email address given in section 1.

15. Changes

We update this privacy policy when the app or the legal situation changes. The version shown in the app applies.