Who is responsible
Lorelibris is operated by Nadija Khnykina, Bruder-Klaus-Platz 2, 51063 Cologne, Germany. Contact: [email protected].
This policy covers the Lorelibris Android app and this website, including closed testing.
Reading on your device
Imported books, saved translations, book memory, notes, reading positions, settings and saved narration are stored in the app’s private device storage. Ordinary reading does not require an account.
PDF text recognition runs on the device. Downloading an additional recognition model transfers technical connection data to its download host, but does not upload your PDF, page images or recognized text.
Your own AI keys are stored locally using Android Keystore-backed encryption. They are excluded from portable backups and cloud library copies. Their selected provider receives the key when you authenticate a request.
Translation and narration
When you start an AI feature, the selected service receives the necessary book passages and context. This can include nearby paragraphs, names and glossary entries, chapter summaries, language, voice and delivery instructions. Book analysis and narration planning can also send chapter text.
With your own key, requests go to your configured provider. Supported text providers are Google Gemini, DeepSeek, OpenAI, Anthropic, xAI and Alibaba Model Studio. Availability depends on the chosen feature and model.
With managed Lorelibris access, relevant text passes through our Supabase-hosted service to the configured provider: Gemini or DeepSeek for text, and Gemini for cloud narration. Access depends on your account.
A custom speech endpoint or an external dictionary receives the text you explicitly send to it. Your selected endpoint, device speech engine and AI providers apply their own processing and retention terms. Do not send content you are not permitted to disclose.
Account and service records
Supabase provides authentication and backend services. Signing in with Google shares the identity information needed to create or access your account, such as an account identifier, email address and profile information.
We process account identifiers, access rights, request identifiers, outcomes and usage information to operate the service, recover interrupted work, estimate costs and prevent misuse. Service providers also receive technical connection data such as IP addresses.
Subscription translation responses have a seven-day recovery window, followed by scheduled cache cleanup. Operational usage records are separate from the text cache and are retained as needed for account operation, security and accounting.
Optional cloud copies
When you enable cloud saving or synchronization on an eligible account, library content is sent to private Backblaze B2 storage in the EU region. This can include original books, translations, memory, notes, positions and eligible saved narration. Supabase stores the account and backup metadata.
Up to three library revisions are retained. An earlier revision may still contain a book you removed from a later one. Clearing cloud data or deleting your account uses the explicit erasure process.
Cloud copies are access-controlled, not end-to-end encrypted with a key held only by you. API keys and sign-in sessions are not included. Cloud saving is optional.
Storage and deletion
Device data remains until you remove it, clear app storage or uninstall the app, subject to the operating system. Local backup files and exports you save elsewhere must be managed separately.
Cloud data is kept until you delete it or an applicable retention rule removes it. For accounts with a paid cloud period, cleanup is scheduled after 14 days without renewed paid access. That rule does not remove device files or the sign-in account.
On an account-deletion request, we delete the account and associated server/cloud data, subject to necessary identity checks and any specific legal retention duties. Records needed for a legal obligation or dispute are restricted to that purpose and deleted when no longer required.
Contact correspondence is kept while handling your request and for any necessary follow-up or legal obligation. Request deletion through the dedicated Delete account page.
This website and email
The website has no advertising, marketing trackers or analytics scripts. Fonts and illustrations are served with the site. Its language links do not store a tracking identifier.
Cloudflare hosts and protects the website and processes technical request information, such as IP addresses and browser data. Contact email is handled through Namecheap Private Email.
The contact form sends your optional name, email address, topic, message and chosen language through Cloudflare to our contact mailbox. This information is used to handle your request; it is not added to the app database. Cloudflare Turnstile checks technical browser and connection signals to protect the form against automated abuse. The check loads when you begin using the form.
You can also email us directly. Email links open a draft in your mail application and do not send it automatically. Include only the information necessary for your request; never send passwords or API keys.
Purposes and legal bases
We process information needed for requested account, AI, cloud and support services under Article 6(1)(b) GDPR. Necessary website delivery, service security and abuse prevention rely on Article 6(1)(f), with an interest in a reliable and secure service.
Legal recordkeeping relies on Article 6(1)(c). Where processing specifically relies on your consent, Article 6(1)(a) applies and you may withdraw that consent for future processing.
Recipients and international processing
The services described above receive only the information required for the feature you use. Some providers may process information outside the EEA. Applicable transfer arrangements depend on the provider and service, including adequacy decisions or standard contractual clauses where applicable.
Contact us for information about the arrangements relevant to your use. The selected AI provider’s terms also determine its own logging, retention and possible use of submitted content. We do not promise that every provider or account tier excludes model training.
Lorelibris does not sell your library content or use it for advertising.
Your choices and rights
Where applicable, you may request access, correction, deletion, restriction or portability of your personal data; object to processing based on legitimate interests; or withdraw consent. Write to [email protected].
We may need proportionate information to verify that a request concerns your account. Never send your password or AI keys. We normally respond within one month and explain any legally permitted extension.
You may complain to a data-protection supervisory authority, including the authority in your place of residence. Our local authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia.
Lorelibris is not designed or marketed specifically for children. Contact us if you believe a child has provided information without the required authorization.
Policy updates
We update this policy when the service or its data handling changes. The date above identifies this version. Material changes requiring notice or consent will be communicated through an appropriate channel.