Privacy policy
My Pocket Library is a reading tracker made by DNA TECHBASE S.R.L. ("we", "us"), a company registered in Romania. This policy explains what the app stores about you, why, where, and how to remove it. It applies to the iOS and Android apps. The website at mypocketlibrary.com only shows information about the app: it has no sign-in, sets no cookies and keeps nothing about you beyond Firebase Hosting (Google)'s standard request logs.
Who is responsible
DNA TECHBASE S.R.L., Aleea Romanilor Nr. 23, Bl. 12, Sc. 2, Ap. 107, Deva, Hunedoara, Romania (trade register J2025048383009, CUI 52084942) is the data controller. Write to contact@dnatechbase.com for anything in this policy.
What we store, and why
| Data | Why | Where it comes from |
|---|---|---|
| Account: email address, display name, a user ID; for Google or Apple sign-in, the identifier those services give us | To sign you in and keep your library yours | You, or Google / Apple when you sign in with them |
| Your library: books, shelves, reading status, pages read, ratings, notes, and the arrangement of objects on your shelves | This is the app: it is what you asked us to keep | You, plus book details (title, author, publisher, page count, description, cover image address) fetched from the catalogues below |
| Photos you take or choose: book covers, spines, backs, and pictures placed in frames | Shown on your shelves | Your camera or photo library, only when you choose a photo |
| Subscription: whether your subscription is active, when it renews or ends, and which plan it is | To open the app for subscribers; this is what the paywall checks | RevenueCat, from Apple or Google after you subscribe. We never see your card or payment details |
| Profile: display name, style-quiz answers, the Atlas starting place | To make the library look the way you chose | You |
| Location (one point): the latitude and longitude of your Atlas starting place, with the nearest city's name | Only if you press "Use where I am" on the Atlas; you can pick a city instead and the app never asks otherwise | Your device, with your permission |
| Crash reports: the error text and stack trace, which part of the app was open, your device model, operating system and app version, with your user ID | To find and fix what went wrong; sent to Firebase Crashlytics (kept 90 days) and to us (deleted with your account) | The app, when it crashes or hits an error |
| Usage records: which parts of the app you use (described below), with your user ID, platform and app version | To improve the app; deleted with your account and after about 13 months | The app, as you use it |
| App analytics — only if you allow it: the screens you open and the same kinds of actions as the usage records, with your user ID and an identifier for this installation | To see how the app is used in aggregate; kept 14 months by Google Analytics | The app, after you choose Allow |
| Ad measurement — only if you allow it: that the app was installed and opened, with the device's advertising identifier | To see which of our Meta ads led to installs | The app, after you choose Allow |
We do not show advertising in the app. To improve it, the app records which parts of it you use — for example the sections you open, how you add books, and the steps of the subscription screen — together with your account ID, the platform and the app version, in our own database. Nothing is stored on your device for this, nothing in these records goes to advertisers or analytics companies, and they are deleted with your account and automatically after about 13 months.
Two kinds of measurement by other companies exist, and both are off until you allow them. We advertise the app on Meta (Facebook and Instagram), and to see which of those ads lead to installs the app can tell Meta it was installed and opened; and the app can send Google Analytics the screens you open and the actions you take, so we can see how the app is used in aggregate. The app asks once, after you sign in: on iPhone through Apple's tracking prompt (one answer covers both; Allow turns both on, anything else keeps both off), on Android through a card in the app with an Allow and a Don't allow button. You can change your mind at any time in Profile → Privacy choices (on iPhone that opens iOS Settings → Privacy & Security → Tracking). Both are described under "Services that process data for us". We do not sell your data, and nothing about your library is shared for advertising. The app does not collect your contacts, precise movements, or anything from other apps.
Services that process data for us
- Firebase (Google LLC) — sign-in (Firebase Authentication), the database that holds your library and profile (Cloud Firestore), and the storage for your photos (Cloud Storage), in Google Cloud's us-central1 region. Google processes this data under our instructions and its own data-processing terms.
- RevenueCat (RevenueCat, Inc., United States) — manages the subscription. It receives your user ID and, from Apple or Google, the record of your subscription purchases and renewals, so it can tell the app and our server whether your subscription is active. It does not receive your library, photos or email address. Payment itself is handled entirely by Apple or Google.
- Google Books and Open Library — when you add a book, the app looks up its ISBN or title in these public catalogues. The request carries the ISBN or title you typed or scanned, not your identity.
- Google Gemini — only when you press "Ask AI to read the cover". The compacted cover photo is sent, through our own server function, to Google's Gemini API to read the title and author printed on it. Nothing is sent until you press that button, and the caption under it says so. We do not store the photo on that path beyond answering the request. We use the paid Gemini API, under which Google does not use prompts or responses to train or improve its models, and processes them under the Google Cloud Data Processing Addendum.
- Slack (Slack Technologies, LLC, United States) — our team's internal notifications. When an account is created or deleted, or a subscription starts, renews, ends or is refunded, a message with the account ID and that event (product, store, price) goes to our private Slack channel. It never carries your name, email address, library or photos.
- Meta (Meta Platforms Ireland Ltd.) — only if you allow it: on iPhone by choosing Allow when iOS asks whether the app may track you, on Android by choosing Allow on the measurement card after you sign in (or turning it on later in Profile → Privacy choices). The app then tells Meta that it was installed and opened, together with an identifier the SDK creates for this installation and technical details of the device: model, operating system and app version, mobile carrier, time zone, language, screen size and similar. On iPhone it also sends Apple's advertising identifier (IDFA), which is what the tracking permission covers; on Android the device's advertising ID, how the app was installed from Google Play and, if the Facebook app is on the phone, that app's attribution identifier. Meta uses this to count which of our ads led to installs and may match it to your Facebook or Instagram account under Meta's own privacy policy; we see only totals. Your account, library, photos, name and email are never sent. Withdrawing — in iOS Settings → Privacy & Security → Tracking, or the switch in Profile on Android — stops anything further being sent at once, and the SDK fully stops the next time the app starts. If you do not allow it on iPhone, Apple's own ad-measurement system (SKAdNetwork) can still tell Meta, in aggregate and without identifying you or your device, that an ad led to an install.
- Google Analytics for Firebase (Google LLC) — only if you allow it, with the same answer as Meta. It receives which screens you open and the same kinds of actions as our own usage records — adding or finishing a book, the steps of the subscription screen — together with your user ID, an identifier Google Analytics creates for this installation, your device model, operating system, app version, language and country (from the IP address, which Google Analytics does not keep). It never receives book titles, photos, your name or email. Google processes it as our processor; we have turned off its advertising features, it is not joined to your Google account, and Google keeps it for 14 months. When you allow it, RevenueCat also passes your subscription purchases to the same analytics property, so we can see revenue next to usage. Withdrawing stops collection and resets the analytics identifier on your device.
- Firebase Crashlytics (Google LLC) — if the app crashes or hits an error, it sends a crash report: the error text and stack trace, which part of the app was open, your device model, operating system, app version, free memory and storage, and your user ID, so we can find your report if you write to us. Crashlytics keeps reports for 90 days; we also keep our own copy until your account is deleted. Reports never include your library or photos. This does not ask for your permission: keeping the app working is our legitimate interest.
- Amazon — on the wishlist, the app can open a book on Amazon.de. The link carries the book's identifiers and our Amazon Associates tag; the app sends Amazon nothing about you. As an Amazon Associate we earn from qualifying purchases. Once you are on Amazon's site, Amazon's own privacy notice applies.
Where your data is processed
Your account, library and photos live in Google Cloud's us-central1 region, in the United States, and the AI cover reading is answered there too, so your data leaves the European Economic Area. RevenueCat and Slack, named above, also receive their part of it in the United States, under their own data-processing terms. Google acts as our processor under the Google Cloud Data Processing Addendum, which incorporates the European Commission's standard contractual clauses as the safeguard for those transfers.
What the app keeps on your device
The app stores things locally so it opens quickly and works offline: a copy of your library and profile in the app's own database, your sign-in session so you are not asked for a password every time, and a few small settings and markers — whether you have seen the welcome tour, your answer to the measurement question (and, on Android, both switches), which Atlas badges have already been celebrated on this device, your sound and haptics preferences (and the seasonal edition's effects, when it is on), crash reports waiting to be sent if the app was offline when they happened, and, in the apps, when you started using the app and when the app last asked you to rate it in the App Store or Google Play (so it asks rarely; the rating itself is between you and the store). The first time you read a cover on the device, the app also keeps the reading engine's English language file, so later readings start faster. We do not send any of that anywhere, except that waiting crash reports are sent once you are back online (see “What we store, and why”). Signing out ends the session; the rest stays on this device until you delete the app or clear its data.
Server logs
When the app calls one of our server functions — reading a cover with AI, or deleting an account — Google Cloud records a technical log for us with the time, the outcome, your account identifier and the usual request metadata such as an IP address. We use these only to keep the service working and secure, and they are discarded on Google Cloud's standard schedule, within 30 days.
Automated decisions
Nothing about you is decided automatically. The AI cover reading only suggests a title and author for you to accept or reject; it has no effect on your account.
Text recognition of a cover photo on the device ("reading" the cover before you ask AI) happens in the app itself; that photo does not leave your device for it.
Legal bases (for readers in the EU/EEA)
- Keeping your account and library: performance of our contract with you (the terms of use).
- Ad measurement with Meta and app analytics with Google: your consent, given with Allow (on iPhone Apple's tracking prompt, on Android the measurement card) and withdrawn in Profile → Privacy choices (on iPhone through iOS Settings).
- Location and the AI cover reading: your consent, given by pressing the button each time; you can decline or withdraw by not using them, and change or clear your Atlas place at any time.
- Keeping the service secure and working — preventing abuse, and the crash reports (ours and Crashlytics') that let us fix errors: our legitimate interest.
- Understanding how the app is used, so we can improve it (the usage records described above): our legitimate interest. You can object at any time by writing to us; we will then stop recording your use of the app and delete what was recorded.
How long we keep it
For as long as your account exists. When you delete your account, your library, photos, profile, subscription record, usage records, crash reports held by us and sign-in are erased at once, and we ask RevenueCat to delete its record of you; residual copies in backups are removed within 30 days. Photos that leave the device for the AI cover reading are not stored by us on that path.
Data held by the measurement services expires on their own schedules: Crashlytics reports after 90 days, Google Analytics data after 14 months; Meta keeps what it received under its own policy. None of it carries your name or email. If you want the Google Analytics data linked to your user ID removed sooner, write to us and we will ask Google to delete it.
Deleting your account
In the app: Profile → Delete account, or, if you have not yet confirmed your email address, from that verification screen. You are asked to confirm it is you — your password, or a fresh sign-in with Google or Apple — and then everything listed above is erased and your sign-in is removed. You can also ask by email from the address on your account: contact@dnatechbase.com. See Delete your account for details.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its processing, and to receive it in a portable form. Write to contact@dnatechbase.com. You may also complain to your data-protection authority; ours is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).
Children
The app is not directed at children under 16, and we do not knowingly keep accounts for them. If you believe a child has an account, write to us and we will remove it.
Security
Data travels over HTTPS only. Your library and photos are readable only by your own signed-in account, enforced by server-side rules; shared catalogue data is read-only for readers. The two operators of the app can view account details (email address, sign-in method, subscription status) and can suspend or delete accounts, for support, security and abuse prevention; they cannot open your library. If the app crashes, it sends a crash report (the error text, which part of the app was open, your device and app version) to Firebase Crashlytics and to us so we can fix it; our copy is deleted with your account.
Changes
If this policy changes, the new version is posted here with a new effective date. Material changes are also announced in the app.