Privacy Policy for Readerly

Last updated: 14 September 2026

Usage-sharing test withdrawn. An optional PostHog usage-sharing feature was briefly included in privately installed test builds on 14 September 2026. It has been removed from replacement builds and was not released through the App Store. The policy below describes Readerly without that feature. The historical test and any previously shared data are covered in section 9.

Readerly is an iPhone app for tracking the books you read. It is made by Jovanne "Joe" Villarino, an independent developer.

The short version: Readerly stores your library on your iPhone. There is no account to create. Optional online features send the information described below only when you choose to use them. An earlier private recommendation test is unavailable in replacement builds; section 6 explains its historical data handling.

This policy explains that in full — what stays on your device, what the app sends over the internet and to whom, and how Apple fits in when you subscribe.

The short version

• Readerly has no user accounts and no login.
• Your library and reading sessions are stored only on your device.
• Readerly does not keep a server-side library or taste profile.
• The app sends your book search text or a scanned ISBN to a book database so it can find the book. Nothing about your reading is attached to that request.
• Optional: if you tap "Find Covers" or "Find Descriptions" — after an import, or in Settings — Readerly sends each book's ISBN, or its title and author when it has no ISBN, to a book database to fetch the cover and details. No export file includes cover images or descriptions, so this is the only way an imported library gets them. You are asked first and it never runs on its own. Your reviews, notes, ratings and reading dates are never sent.
• Optional: if you tap "Find Genres" after an import, Readerly sends the titles and authors of your uncategorized books to Anthropic's Claude to identify their genres. You are asked first, every time, and it never runs on its own. Your reviews, notes, ratings, reading dates and progress are never sent.
• Optional: if your import file comes from a service Readerly doesn't know, you can tap "Figure Out This File" to send its column names and a few sample values to Claude to work out how to read it. Columns holding your reviews or notes are never sent, not even a sample. You are asked first.
• Barcode scanning happens entirely on your device. Camera images are never saved and never sent anywhere.
• Readerly has no advertising, no analytics tools, and no tracking. It never asks to track you across other apps or websites, because it doesn't.
• Nothing is ever sold or shared for marketing.
• Optional feedback: Settings → Send Feedback sends only the category, subject, message and screenshot you choose to a private Readerly inbox hosted on Cloudflare, with an email copy delivered to Readerly's operator through Proton Mail. Nothing is sent until you tap Submit Feedback. Section 7 explains storage and deletion.

What Readerly stores on your device

Your library and Profile information are written to a private database (Apple's SwiftData) inside the app's own storage on your iPhone. That includes:

• The books in your library — title, author, ISBN, page count, cover image, genre, and the shelf and star rating you give them.
• Your reading sessions — dates, times, page counts, and progress.
• Your optional Profile display name and photo, annual reading goals, favorites, pinned quotes, notes, and custom book lists. Choosing a photo uses Apple's system picker; Readerly receives only the photo you select and does not upload it or send it to an AI service.
• Your app settings and preferences (stored in iOS's standard settings storage).
• Derived literary data and any recommendation records retained from earlier private tests, including downloaded cover art, reveal progress, feedback, and whether you kept or passed a book. These records remain local and are preserved when updating the app.

Profile information is included when you choose to export your Readerly data. You can remove your photo in Edit Profile. Erasing the library in Settings also erases the local Profile, goals, custom lists, derived literary data, and retained recommendation records.

Importing a library. Readerly can import a CSV export from another reading service, such as Goodreads or The StoryGraph. You choose the file yourself, it is read on your device, and the books in it are written straight into the same local database as everything else. The file is never uploaded anywhere.

Reading the file makes no network requests, and no export file from any service contains cover images. Afterwards the app may offer two optional steps, each of which you have to tap: looking up missing covers and book details in a book database, and finding genres with Claude. Both are described below. Decline them and the import stays entirely on your device — with plain placeholder covers, because there was never a cover in the file to show.

This data belongs to you. The database stays in the app's private storage. Only the specific fields described below leave the device when you use an online feature; the database and import file are not uploaded.

About device backups. Readerly does not sync or upload your library database. However, if you back up your iPhone — to iCloud or to a computer — that backup is made by iOS itself and may include Readerly's data along with the rest of your apps. Those backups are controlled by you and by Apple, under Apple's terms and privacy policy, not by Readerly.

What Readerly sends over the internet

Readerly uses book databases to identify books and supply covers, Anthropic's Claude for the optional AI help described in sections 4 and 5, and a private Readerly feedback inbox hosted on Cloudflare with operator email delivery through Proton Mail when you submit feedback. There is no analytics service, advertising network, crash reporter, or server-side copy of your library database.

1. Book lookup — ISBNdb, through a small server I operate

When you search for a book, scan a barcode, or run one of the optional lookup passes, Readerly asks ISBNdb — a commercial book database — to identify the book. That request goes first to a small server I operate (a Cloudflare Worker), which forwards it to ISBNdb and returns the answer.

Why it goes through my server. ISBNdb requires a paid API key. A key placed inside an iPhone app can be extracted from it, so the key lives on the server instead, where it can also be rate-limited. This is the same server, and the same arrangement, described in section 4 for Claude.

What is sent: either the text you typed, or a scanned ISBN, or — for a lookup pass — one book's ISBN, or its title and author when it has no ISBN. That is the whole payload. Your ratings, reviews, notes, reading dates, progress and shelves are never sent, and there is no account, name, email or advertising identifier to send.

What identifier is attached. One thing is: a random ID generated on your device the first time a network feature is used — the same one described in section 4. It contains nothing about you or your phone, exists so requests can be counted against a daily limit, and is destroyed when you delete the app.

What my server keeps. Three things, and it is worth being exact because an earlier version of this policy said I kept nothing:

• The book's own details, cached. An answer about a book — its title, author, cover address, description, publisher and so on — is stored for up to 30 days and reused for anyone who asks about the same book. This is a cache of public facts about books, not of anything about you. It is keyed by the ISBN, not by your device, and one reader cannot be distinguished from another in it.
• A search's results, cached. When you search by words rather than by an ISBN, the list of books that came back is kept for up to 7 days so the same search does not have to be asked twice. It holds the same public facts about books as the entry above, but it is filed differently, so it is worth saying how. The words you typed are not stored. What files the entry is a digest of them — a fixed-length fingerprint that the same search always produces. A digest is not a guarantee of anonymity: someone who guesses a search can compare its digest. The cache is not tied to your install ID.
• A count, for one day. A running total of how many lookups your random ID has made today, so a daily limit can be enforced. It is a number. It expires after midnight UTC and is not a history of what you looked up.

What it does not keep: your search text, a list of the books you asked about, or anything tied to your library.

And no log of what you asked. No logging service is attached to the server, nothing streams its output anywhere, and its code contains no logging statements at all — so no request and no IP address is written down. Cloudflare, which runs the machine the server sits on, keeps aggregate figures for it — how many requests, which status codes came back, how much processor time was used — for around three months. Those are totals, not requests: nothing you sent is in them. Like any company carrying internet traffic, Cloudflare necessarily handles the connection itself, including the address it arrives from. That is how the internet works rather than something the server records.

2. Book lookup fallback — openlibrary.org

When ISBNdb is unreachable, is rate-limited, or simply has never heard of a book, Readerly asks Open Library instead — a free public service that needs no key. That request goes directly from your device and carries no identifier at all, not even the random ID. It sends the same thing: an ISBN, or a title and author.

This is also the only source in builds of the app configured without the server above, where Open Library is used on its own.

Books that neither source can identify simply keep the plain placeholder cover and no description. Nothing is invented for them.

Either way, the pass never starts on its own. It tells you how many books it would ask about before you agree, and you can stop it while it runs.

3. Cover images — ISBNdb, Open Library and Internet Archive

Book cover artwork is downloaded from whichever database supplied it — ISBNdb's image service (images.isbndb.com) or Open Library's (covers.openlibrary.org) — so your library shows real covers. Readerly normally stores the web address of a cover and lets iOS cache its image. Earlier private recommendation tests also saved cover bytes locally. Open Library can redirect older artwork to its Internet Archive cover storage at archive.org and ia*.us.archive.org. These image requests go directly from your device and carry no Readerly install identifier.

About the book databases

Neither database is run by me. ISBNdb is a commercial service operated by ISBNdb.com LLC; Open Library is a free public service operated by the Internet Archive. Like any website you connect to, their servers necessarily see the incoming connection itself — including, for the direct requests, your device's IP address — as a technical requirement of answering it. How each handles that is governed by their own privacy policy, not this one.

Requests routed through my server reach ISBNdb from the server rather than from your phone, so what ISBNdb sees there is my server's address, not yours.

4. Genre categorization — Anthropic's Claude (optional, consent required)

Reading services do not export a usable genre. A real Goodreads export of 213 books contained no genre at all once shelf names were filtered out; a StoryGraph export of 675 contained 81, most of which were plot tropes rather than genres. So Readerly can offer to identify genres for you using Claude, an AI service operated by Anthropic, PBC.

This never happens automatically. After an import, Readerly shows a button. Tapping it opens a confirmation that names Anthropic and states exactly what will be sent. Nothing leaves your device unless you then confirm.

What is sent: the title and author of each book that has no genre. That is the whole payload.

What is never sent: your reviews, your private notes, your star ratings, your reading dates, your progress, your session history, your shelves, your search history, your camera images, or any name, email or account — the app has no account to send.

How it is sent. The request goes to a small server I operate (a Cloudflare Worker), which forwards it to Anthropic. This exists so the API key is not inside the app, and so the number of requests can be limited. The only identifier attached is a random ID generated on your device the first time the feature is used. It contains nothing about you or your phone, is used solely to count requests against a daily limit, and is destroyed when you delete the app. My server stores none of what you send: it keeps a running count of requests against that random ID and nothing else — not your titles, not your authors, and no log of the request itself.

What comes back. One genre per book, chosen from a fixed list of about thirty-five categories built into the app. Anything outside that list is discarded rather than saved, so the feature cannot introduce arbitrary text into your library. Books Claude does not recognize are simply left uncategorized — Readerly does not guess.

AI-generated content. Genres identified this way are produced by AI and can be wrong. You can change any book's genre yourself at any time, which overrides the suggestion permanently.

What Anthropic does with the request on their side — including how long they keep it — is governed by their own privacy policy and commercial terms, not this one. It is not something I control, and I will not claim a retention period on their behalf: for that, read their policy at anthropic.com/legal/privacy. What I can tell you is what is sent, which is above, and that under those commercial terms data sent through their API is not used to train their models.

Declining costs you nothing else. Every other feature works normally; the affected books stay uncategorized, exactly as they arrived.

5. Reading an unfamiliar export file — Claude (optional, consent required)

Readerly recognizes the export formats of the major reading services. If you import from somewhere it doesn't know — or from a spreadsheet you made yourself — it can offer to work out what your columns mean.

This never happens automatically, and it never happens for a file Readerly already understands. A Goodreads or StoryGraph export makes no request at all.

What is sent: your file's column names, and up to three short sample values per unrecognized column. It also sends a bounded set of actual date strings and shelf names it could not read. Short samples may include ratings, reading-status labels or other user-entered values from unresolved columns.

How samples are limited. Recognized review and private-note columns are excluded from column sampling. For other columns, sampled values that look like prose cause that column's samples to be withheld; its name may still be sent. These filters cannot identify every short personal value in an unfamiliar column.

The request describes the file's structure using these limited samples. It does not upload the full export, the app's library database or its reading-session history. Samples are used to interpret the import, not to personalize recommendations.

What comes back. Which column holds which field, what format your dates are in, and what your shelf names mean. Every answer is checked against your actual file before it is used, and anything Readerly cannot verify is discarded.

You see what it decided. The import preview lists each thing it worked out in plain language — "Read your 'Pgs' column as Page count" — before you import anything. If it looks wrong, don't import.

6. Earlier private recommendation tests

A recommendation feature in earlier privately installed test builds has been deferred and is unavailable in replacement builds. It is not a current app feature. Updating preserves existing local data and does not retract information that an external provider already processed.

What those tests sent. Each match required separate permission. Approved requests sent library titles, authors, book identifiers, genres, formats, shelves and exact star ratings when available through Readerly's Cloudflare Worker to Anthropic's Claude. Later test versions also included bounded public catalog descriptions and subjects, saved literary analysis, a chosen mood, repeat-book exclusions, and up to 100 revealed recommendation outcomes with optional first impressions and linked library ratings or shelves. The Worker used this evidence to compare literary themes and choose a catalog book. These preferences were personal, not described as anonymous.

Private notes, quotes, written reviews, Profile name or photo, exact reading dates, progress positions, reading sessions and the local database file were excluded. A random install ID went to the Worker for request limits and counters; it was not forwarded to Anthropic or the book catalogs. Catalog services received public subject searches or book identifiers, not ratings or the full literary dataset. Cover requests went directly to Open Library or Internet Archive and carried no Readerly install identifier.

Storage and retention. Derived literary evidence, saved analysis, recommendations, artwork, reveal progress and feedback remain in the app's local data unless erased. Local derived-data maintenance makes no network requests. These records are included in a library export and removed by Erase Library; export first if you want to keep a copy. The separate inspection and history screens from the test feature are no longer available in replacement builds.

Readerly's Worker did not log or save incoming taste payloads, library evidence, recommendation text or personal literary profiles; these existed in memory while a request was processed. It could cache public catalog metadata and literary features derived from public sources, keyed by the work, source fingerprint and analysis version. Those shared entries contain no ratings, library associations, record of ownership, incoming app descriptions or features derived from personal library requests. Daily quota and spending counters were separate. Cloudflare processed request and connection information to operate the service.

Anthropic processed supplied evidence under its commercial API terms. Its commercial retention policy describes standard API input/output deletion within 30 days, with exceptions including legal obligations and policy enforcement. Readerly does not promise zero retention or a special agreement. Anthropic's API data-handling guidance states that retained data is not used for training without express permission; Readerly did not opt library data into training. Updating or deleting the app cannot retract an earlier request. Contact Support about historical data or a deletion request; the provider's retention and deletion terms still apply.

7. Send Feedback — private Readerly inbox

In Settings → Send Feedback, you can report a bug, request a feature, or send general feedback. Choose a category, write a subject and message, and optionally select one screenshot with Apple's system photo picker. You can preview, replace or remove the screenshot before submitting.

What is sent. Only the category, subject, message, optional screenshot and a random submission reference used to avoid duplicate retries. Readerly does not automatically attach your library, notes, quotes, reading history, taste dataset, retained recommendation records, Profile photo, install identifier, app version or device diagnostics. The app creates a resized JPEG without the original photo metadata or filename. Anything visible in the screenshot or written in your message is part of the feedback, so review it before sending.

Your choice. Selecting a category, typing or choosing a screenshot does not upload anything. Upload starts only when you tap Submit Feedback. A failed submission keeps the draft open for retry. The form does not collect an email address or provide an in-app reply thread; use the support email below if you need a reply.

Who can access it. Feedback is stored in a private inbox operated by Readerly on Cloudflare and an email copy, including your chosen screenshot, is delivered to Readerly's operator at Proton Mail to handle your request. Cloudflare processes the email for delivery and Proton Mail processes the operator's email copy. It is not published or forwarded to an AI provider. Access to the Cloudflare inbox requires a separate administrative credential that is not included in the app. The inbox records a submission timestamp and reference; it does not store your IP address or a device identifier. Cloudflare handles connection information to operate the service.

Retention and deletion. Active inbox records, including screenshots, expire after 30 days and may be deleted sooner. Cloudflare's database recovery history can retain deleted content for up to another 30 days. Operator email and downloaded copies have separate retention: they are kept only while needed to handle your request and are deleted separately when no longer needed or when you request deletion. The Cloudflare inbox's automatic expiry does not delete those copies. Save the reference shown after a successful submission and include it when contacting [email protected] to request earlier deletion. Deleting the app or erasing your local library does not retract feedback already submitted. Recovery copies are not used as an ongoing inbox.

8. Get This Book — optional external print-book search

Book details offer Get This Book without requiring a subscription or adding the book to your library. Opening this sheet does not contact a retailer. Only tapping its labeled Amazon link opens a print-book search in your browser or the associated app.

The link contains a valid ISBN for an identified physical edition, or the book's title and known author. It includes no ratings, shelves, feedback, notes, install identifier or other private Readerly data. These links have no affiliate tags. The retailer and your browser or associated app handle the visit under their own privacy policies, including any account you use there. Readerly does not receive purchase details and does not automatically buy or save the book.

9. Withdrawn usage-sharing test

The earlier private test build offered Share Usage and sent nothing to PostHog until the reader agreed. When enabled, it sent selected app actions (such as opening the app, visiting a tab, importing, saving reading progress, or using the purchase flow), event times, app/build and major iOS versions, and random installation and visit identifiers to PostHog's United States Cloud. The installation identifier linked that installation's actions over time; the history was pseudonymous, not guaranteed anonymous.

Those events did not include names, book details, library contents, notes, reading-session contents, payment information, screenshots or screen recordings. The project was configured to discard event IP addresses and disable location enrichment. Network infrastructure still receives connection information.

Stopping the old build. If you still have a test build with Settings → Usage Sharing, turn sharing off there or install its replacement. Turning sharing off clears unsent events and attempts to cancel any request in progress. Replacement builds contain no usage collector or sender and cannot upload an old queue. A prior local usage file may remain in the app's private storage; it is excluded from device backups and library exports. Removing the feature does not remove your library.

Previously shared history. Updating the app, switching sharing off or deleting the app does not delete events already received by PostHog. That history remains until explicitly deleted, subject to PostHog's data-availability limits; Readerly does not promise a fixed automatic deletion schedule. PostHog processes it under its privacy policy. To request deletion, contact [email protected]. If you still have the old test build, save the usage reference ID from Usage Sharing before updating or deleting the app and include it in your request. If you already updated, contact Support for help; without that reference, locating a particular installation's history may not be possible. The app does not submit a deletion request automatically.

If you use none of the above

If you never search for a book, never load a cover, and never tap "Find Genres" or "Figure Out This File", and never submit feedback or follow an external book link, Readerly's library and local derived-data maintenance make no network requests. StoreKit may still communicate with Apple for subscription status.

Camera and barcode scanning

Readerly can scan a book's barcode so you don't have to type in its details.

• Scanning uses Apple's VisionKit, which reads the barcode entirely on your device.
• Camera images and video frames are never stored and never transmitted anywhere — not to me, not to a book database, not to anyone.
• The only thing that leaves the camera is the barcode's number (the ISBN), which is then used exactly like a typed search: sent to a book database to look up the book, as described in sections 1 and 2.
• iOS asks your permission before the camera is used, and you can withdraw it at any time in Settings → Privacy & Security → Camera. The rest of the app works without it; you can always add books by typing.

Subscriptions and Apple

Readerly Pro is optional and unlocks the part of the Insights dashboard that isn't free. It is sold entirely through Apple's In-App Purchase system, as an auto-renewing monthly or annual subscription.

• Apple processes the payment. I never receive, see, or store your payment card number, billing address, or Apple Account details.
• The app asks Apple's StoreKit only one thing: whether this Apple Account currently owns Readerly Pro. It gets back a yes or no. That answer stays on the device.
• Your purchase is handled under Apple's privacy policy and terms.

Third-party code in the app

Readerly includes two open-source libraries — Pow and Lottie — used only to draw animations on screen. They collect no data, and neither makes any network requests.

There are no analytics SDKs, advertising SDKs or crash-reporting services. The online services the app uses are described above.

Children's privacy

Readerly is a general-audience reading tracker and is not directed at children under 13.

The optional online features and their disclosures apply to anyone who uses them. Readerly does not knowingly seek personal information from children under 13. If you are a parent or guardian and have a question about information sent through an online feature, please get in touch at the address below.

Your data, and how to delete it

You can manage your local reading data on your device:

• Delete individual items — remove a book or a reading session inside the app at any time. Local taste markers reconcile to remove deleted books.
• Erase Library — in Settings, removes all local library content, including Profile, goals, lists, derived literary data and retained recommendation records. Export first if needed.
• Delete everything — delete the Readerly app from your iPhone. That removes the app's local database and all of the reading data in it. This is permanent, so export or note anything you want to keep first.

There is no account to close or stored server-side library to erase. Questions about a request already sent to an external provider can be directed to the support address below; that provider's retention and deletion terms still apply. For submitted feedback, include your submission reference when requesting deletion; the retention and recovery-copy limits in section 7 apply.

One important note: deleting the app does not cancel a subscription. Subscriptions are managed by Apple — cancel in Settings → your name → Media & Purchases → Subscriptions on your iPhone.

Contact

Questions about this policy or about privacy in Readerly:

support@thereaderlyapp.com

Changes to this policy

If Readerly changes in a way that affects this policy — for example if a future version added a new network service — I will update this page and change the "Last updated" date at the top. Significant changes will be noted in the app's release notes. Because the app has no accounts, there is no mailing list to notify; please check back here.

Last updated: 14 September 2026