Libratory

Your privacy

Libratory Reader for iPhone and iPad · local reading and the optional cloud beta

Local reading does not require a Libratory account. Some TestFlight builds also offer optional online page preparation, translation and voices. These features send selected content to the provider you choose, after permission. The currently published App Store release has no Libratory account or hosted reading service. This notice covers both experiences; a cloud beta feature is not a promise that it is available in the current App Store release.

Libratory is operated by Petar Sabev. For privacy requests, contact [email protected]. Please use private email, not a public issue, for account or personal information.

Your library stays on your device

Imported books, reading positions, saved passages, notes and local narration are stored on your device. Local reading does not upload a book to our cloud processing service. Device backups and files you share follow your device settings and the destination’s policies. Deleting your Libratory account does not delete these local books or their progress.

When content is sent

Approving a provider does not itself upload anything. Importing a book does not authorize a cloud upload. Content is sent when you use an online feature with that provider, including the limited preparation of upcoming passages needed for uninterrupted listening. Approving several providers does not send each request to all of them.

Depending on the feature, inputs can include page images, extracted text, nearby text needed for context, or translated text to be spoken. A page image or passage can contain personal information. The app identifies the recipient, purpose, information sent, and provider training and retention disclosures before you allow it. You can withdraw permission in account settings. Withdrawal stops new work; it cannot recall information already sent.

Our relay forwards reading content transiently. It does not keep a server library of your books, page images, prompts, generated translations, narration, audio or reading history. This is different from saying that no data is processed or that every provider retains nothing.

Cloud providers

The beta offers eligible combinations of OpenAI, Anthropic and DeepSeek for page preparation or text processing, and xAI and Inworld for online voices. Availability depends on your region, age eligibility, permission and service capacity. The in-app disclosure identifies the provider actually used.

We do not promise zero retention or account-specific exclusion from provider training where those settings have not been verified. Treat content submitted under such a disclosure as potentially retained or reviewed according to the provider’s policies. Providers may process information outside your country. The relay is hosted by Cloudflare; Apple supplies sign-in and purchase services. Their processing is separate from our transient handling of reading content.

xAI without Zero Data Retention: the current beta does not have ZDR enabled. xAI documents a default 30-day retention period with legal, safety and security exceptions. Its terms restrict submission of personal data without ZDR. Do not use an xAI online voice for documents containing personal information; choose another eligible provider or local reading. Permission does not override this restriction.

Where a provider supports it, we send a stable pseudonymous safety identifier derived from your account and scoped to that provider and environment. It does not contain your name or email. It helps the provider investigate misuse; it is not a guarantee that one person’s activity cannot affect shared service availability. Provider support for this identifier varies by endpoint.

Account, purchase and service records

Cloud accounts use Sign in with Apple. We retain the identifiers and session information needed to authenticate you, your provider-permission decisions, and a reported age band with its source and policy version. We do not collect a birth date or identity-document image through this flow. A reported age band is not independently verified identity. Where required, Apple age and app-association checks also apply.

We keep numerical credit balances, grants, charges, reservations, usage estimates and corrections, opaque request references and verified Apple purchase/refund records. These records are associated with your account. Apple handles payment details; we do not receive your card number. A support reference locates your account but does not grant access to it.

To identify service failures, we record limited cloud-blocker metadata such as provider, task category, fixed failure or recovery status, time and account reference. These records do not contain book text, titles, images or audio. We keep the latest state for each account, provider and task, including first and last failure and recovery times. These records are scheduled for deletion after 30 days without a new observation and removed on account closure. They help us explain restrictions and restore service.

We use account and operational information to provide and secure the service, financial records to administer purchases and resolve disputes, and your permission to control optional provider processing. We do not use advertising identifiers or sell your reading information. Apple may provide TestFlight feedback and diagnostics under your Apple settings; this notice does not describe those as anonymous.

Retention and deletion

Account and session information is kept while needed to provide access. Closing the account revokes access and removes its active profile and permission records. Minimal financial, purchase, security, withdrawal and request-deduplication records can remain where needed for accounting, outstanding usage, refunds, legal obligations, dispute resolution and preventing repeated grants or charges. Closure does not reset earlier spending or cancel an Apple subscription. There is no promise of immediate deletion from every provider or backup.

You can request access, correction, deletion or a copy of your personal information, and request restriction or object where applicable, by emailing [email protected]. Where processing relies on consent, withdrawal does not undo processing already performed. You may also complain to your local data-protection authority, including Bulgaria’s Commission for Personal Data Protection.

Private support and optional AI assistance

Support receives what you choose to send. An email opened from the account screen includes an account reference to help find your case; review the draft before sending. Do not include passwords, API keys or private book passages. Support correspondence is kept as needed to resolve the case and related disputes or obligations.

AI-assisted account support is a separate optional permission. If offered, its disclosure identifies Anthropic, the account/payment facts and support conversation involved, and the applicable training and retention terms. Cloud-reading permission does not allow this separate use. Without that permission, customer-case facts are not sent to the assistant; human support remains available. Model advice cannot execute an account action by itself. The beta currently does not offer customer-case AI consent while those support terms remain unpublished.

Shelves, downloads and sharing

A shelf is operated by its owner. Pairing sends the phone name you choose and establishes a separate shelf credential. Requests list or download books and include app/iOS/device information. A paired shelf can associate downloads with that device. The public shelf issues no paired-device key and records download counts with the requested file, time, bounded user-agent information and country when supplied by its proxy. These are download records, not your reading position, notes or listening history.

Optional local voice packs download through GitHub or Hugging Face and their delivery services, which receive the network request and IP address needed to deliver them. These downloads do not contain your book; installed local voices process text on the device. Apple manages its own voice and language assets. See GitHub’s privacy statement and Hugging Face’s privacy policy.

Sharing sends the file or annotations you choose to another app or service. Search Web sends selected text to your chosen search destination. Source links open their destination. These actions follow those services’ policies and do not authorize unrelated cloud processing.

Age and availability

Local reading remains available without a cloud account. Cloud access requires the age and regional eligibility shown in the app; the current limited beta enables adult provider access. Younger readers can continue locally. The App Store content rating and permission to use a particular cloud provider are separate.

Changes

Material changes to cloud processing are reflected in this notice and the applicable in-app disclosure. Updated provider permissions may be requested before new processing. Contact us if a disclosure or restriction is unclear.