Privacy Policy
Last updated: September 1, 2026
ReadAware is a local-first reading app. The short version: your books and reading data live on your device; sync is optional and end-to-end encrypted, so we cannot read what you sync; AI features talk to the provider you choose, with your own key; and the app contains no ads, no trackers, and no analytics.
This policy covers the ReadAware apps and the readaware.app website ("we" is the ReadAware developer). For any question or request, write to hi@ahpx.me.
On your device
Everything the app works with — imported books, highlights, notes, reading progress and statistics, preferences, and the app's internal event log — is stored locally on your device. None of it is uploaded unless you enable one of the optional features below. Diagnostic logs are plain local files: they record technical events, never the text of what you read, and they leave your device only if you explicitly send a diagnostic report.
Sync — optional
If you connect a sync account:
- Account data. Your email address identifies the account and receives sign-in links (delivered through our email provider, Resend). Alongside it we keep technical account records: plan tier, storage used, and session data.
- Your content is end-to-end encrypted. The synced event log and your book files are encrypted on your device, with a key derived from a passphrase only you know, before anything is uploaded. Our server stores ciphertext: we cannot read your books, highlights, or notes. If the passphrase is lost, we cannot recover the data — that is the point.
- Operating the service, the server necessarily processes standard connection metadata — IP address, timestamps, object sizes — for delivery, quotas, and abuse prevention. The sync relay runs on Cloudflare infrastructure.
- Prefer your own storage? A transport plugin (for example WebDAV) syncs the same encrypted envelopes to a server you control, and our relay is never involved.
Payments — optional
Paid plans are processed by Stripe under Stripe's own privacy policy. We never see your card details; we receive the email you paid with, the plan, and the subscription status.
AI — optional
AI features only run when you configure them. With your own API key, the text a feature needs — a selection, a passage, your question, surrounding context — is sent directly from your device to the provider you chose and is governed by that provider's terms; we never see these requests, and your key is stored encrypted on your device. If you use the bundled AI subscription instead, requests pass through our relay to the upstream model provider: the relay meters token usage for billing and never stores or reads the content.
Diagnostic reports — optional
If something breaks, you can send us a diagnostic report from the app. It contains the app's technical logs (no reading content) and is stored with the app version, platform, and a hashed IP address, used solely to debug the problem.
Deleting your data
- Local data is yours to delete with the app.
- Settings → Data & Sync → Delete account permanently removes your account, the synced event log, and every uploaded file from our server, and cancels any active subscription.
- For any data request beyond that, email hi@ahpx.me.
The website
readaware.app is a static site on Cloudflare Pages. It runs no analytics scripts and sets no tracking cookies; Cloudflare processes ordinary server logs to deliver the site.
Children
ReadAware is not directed at children under 13, and we do not knowingly collect personal data from them.
Changes
When this policy changes, we will update this page and the date above; meaningful changes are also called out in the release notes.