Privacy

The short version

• The library, the time and the notes live on your phone and work with no account and no internet.
• AI generation is disabled for everyone. References to AI processing below describe previously sent data and its retention, not a feature opened by the current subscription.
• The server comes in when you sign in or sync between your own devices; earlier versions may also fetch book details from Apple Books. Besides that, the app asks it at launch which versions are still supported and sends it anonymous counts from the subscription screen. Each time it asks, the server adds one to an anonymous daily count for that app version and platform, so we know when an old version can be retired; no account, device or address is kept with it.
• Photographed pages never reach our server: the text on them is recognized by the phone itself. Your phone’s own backup may include them, as described under What stays on the phone.
• The app has no analytics tools inside. Beyond what its features need, it reports one thing about how it is used: how often the subscription screen is shown and how purchases on it end, which the server keeps only as anonymous daily totals. On the server we also count, in weekly totals, whether the free AI answers lead to subscriptions and whether people come back to the AI. The site counts visits and page steps only if you allow it. No ads and nothing sold on: we make money only from what you buy in the app.
• Deleting your account wipes everything from the server, conversations included, and takes one button in settings. A few marks stay: that the same Apple or Google account already had its free AI answers and that Apple refunded a purchase, neither linked to you, and, for fifteen days, a record that the account was deleted.

Who is responsible

Pagetime is made by Eduard Abdullin, an independent developer enrolled in the Apple Developer Program as an individual. He decides why and how the data is processed, which makes him the controller under the GDPR.

About your data, write to privacy@pagetime.net. About anything else, hello@pagetime.net.

This document covers the Pagetime apps for iPhone and Android, the pagetime.net site and the api.pagetime.net server. There is nothing else.

What stays on the phone

Everything you do in the app is written to the phone first, and with no account that is where it ends, apart from the anonymous counts from the subscription screen described below. The tracker, the notes, the statistics and the widgets all work on a plane.

• Books, reading sessions, thoughts, quotes and ideas — in the app’s own storage.
• Photographed pages — as files inside the app. They never reach your camera roll and never reach the server.
• The number of free page scans already used — in the Keychain, marked “this device only”, so deleting and reinstalling the app does not reset it. The number itself is not sent anywhere. Once you sign in, the server also counts the notes that arrived with recognized page text while you had no subscription, and the app uses the larger of the two numbers, so another iPhone on the same account does not start from zero. Deleting notes does not reset either count.
• Text recognition runs on the phone itself. The photo is not sent anywhere for it, not even for a second.
• The daily goal and its history, the streak, the exact reminder time, the theme and the ink color — in the app’s settings. Reminders are scheduled by the phone; we send no push notifications at all. After sign-in, the time zone, the first day of the week and the selected reminder hour are also copied to the server as described under Sync.
• The sign-in token — in the Keychain, marked “this device only”, so a backup does not carry it to another phone.
• Your phone’s own backup. On iPhone, if iCloud Backup or a backup to a computer is on, it includes the app’s storage, page photos too; the sign-in token and the scan count stay on this iPhone. On Android, Google’s backup of the phone includes the library, notes and settings, but not page photos and not the sign-in; photos move to a new phone only in a direct transfer from the old one. These backups belong to your Apple or Google account, and we have no access to them.

Signing in

There is nothing to register and no password of ours: the iPhone app signs in with your Apple Account, the Android app with your Google account. We never see or store a password.

Apple gives us a permanent identifier issued to this app alone, and an address — either your real one or a hidden “name@privaterelay.appleid.com” if you chose to hide it. Google gives us your account’s permanent identifier, its email address and the name on the account.

The server then keeps: that identifier, the address, your name, the device name, a fingerprint of the session token, the dates the session was created and last used — and, for Apple, a token Apple issues at sign-in, kept for one purpose only: to revoke Pagetime’s access at Apple when you delete your account.

An Apple account and a Google account are two separate Pagetime accounts, even with the same email address: one syncs your library between iPhones, the other between Android phones.

The session token itself is not on the server, only its hash. A leaked database does not let anyone sign in as you.

Sync

Sync starts once you are signed in and puts a copy of your library on the server, so that it survives a lost phone and reaches a second device. It is free and needs no subscription.

What travels: books (title, author, genre, cover, page count, shelf, rating, tags, dates), reading sessions (start, end, length, pages, the note you left on the session) and notes (kind, text, page, chapter, tags, favorite, text recognized from a photo). Deletion marks travel too — otherwise a deleted book would come back from the other device. A deletion mark keeps no text: once you delete a book, session or note, the server keeps only its ID and dates, not the title, author, note text or anything else you wrote.

The phone also sends your daily goal, the days you changed it on and whether the streak freeze is on. Without them a second device — or the app reinstalled — would judge every past day by today’s goal, and a calendar you had already earned would change behind you.

It also sends its time zone, the first day of its week and the selected reading-reminder hour. The server uses the time zone to reset the daily AI limit at local midnight and the monthly one on the first of the month, and the time zone and first day of the week for reading-day and streak calculations. The reminder itself is still scheduled on the phone, and its exact minute stays there.

Photographed pages do not travel. If a note was made from a photo, only the text reaches the server.

AI in earlier versions

AI is disabled for everyone, including subscribers. The following describes earlier versions: a conversation about a book, a book summary, a month in review and a thought about a quote did not run on the phone: the request goes to our server and from there to an outside model. This is the only place where someone other than us sees your words.

What goes into the model: your message, the book’s details (title, author, genre, shelf, page count, current page, how long you have been reading it) and your notes on that book — up to forty quotes and up to forty thoughts. For a month in review and a conversation about it: the month’s statistics, the titles you finished and that month’s notes. For a general question that is not about one book: your books — title, author, shelf and current page. Individual reading sessions, your email address, your name and your IP address never go.

We route the requests through OpenRouter with training refused: the router only picks providers that do not keep requests and do not train on them. The conversations themselves are stored by us — otherwise you could not open one tomorrow — and are wiped along with the account.

Earlier AI-enabled versions asked your permission before the first request and showed what would be sent and where. Without permission nothing reached a model. Current versions do not offer AI requests or show an AI permission control.

The answer is written by a model, not by a person. We do not read your conversations to improve them and we build no recommendations on them. The one exception is a conversation you send us yourself with a complaint about an answer: that one we read.

Telling us an answer went wrong

Under every AI answer there is a way to say it went wrong: it gave away what happens later in the book, it made something up, it answered about the wrong thing. A complaint is a reason you pick from a list and anything you care to write. The same form, with no conversation attached, is in Settings for everything else you want to tell us.

Sent either way: the app version and build, the phone model and the language of the app. If the complaint is about an answer, also which model wrote it, the book and the page you were on at the time, and whether that conversation had spoilers switched off. That is what says whether the answer was wrong at all.

The conversation itself and what the model saw with it — the book and your notes on it, or the month, or your books — go only if you tick the box that says so, and the complaint sends without them. A complaint about a wrong answer is usually impossible to check without them. What is attached is what the app sees at the moment you complain, not a recording of the moment the answer came.

A copy attached this way stays with us even if you later delete that conversation, because otherwise the complaint would point at nothing. All of it goes when you delete your account, complaints included.

The form in Settings works before you sign in: the first week in the app is meant to work without an account. A letter sent that way has no account to hang on. We cannot find it again on request and you cannot withdraw it — there is nothing in it to go by. It is deleted ninety days after it arrives, answered or not. Sign in first if you want to be able to take it back.

We read every one and answer some of them. If you want an answer, write to hello@pagetime.net.

Purchases

Apple takes the money in the iPhone app, Google Play in the Android app. We never see the card, the address or anything else about the payment.

What reaches us from Apple is a signed purchase, and from it we keep: the purchase identifier, the plan (monthly or yearly), the expiry date, whether the current period is Apple’s free trial, and a record of the event — bought, renewed, refunded. The same record is how we notice a purchase being claimed a second time from another account. When Apple refunds or revokes a purchase, we also keep a fingerprint of that transaction — not its number, and nothing that points to you or your account — so that the refunded purchase cannot switch the subscription back on, not even after the account is deleted.

In the Android app, the phone sends our server the purchase token that Google Play issued. The server sends that token to Google to check and confirm the purchase, and Google then tells the server about renewals, cancellations and refunds. From this we keep: the purchase token, the order number, the plan, the expiry date, whether the current period is the free first month, whether it was a tester’s purchase, and the type of each notice from Google Play.

Payments in the Android app go through Google’s Play Billing library, which runs inside the app. The library talks to Google Play directly and may send Google diagnostic logs of its own, even if you never buy anything. Those logs go from the phone straight to Google, not through our server, and we do not receive them.

A subscription bought in either store works in both apps on the same account. It is managed and refunded in the store where it was bought.

Tips never reach our server: Apple and Google Play handle them like any other purchase, and the app does not tell us about them.

Counting the subscription screen

The app tells the server when the subscription screen is shown, when a purchase is started on it and how that purchase ends: bought, free trial started, cancelled, waiting for a parent’s approval or failed. Each count says where the screen appeared — after your first reading session, say, or opened from Settings — which plan it was about and the app version. That is how we see whether the screen comes up at sensible moments and whether buying works.

Nothing in these counts identifies you or your device: the app sends them without your account details, even when you are signed in. The server adds each one to a total for its day and keeps only those daily totals, for a year. Since nothing in them points to a person, nobody, us included, can pick out your counts, and deleting your account leaves the totals as they are.

The request that carries the counts is logged like any other, with its IP address, as described under Server logs below.

Historical AI usage and subscription counts

Earlier AI-enabled versions offered free answers after sign-in. AI is now disabled for everyone; signing in or subscribing does not enable it. Using historical records, we count on the server how many of the people who signed up in a given week started Apple’s free trial, how many went on to pay for a subscription, and what happened after their last free answer: whether they paid within a week, within a month, or not at all.

Nothing new is collected for this, and nothing is read from your phone. The count is made from records the server already keeps for other reasons: the date of your first sign-in, the record of AI requests that the daily and monthly limits need, and the purchase record from Apple. It uses dates and totals only, never the text of your notes or conversations, and what comes out is a table of numbers by week, not a profile of anyone. The table is not stored: it is worked out again each time we open it.

From the same record of AI requests we also count how many people got AI answers in two or more different weeks: one number that tells a habit from a one-off try. It uses the dates of the requests only and is not stored either.

The grounds are our legitimate interest, described below. If you would rather not be counted, write to privacy@pagetime.net and we will leave your account out of both counts. Nothing else about the app changes.

Looking a book up

When you search for a book or paste a link from Apple Books, the search string goes from our server to Apple to retrieve book details. Apple does not see your IP address: the request comes from our machine, not from your phone.

What comes back — title, author, genre, cover, page count — is written into your library. The cover itself is later fetched by the phone straight from Apple’s servers.

The email form on the site

The form on pagetime.net collects an email address, the language of the page it was left on, and the tag from the link if you came through one: for “pagetime.net/de/?from=tt-de-03” that is “tt-de-03”. The tag is the same for everyone who opened that link — it says which video worked, not who you are. No name, no IP address, no browser fingerprint.

The promise under the form is one letter on the day the app ships, and it holds: there is no newsletter and the address goes to nobody else. Write to privacy@pagetime.net and it is struck off the list straight away.

Server logs

The web server records requests: the IP address, the time, the address requested, the app or browser version. That is what a broken thing is diagnosed with and what keeps bots and password guessers out. These logs are separate from the optional site analytics.

Logs live on the server for no longer than fourteen days and are then rotated away.

A separate operator log records when the admin signs in or out, failed sign-in attempts, every change made in the admin panel, and every time complaints, lists with email addresses or someone’s purchase history are opened, together with whether the request succeeded. When an entry concerns particular accounts, it keeps their account IDs, but never complaint text, email addresses or search terms. Deleting your account removes your ID from the log. The log is deleted after one year.

Crashes go nowhere: Pagetime has no crash reporter and sends no error reports.

Optional site analytics

Only after you choose Allow analytics on the site, we record the landing page sections that came into view, views of reading guides, clicks from a guide to the product page or email form, when the email form was started and submitted, whether it succeeded, and clicks to the App Store. Guide events include a fixed article key and its language, not the full page URL or its query parameters. We also record the page language, short campaign labels from the link (from and UTM fields) if present, and the referring site’s domain if your browser supplies it. We do not record the email typed into the form, full referring URLs, IP addresses or device details in these events.

A random ID connects steps during one visit in one browser tab so we can see where a visit stopped. A new visit starts after 30 minutes without events or after 24 hours. It is not linked to your app account or the launch email list. Individual events are deleted within 30 days. We keep daily counts for up to 365 days to compare periods. These include counts by guide and language. When the individual events expire, all source and campaign labels are also removed from those daily counts; older totals contain no visit IDs or link labels. The dashboard therefore describes only visitors who agreed. We do not follow a visitor from this site into an installed app.

Choose Site analytics settings in the footer to withdraw or give consent. Withdrawal stops new events and removes the ID from this tab. Existing events expire within 30 days; because the ID is not linked to a name or email, we cannot find one person’s earlier events.

What we do not collect

• No analytics tools in the app. The only record of what you tap or look at is the anonymous daily count from the subscription screen; apart from it, the server counts only the weekly totals described above and the daily number of update checks per app version. No third-party analytics scripts on the site.
• No ads and no advertising identifiers. The app never asks for tracking permission because it does not track.
• We do not ask for location, contacts, calendar, microphone or health data, and we do not use them.
• We do not buy data about you and we do not sell yours.

Who else gets data

This list is complete. Each of them gets exactly what their job needs. Hetzner and OpenRouter process data on our behalf under data processing agreements; Apple, Google and Cloudflare act under their own terms.

• Apple — Sign in with Apple, App Store purchases and book details from Apple Books. Apple handles that data as its own controller, under its own policy.
• Google, USA — Sign in with Google in the Android app, and purchases there through Google Play: our server sends Google the purchase token to check and confirm a purchase, and Google tells the server about renewals and refunds. Google’s Play Billing library in the app may also send Google its own diagnostic logs straight from the phone. Google handles that data as its own controller, under its own policy.
• Hetzner Online GmbH, Germany — the machine that runs the server, the database and the backups. The data sits in Nuremberg.
• Cloudflare — DNS and delivery for the pagetime.net site. The site goes through it; the app does not: api.pagetime.net points straight at our machine. When a page fails to load, your browser may send Cloudflare a short error report: the page address with any campaign tag in it, the page you came from, the type of error and how long the attempt took. Cloudflare adds the network, country and city the report came from and uses it to find where its network fails; by its own account, it does not keep the IP address.
• Earlier AI-enabled versions: OpenRouter, USA — routing requests to a model, and the model provider it picked. Only the information listed under “AI in earlier versions”, with training refused. Current versions do not send requests to a model.

The legal grounds

• Our contract with you — the account, sync, the subscription and the AI answers you asked for. Without this the app cannot do the thing it was installed for.
• Your consent — the letter about the launch, optional site analytics, if you allow it, and anything you send us yourself: a complaint about an AI answer and whatever you chose to attach to it. You can change the analytics choice in the site footer at any time. For a letter or complaint, withdraw consent by email. A letter sent without signing in carries nothing to find it by, and it goes by itself after ninety days.
• Our legitimate interest — keeping the server safe, daily and monthly limits, backups, diagnosing failures, the tag of the link that brought someone to the site, counting in weekly totals whether the free AI answers lead to subscriptions, counting how many people come back to the AI in a later week, the anonymous daily counts from the subscription screen, and the anonymous daily counts of update checks per app version. We weighed that against your privacy and keep it inside the limits described above.

How long it is kept

• Account data and the copied device settings — for as long as the account exists. Delete the account and the server wipes it all at once: books, sessions, notes, conversations, complaints you sent and anything attached to them, usage records, subscription and purchase history, your daily goal with the days you changed it on, the streak freeze, time zone, first day of the week and reminder hour. Besides a fifteen-day record of the deletion itself (see below), two things stay, and neither is linked to you or to an account. A fingerprint of the Apple identifier — not the identifier itself, and no name or address — with the date that Apple ID first signed in, how many free AI answers were used and whether the free month in review was given. It is there so that deleting the account and signing in again does not hand out the free answers again: signing in with that Apple ID picks up where the old account left off. And, if Apple refunded a purchase, a fingerprint of that transaction with the refund date: it keeps the refunded purchase from opening the subscription again, and is deleted once that purchase could no longer be in force anyway — within thirteen months of the refund.
• A letter sent without signing in — ninety days from the day it arrives. There is no account to wipe it with, so it goes by itself.
• Database backups — fourteen days. Deleted data is gone from them within that time.
• A record of steps that must not be undone — an account deleted, a sign-out, a block or its lifting, a refund — fifteen days. It holds the step, its time and the account ID; for a sign-out, a fingerprint of the session token instead, and for a refund, also a fingerprint of the purchase. No address, no name, no text. If a backup ever has to be restored, the server repeats these steps on it: a deleted account is deleted again instead of coming back, a closed session stays closed, a block and a refund stay in place. The record of a deletion outlives the account by those fifteen days, as long as the backups keep the account itself.
• Server logs — fourteen days.
• Counts from the subscription screen — a year, as daily totals with nothing that identifies a person or a device.
• Counts of update checks per app version — a year, as daily totals with nothing that identifies a person or a device.
• A sign-in session — ninety days without use, and never more than a year from the sign-in, even if you open the app daily.
• The address from the site form — until the launch letter, or until you say the word.
• On the phone, everything stays until you delete a note or remove Pagetime from the phone. On an iPhone that also has the earlier Pagetime app, the two apps share their storage, and it goes only when both are removed. Deleting the account clears the server, not the phone — and the button says so.

Your rights

You can ask for a copy of your data, for a correction, for deletion, for processing to be restricted, you can object to it, and you can take your data with you in a portable form. Consent can be withdrawn at any time, and withdrawing it does not undo what was done before.

Two of these need no letter. To delete your account: Settings, the Account section, Delete Account; the server is wiped immediately, apart from the marks described above. This works for a blocked account too. Without the app, follow pagetime.net/delete-account/. To take your notes: Settings, Export Notes — the app builds a file with every thought, quote and idea, arranged by book.

For anything else write to privacy@pagetime.net. We answer within a month, usually sooner. If the answer does not satisfy you, you may complain to the data protection authority where you live.

Children

Pagetime is meant for people aged sixteen and over. We do not knowingly collect children’s data; if it turns out an account belongs to someone younger, we will delete it on the first letter.

Where the data goes

The server and the database stand in Germany, that is, inside the European Union. Everything that leaves the phone lands there.

Three things leave the EU. AI requests from earlier versions went to OpenRouter in the USA, which handles them for us under a data processing agreement that includes the European Commission’s standard contractual clauses. Signing in on iPhone, App Store purchases and book look-ups go to Apple, and signing in, Google Play purchases and the Play Billing library’s own logs in the Android app go to Google; each handles them as its own controller, under its own terms and policy.

How it is protected

Connections are HTTPS only. The sign-in token lives in the phone’s Keychain and the server holds only its hash. Someone else’s record answers “not found” rather than “not allowed”: otherwise guessing identifiers would tell a stranger about your library. Ports are closed by a firewall, the database and the app listen to the machine itself only, and the service runs with cut-down privileges.

One thing is worth saying plainly: notes on the server are not encrypted with a key only you hold. With such a key the AI could not read your notes, and the very reason the server exists would be gone. The developer has access to the database, and nobody else does.

Cookies and browser storage

The site sets a language cookie, pagetime_lang, only when you switch language by hand. It lives for a year so your choice survives a return visit. This cookie is necessary for the language choice you requested.

The site remembers whether you allow or decline analytics in your browser’s localStorage, under pagetime_site_analytics. This preference has no automatic expiry: it stays until you change it or clear the site’s browser data. It is used to remember your decision, including a refusal.

Only if you allow analytics, the site uses sessionStorage for a random visit ID, an event counter and visit timestamps in this tab. Their names start with pagetime_site_. These entries last for the tab’s session. A new visit ID is created after 30 minutes without events or after 24 hours. The ID is not linked to your email or app account.

Choose Site analytics settings in the footer to change your decision. Choosing Without analytics stops new events and removes the analytics entries from this tab’s sessionStorage. Your refusal remains saved so the site does not ask on every page. Clearing the site’s browser data also removes the saved choice. The retention periods for events and daily totals are described under Optional site analytics above.

Cloudflare may add a technical cookie of its own that tells a person from a bot. The app sets no cookies at all.

If this policy changes

The date at the top is the date of the last edit. Substantial changes will be announced in the app before they take effect, not after.