Privacy Policy — Umebook
Last updated: 11 October 2026
This policy describes what Umebook collects, where it goes and what you can remove. It is written to be read, not to be survived.
Questions, requests and complaints: [email protected]. The short version
Umebook records what you read, how long for, and what you say about it. Your reading and your journal are private to you unless you turn on a sharing setting or add a friend. Two of the things you create — the audio you record and the transcript made from it — are sent to a third party to be processed; that provider is contractually barred from training on them and does not keep them. Your voice is never stored: when you speak an entry or a reply, only its words are kept. There is no advertising, no analytics SDK, no tracking across other apps or sites, and nothing here is sold.
What is collected, and why
Signing in with a magic link stores your email address. Signing in with Apple stores whatever Apple sends — which, if you chose to hide your address, is Apple's private relay address rather than your real one. Signing up with an email and password stores your email address and a bcrypt hash of your password — never the password itself. You can set or change it in Settings, and reset it by email if you forget it. This is used to sign you in and for nothing else. There is no marketing list.
A username (which other readers can search for, and which is how friends find you), and optionally a display name, an avatar and a short bio. Your timezone, so a 19:00 reminder means 19:00 where you are. Your daily goal, your reminder time, your XP, level, streak, and your baseline reading speed and comprehension score from the speed test.
Books you add — title, author, cover and page count, looked up from public book catalogues. A book found in a catalogue joins our shared catalogue, which Discover may suggest to other readers, never saying who added it. A book you type in yourself is your own record, which no other reader can read, except that, as with any book, your friends see its title and cover while it is the book you are currently reading and Who can see your library is set to Friends or Everyone. It never appears on a public page. It is kept only while it is on your shelves, and deleted when you remove it or delete your account. Your reading sessions: when each started and stopped, how long it ran, and the page or percentage you reached. Your speed test results. The books you recommend, with the list you put each one on and anything you write about why.
The practice drills you play: each round, its score and level, and the blossoms it grows. Any peg words you write on the Your pegs screen, in place of the default ones.
When you record a journal entry, the app stores the transcript made from it, the questions generated about what you said, the answers you type, and the score. The audio recording is never stored: it is sent once to be turned into words and kept nowhere, not in our storage and not in the database. Until its words are saved, the recording stays on your device only, so that if turning it into words fails you can try again or type it instead; it is deleted from your device as soon as the words are saved, or when you discard the entry or leave the screen. If you say which chapters an entry covers, those are stored with it, and so is any name you give a chapter.
The Library's Discover tab suggests books to read next. To do it, the app keeps, for your account:
•
The authors you follow. You can follow an author by hand, and an author is followed for you when you rate one of their books four stars or more. If you unfollow an author, that sticks: rating another of their books does not follow them again.
•
The books you mark Not for me.
•
When you last opened Discover, so it can tell you what is new since.
Your picks are worked out in our database each time you open the tab, for your own feed only, from the books on your shelves, your ratings, the genre tags you give your books, the authors you follow and your Not for me choices. No profile of your taste is stored, and none of this is shown to your friends.
To compare books, each book gets a fingerprint, made from its title, authors, categories and description by a small text model that runs with the rest of the service on Supabase. Only the book's own details go into it, and they are not sent to anyone else to do it.
Who you are friends with, pending requests in both directions, and invite codes you create or redeem. Invite codes expire after seven days. The books you send to friends, with any note you write, and which of the books sent to you you have dismissed.
The clubs you start or join: each club's name, its book, its join link, its plan (the sections and their dates), who is in it, how far each member has marked they have read, and the replies members post in each section's conversation, with whether a reply was spoken. A spoken reply is kept as its words only: the recording is not stored, by us or by anyone. We also keep the times you posted replies, to stop floods of them; times older than a day are cleared whenever you post again, and all of them go with your account.
If you report a reader's public page, we keep the report, the reason you chose and any message, and, if you were signed in, your account, so a person can review it.
If you ask to take over or remove a great mind's page, we keep your request: your name, whether you are the person or on their team, the address you gave, how you want to be checked, what you asked for, any message, and, if you were signed in, your account. A person uses these to check who you are, by email or on social media, and keeps what they decided and why. If the page becomes yours, we keep a copy of how it was before, so it can be put back, and the times you changed it, to stop floods of changes; times older than a day are cleared whenever you change it again.
If you turn notifications on, a device push token, plus a record of which reminders have already been sent to you — kept only so you are not sent the same nudge twice in a day.
No location. No contacts. No advertising identifiers. No analytics or attribution SDK. No behavioural profile. Nothing is sold or shared for advertising, ever.
Who else sees it
Umebook uses a small number of services to work at all. Each one gets only what that job needs.
Everything above is stored with Supabase, which hosts the database, runs the server functions that pass your recordings on to be transcribed, and runs the sign-in system. Supabase processes it on our instructions. supabase.com/privacy When you record a journal entry, the audio is sent to Groq to be turned into text, and only the text is kept: the recording is not saved anywhere, and the copy on your device is deleted once its words are saved. The transcript is then sent back to Groq, together with the book's title, author and publisher blurb, the page range the session covered, the chapters you said the entry covers and the names you gave them, and up to three of your earlier entries about that same book, so it can write the questions and grade your answers.
When you record a reply in a book club, the audio is sent to Groq to be turned into text, and the text is posted as your reply. The recording is not saved anywhere: not in our storage, not in the database, and the copy on your device is deleted once it has been sent.
Groq's services agreement states that Groq is not permitted to use inputs or outputs to train or fine-tune any model without explicit permission, and that it does not retain data from inference requests by default, beyond a short window for abuse monitoring. groq.com/privacy-policy Your journal entries are not used to train anyone's model.
When you search for a book, the words you type are sent to Google Books and, if that finds nothing, to Open Library. Nothing identifying you goes with the search — no account, no username, no device identifier.
Each night the service also asks both catalogues for new books by the authors readers follow and for books in each genre, and asks Open Library for the descriptions of catalogue books, to find recommendations. Those requests carry an author's name, a genre's subject or a book's Open Library id and nothing else: never who follows the author, rated the genre or holds the book, and nothing that identifies any reader. policies.google.com/privacy · openlibrary.org/privacy If notifications are on, the notification's text and your device's push token are sent through Expo's push service to Apple or Google for delivery. A notification can name a friend's username ("someone just passed you"), your streak length or your daily goal. It never contains what you read or wrote. expo.dev/privacy If you sign in with Apple, Apple handles that sign-in under its own policy. www.apple.com/legal/privacy/ What other readers see
•
Your username, avatar, level and weekly XP are visible to your friends on the leaderboard.
•
The book you are currently reading is visible to friends while Who can see your library is set to Friends or Everyone. Choosing Only me keeps you on the leaderboard and hides the book.
•
The friends feed. While Who can see your library is set to Friends or Everyone, your friends' feeds show when you start a book, when you finish one, and the books you recommend with what you wrote about why. Books you typed in yourself, books you mark as already read, your journal, your notes, your ratings and your tags never appear in it. Choose Only me and you leave your friends' feeds. Removing a friend takes you out of their feed and them out of yours.
•
A book you send to a friend goes to that friend only, with your note, whatever Who can see your library is set to. They can put it on their shelves or dismiss it. You can see what you sent, but not whether they dismissed it.
•
If you choose Everyone, anyone can see your public page: your username, display name, avatar, bio, the books you recommend and what you wrote about them, the books you are reading and the books you have finished. Anyone can also open those books' pages, and your recommendation shows there with your name. If you allow it in Settings, we may list your public page on the Great minds page. Books you typed in yourself, your journal and your notes stay off it. Choose Friends or Only me and the page and those mentions disappear.
•
You can hide any single book from friends and your public page.
•
Your journal entries are private by default. They are shared with friends only if you turn Share new journal entries with friends on, and that setting applies to entries you record afterwards. An entry shared with friends shows them which chapters it covers; the names you give chapters are shown to no one but you.
•
A pending friend request shows the person you sent it to your username. Until they accept, you see nothing of theirs and they see nothing of yours beyond that name.
•
In a book club, everyone in the club sees your username, display name and avatar, how far you have marked you have read, and your replies, whether or not they are your friends. A section's conversation opens to each member only once they mark that section finished, so nobody reads replies about a part they have not reached. The person who runs the club can remove you and delete your replies. Anyone with the club's join link can join until the person running it closes or replaces the link. Leaving a club, or being removed, deletes your replies and progress in it.
•
A great mind's page you own is public. Everything you put on it (the line under your name, your books and lists, and what you write about each book) is shown to anyone, marked as in your own words and written on Umebook. You can hide the whole page. If you give it back you choose whether your words stay or go; if we take it back, they go.
•
Your voice is never shared with anyone, in any setting: it is not kept to share. Only the words of a spoken entry or reply are stored.
How long it is kept
Your data is kept while your account exists. Reading sessions and journal entries are not expired on a schedule — the point of a reading journal is that last year's entries are still there. Audio is not kept at all.
Deleting your account deletes it. Settings → Delete account, with your username typed to confirm. That removes your profile, your books and reading sessions (and the books you typed in yourself), your recommendations and your public page, your follows and Not for me choices, your speed tests, your journal entries, the names you gave chapters, your friendships and requests, the books you sent and were sent, the book clubs you run (a club you run passes to its longest-standing member, and closes if you were its only one), your club memberships, progress and replies, your notification records, anything you wrote on a great mind's page you own (the page goes back to how it was before you claimed it), and the sign-in account itself. It cannot be undone, and there is no retention period — the deletion runs immediately.
Invite codes you created are kept as expired records with your name removed from them, so that a friend who redeemed one does not lose their own history. A report you made about a reader's page, and a request you sent to claim a great mind's page, are kept for the person reviewing them, without your account attached.
Your rights
You can see and change most of what is stored from inside the app: your username, goal, reminder time, both visibility settings and your notification choice are all in Settings, and every book, session and journal entry is visible in the app.
Depending on where you live you may also have the right to ask for a copy of your data, to have it corrected, or to have it deleted. Deletion is built in and immediate. For anything else, write to [email protected] and you will get an answer within 30 days. Children
Umebook is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created an account, write to [email protected] and it will be deleted. Security
Sign-in is by password, by magic link, or by Apple. A password is never stored as you typed it: Supabase keeps only a bcrypt hash, which cannot be turned back into your password, and nobody operating this service can read it. Every row in the database is protected by row-level security, so one reader's account cannot read another's. No audio is stored, so there is none to protect: a recording is held in memory only while it is turned into words. The keys for the transcription and grading services are held on the server and never reach the app, which is why that work happens server-side rather than on your phone.
No system is perfect. If you find a security problem, please write to [email protected] before disclosing it publicly. Changes
If this policy changes in a way that affects what is collected or who receives it, the date at the top changes and you will be told in the app before the change takes effect.
Contact