Privacy Policy — TomeBox

Last updated: November 7, 2026

1. Data controller

TomeBox is a free reading app for classic works, published by De Majcher Jean, the controller of your data. Contact: contact.tomebox@gmail.com.

2. Data we process

• Account: email address, user ID, display name, bio and profile photo (optional), preferred language. Sign-in by email or with Google. Face ID unlocking stays on your device: TomeBox receives no biometric data and never your password.
• Reading: library, progress, reading sessions, highlights, notes, vocabulary, goals and statistics. This content is private: other readers cannot see it.
• Star ratings: your rating stays private; a book page only shows the anonymous average and the number of ratings.
• Reports and blocks you make.
• Usage statistics: usage events, device ID, device model and OS version, only with your consent (off by default, changeable at any time in Profile → Data and consent).
• Error reports (when signed in): error message and trace, screen, platform, app version.

No purchases, no subscriptions, no advertising, no cross-app tracking.

3. Data that stays on your device or goes directly to a third party

• Camera (barcode scan in the Tracking tab): the image is analysed on the device and never sent; the Tracking log is stored locally.
• Approximate location (Atlas "Around me"): it is not sent to our servers. It goes directly from your device to OpenStreetMap (map tiles) and the Overpass API (nearby places).
• Book search in the Tracking tab: the ISBN or title you search for is sent to Open Library and Google Books.
• Export to Readwise: only on request, the highlights you choose are sent to Readwise.

These services then receive your IP address and the data needed, under their own policies.

4. Purposes and legal bases (GDPR art. 6)

• Providing the service (account, syncing library and progress, notes): performance of a contract (terms of use).
• Usage statistics: consent, which you can withdraw at any time without affecting your use of the app.
• Error reports, security, reports: legitimate interest in running and protecting the app.

5. Hosting and recipients

Data is hosted by Supabase (database, authentication, storage) in the European Union region (Ireland). The public website is hosted by the publisher. Google sign-in: Google receives the data needed for authentication. No data is sold.

6. Retention

Account data, reading data and consented statistics are kept as long as the account exists. Deleting your account (Profile → Delete my account) erases your app data, your photos and your authentication account. Withdrawing consent also lets you erase usage statistics.

7. Your rights

You have the rights of access, rectification, erasure, portability, restriction and objection, and the right to withdraw consent. In the app: Profile → Export my data (portability), profile editing (rectification), Profile → Delete my account (erasure), Profile → Data and consent. Or by email at contact.tomebox@gmail.com. You may lodge a complaint with the CNIL (www.cnil.fr) or your local supervisory authority.

8. Age

The app is intended for people aged 15 and over.