Privacy — Leafin

Who is responsible

Leafin is made by Majd Khris, an independent developer. For anything about your privacy, write to support@leafin.app.

Majd Khris is also the person in charge of protecting personal information at Leafin, as Quebec’s privacy law asks every business to name. Write to him at the same address.

What stays with you

Everything you put into Leafin — your books, ratings, notes, reviews, reading sessions, passages, shelves, goals and settings — is stored on your iPhone. We do not run a server that holds it, and we cannot see it.

If you use iCloud, Leafin keeps your library in your own private iCloud database, and a few settings in your own iCloud storage, so they reach your other devices. The library includes any cover you photographed or chose for a book. The settings are your goals, theme and timer choices, how your Library is shown, arranged and sorted, the language you want editions in, whether shared pictures carry the small Leafin line, the books you said “Not interested” to, and a note that you have a library, so a new iPhone of yours brings your books back instead of starting over. That data is held by Apple under Apple’s privacy policy; it is not visible to us. The genres you say you like are kept on that iPhone only: not in iCloud, and not sent anywhere.

Deleting the app deletes the library on that iPhone. Anything kept in iCloud can be removed in the Settings app, under your name, then iCloud.

You › Settings › Your data › Delete all data deletes your library, reading history, goals, reminders and settings on that iPhone, and in iCloud when iCloud is on there. It also clears what Leafin has kept on the phone to work faster, such as covers and looked-up book details, resets Google Analytics’ data on the phone, deletes any crash report not yet sent and forgets your answer about usage statistics. Your Plus subscription stays with your Apple Account. If iCloud is off on that iPhone, your other devices keep their copy; Leafin says so before deleting.

What is sent to look books up

To find a book’s details and cover, Leafin asks one public book catalogue, Open Library, and no other, through a small cache of our own. These requests carry what is needed to answer them and nothing that identifies you:

Open Library, run by the Internet Archive, is the one catalogue Leafin asks. It receives what you type into search, and each line of a list you paste or photograph; the ISBN of each barcode you scan; the language you chose for books, so results come in it; and, to suggest more by authors you love, the names of authors whose books you rated highly. To find a cover or a genre that a book in your library is missing, including after an import, Leafin also looks that book up now and then in the background, by its ISBN or by its title and author. Each request names the app and its version, and gives our contact address, as Open Library asks every app to. Covers are downloaded from Open Library too. See the Internet Archive’s terms and privacy policy.
Leafin’s book cache, run by us on Cloudflare at books.leafin.app, stands in front of Open Library. A search, a scanned ISBN or a cover is asked there first, and it asks Open Library only when it does not already have the answer, naming Leafin and passing on only the question itself — the words searched, the ISBN or the cover’s number — never your network address or anything else about you. Searches pass straight through and are not kept. Book records are kept on Cloudflare for up to 90 days (the 1,000 most-read books' for up to two years) and covers for up to a year, with nothing about who asked. Leafin keeps no logs of these requests and reads none. To protect the cache, Cloudflare limits how often one network address can search, and its security systems may keep a record of a request they block, with the address it came from and what it asked, for a short time. Like any server, Cloudflare sees the network address a request comes from in order to answer it. If the cache does not answer, Leafin asks Open Library directly, as above.

Like any website you visit, Open Library sees the network address your request comes from. Leafin sends no name, email, account, advertising identifier or device identifier with any of these requests.

Collections and corrections

About once a day Leafin checks leafin.app for three files and downloads any that have changed: the list of curated collections shown in Discover; Leafin’s corrections to the details Open Library gives for about 10,000 books, such as a missing cover, a misspelt title or a page count, under 1 MB to download; and the books most read in each genre, for “Popular in…” in Discover. Each is a plain file request that names the app and its version: nothing about you or your library is sent with them. The genre file holds every genre, so downloading it says nothing about which ones you like.

Usage statistics and crash reports, if you say yes

When you set Leafin up, it asks whether to share usage statistics. Nothing is collected or sent unless you say yes, and you can change your answer at any time in You › Settings › Privacy › Share usage statistics. On a new iPhone that brings your library from iCloud, Leafin does not ask again; the answer is kept on each iPhone separately, and sharing stays off there until you turn it on.

Leafin does not ask at all, and sends nothing, when your iPhone tells it you are under 18 (see “Children”). In some countries Leafin doesn’t ask, and nothing is collected there.

If you say yes, Leafin uses Google Analytics for Firebase, a service run by Google, to count how the app is used, so we can see what works and what does not. The statistics, and any crash reports, are sent to Google (Firebase) in the United States. Leafin itself sends these events:

the app being opened, once a day at most;
finishing the introduction, whether a reading goal was set, and which way you went on;
each screen of the introduction being reached, skipped or completed, and which way you chose to add your first books (search, a barcode scan or an import). The screens before the question about usage statistics are counted only once you say yes; with a no, nothing about them is sent;
adding a book and how — search, barcode, cover, shelf scan, by hand, import, collection or suggestion — and whether it was your first;
an import finishing, with the number of books as a range, such as 51–200;
a reading session ending, timed or logged, with its length as a range, such as 10–30 minutes, and whether it was your first;
the Leafin Plus screen being shown and what opened it, and a free trial starting, with what opened the screen it started from;
using a feature: scanning a shelf or a cover, saving a passage, sharing a card (a recap, a shelf picture, a review, a finished book or a passage), opening a collection, or Pick for me;
Open Library, or Leafin’s book cache, refusing or not answering — which of a few kinds (too busy, unavailable, refused, too slow, unreachable, an error, or the cache switched off) and, for Open Library, whether you were waiting for it — at most once a day for each kind, never what was asked;
a book being added by hand, or from its scanned cover, after a search that did not find it — never what was searched for.

They never include your books, titles, authors, ISBNs, searches, notes, reviews, passages or anything else you type, and never an exact number of books or minutes.

Google Analytics also collects some things by itself while it is on:

a random app instance ID, and an installation ID Firebase uses to talk to Google, neither of which is your Apple Account, your device’s advertising identifier or its vendor identifier (Leafin collects neither);
when the app is first opened, sessions and how long the app is in use, and when the app or iOS is updated;
that the device is an iPhone, its iOS version, the app’s version, your language, and your country and region, worked out from your network address. Google Analytics is set not to keep anything finer — not your iPhone’s model or name, the exact iOS version, your screen size or your city. Leafin does not use Location Services.

We have set Google Analytics up so that none of this is used for advertising: Leafin includes no advertising identifier and tells Google that the data may not be used for ads or ad personalisation; in Google Analytics, ads personalisation is turned off in every region, Google signals and data sharing with Google are turned off, and there are no links to Google Ads. Google Analytics keeps the events for 14 months, and after that only totals, such as how many people opened the app in a month. None of it is linked to you or combined with data from other apps or websites. Google handles it under Google’s privacy policy and the Firebase privacy information, and may process it outside your country, including in the United States. Google protects data it processes for us outside your country under its Google Analytics data processing terms, which bind it to protect these statistics at least as well as this policy does.

If you turn usage statistics off, Leafin stops collection at once, deletes any crash report not yet sent and clears what Google Analytics holds on your iPhone, including the app instance ID; turning them on again starts a new one.

Scanning happens on your iPhone

When you scan a barcode, a cover, a shelf, a page or a list of books, the reading is done on your iPhone by Apple’s on-device frameworks. The photos and camera frames are never sent to us or to anyone else, and are not used to train anything. The one picture Leafin keeps is a cover you choose to use: it becomes that book’s cover in your library, on your iPhone and in your own iCloud, and the photo it was cut from stays on your iPhone, so you can adjust the crop later. That photo is never synced or sent anywhere, though it is part of your iPhone’s own backup if you back the iPhone up to iCloud or to a computer.

Barcodes, covers, passages and lists are read with Apple’s Vision and Live Text, on the device. The words of a passage you save stay in your library, on your iPhone and in your own iCloud.
A shelf scan reads the spines with Vision, then uses Apple Intelligence’s on-device model to work out which words belong to which book. That model runs on your iPhone; nothing is sent to Apple or to us.
To find a book’s details, what was read — a barcode’s number, or the titles and authors found on a cover, a shelf or a list — is then looked up in Open Library, as described above, exactly as if you had typed it into search. The photo itself never leaves your iPhone.

Photos, notifications and widgets

When you choose a photo — of a cover, a shelf, a page or a list — Apple’s photo picker gives Leafin only that photo; Leafin cannot see the rest of your library. Leafin adds to your photo library only when you save a picture you made in it.
Reminders are scheduled on your iPhone, and only if you turn them on: the daily reminder, a note when a book is nearly finished, your reading week, and passages coming back to you. They can show a book’s title or a passage’s words on your Lock Screen; you can hide previews in the Settings app, under Notifications. No notification is sent from a server of ours.
Five days before a free trial ends, Leafin shows a note on Home, and if you allow notifications, sends it as one too: right after you start a trial, it asks once whether it may, unless you have already answered. On the yearly plan, about thirty days before each renewal, it sends a reminder only if you have already allowed notifications; it never asks for that one. Both are scheduled on your iPhone.
Widgets and the Live Activity show your current book, your progress and, if you choose, a passage on your Home Screen and Lock Screen. They read from a copy kept on your iPhone.

Purchases

Leafin Plus is bought through the App Store. Apple handles payment. Leafin learns from the App Store, on your iPhone, which plan you have, when it renews or ends, whether a renewal payment has failed, and whether you can still have the free trial — never your payment details. If you share usage statistics, the start of a free trial is counted with them; nothing else about purchases is.

What “no ad tracking” means

Leafin shows no ads.
It does not use your iPhone’s advertising identifier, and it does not follow you across other companies’ apps and websites.
It does not share or sell data about you to advertisers or data brokers.
Nothing it collects is linked to your name, your email address or your Apple Account.
Your library lives only on your iPhone and in your own iCloud. We never hold it, so it can never be sold — including if Leafin changes hands.

The only data about how you use the app that reaches us is usage statistics and, if Leafin crashes, crash reports, and only if you say yes: they help us see what works and improve Leafin. They are not linked to you — they carry a random ID for the app on your iPhone, not who you are (see “Usage statistics and crash reports, if you say yes”).

Leafin’s only third-party code is Google’s Firebase, which stays off unless you say yes. With your yes it sends the usage statistics above and, if Leafin crashes, a crash report: where in the app it stopped, on which iPhone and iOS version, with a random ID for the app on your iPhone. A crash report holds nothing from your library — no titles, notes or searches — and is not linked to you. Crash reports are kept by Firebase Crashlytics for 90 days, then deleted. Saying no, or turning statistics off in Settings, stops both and deletes any crash report not yet sent. If you have chosen to share analytics with app developers in your iPhone’s Settings (Privacy & Security › Analytics & Improvements), Apple passes us crash and performance reports for Leafin — where in the app it crashed or froze, on which iPhone and iOS version. Apple collects these, not Leafin, and does not tell us who you are; you can turn the setting off there at any time.

If Leafin changes hands

We never sell data about you. If Leafin is sold, or merged with another company, the little we hold — the usage statistics and crash reports above, if you share them, and any emails you have sent us — passes to the new owner with the app, and the new owner must honour this policy. Your library is not part of it: it is on your iPhone and in your own iCloud, where no owner of Leafin can reach it. You will be told first, here and in the app, so you can export your library, turn usage statistics off or delete your data before anything passes.

Why we may use it

Usage statistics and crash reports: only with your consent, which you can withdraw at any time in You › Settings › Privacy. Saying no changes nothing else in the app, and Plus never depends on it.
Book lookups through our cache: to answer the lookup you asked for.
Emails you send us: to answer you, which is our legitimate interest in helping you. We keep emails up to 2 years after our last message, then delete them.

No law requires you to give us any information.

Your rights

You can ask what data about you exists, have it deleted, withdraw your consent to usage statistics at any time, and complain to your data protection authority. Because we hold almost nothing ourselves, most of this is done in the app:

What exists: everything Leafin keeps is in your library, on your iPhone and in your own iCloud, and You › Settings › Your data › Export your library writes your books, their reading sessions and your passages to a file you can read.
Deleting it: You › Settings › Your data › Delete all data.
Withdrawing consent: You › Settings › Privacy › Share usage statistics, which stops collection at once, deletes any crash report not yet sent and clears what Google Analytics holds on your iPhone.

You can also ask us to correct anything we hold about you, to stop using it, or for a copy in a common file format. For anything else — including usage statistics already sent to Google Analytics — write to support@leafin.app and we will help. You can also complain to the data protection authority where you live.

Complaints

If you are unhappy with how Leafin handles information about you, write to support@leafin.app. We will acknowledge your complaint within 30 days, look into it, and tell you what we found and what we will do about it. You can also complain to the data protection regulator where you live — in the UK, the Information Commissioner’s Office (ICO); in Israel, the Privacy Protection Authority.

This website

leafin.app sets no cookies and runs no analytics or tracking. It loads nothing from anyone else — the fonts and pictures are served from the site itself — so reading it tells no one else you were here. Like any website, it is served by a host, Cloudflare, which sees the network address a request comes from in order to answer it.

Do Not Track

Leafin and this website do not follow you across other companies’ apps or websites, so they do not respond to a browser’s Do Not Track signal differently: they work the same way with it or without it.

Leaving with your data

You › Settings › Your data › Export your library writes every book to a CSV file you can keep or take elsewhere — its details, status, rating, dates, shelves, review, notes, passages, moods and pace, and every reading session. Covers, goals and settings are not in it. You › Settings › Your data › Import from Goodreads or another app reads the file back in, so you can bring your library back to Leafin.

That import also reads a library exported from Goodreads or another app. The file is read on your iPhone and is not uploaded anywhere. To find covers and details the file lacks, its books are then looked up in Open Library, as described above, as any book in your library is — by its ISBN, or by its title and author.

Goodreads is a trademark of Goodreads, LLC. Leafin is not affiliated with or endorsed by Goodreads.

Children

Leafin is not directed at children. It asks no one for personal information, children included. Usage statistics are collected only if the person using the app says yes.

Readers under 18 are not asked to share usage statistics. Where Apple’s age features apply, Leafin asks the iPhone, once, for the reader’s age range (Apple’s Declared Age Range). If it is under 18, or not shared where Apple requires it, the question never appears, in the introduction or in Settings, and nothing is sent to Google. Only the answer — adult, under 18 or not shared — is kept, on that iPhone.

Changes and contact

If this policy changes, the new version will be posted here with a new date. Questions go to support@leafin.app; ideas and feedback to hello@leafin.app. If you write to us, we see your email address and what you wrote, use them only to answer you, and do not add you to any list.