Legal
Privacy policy
2026-08-01
This policy applies to readendar.com, the Readendar app for iOS and Android, public sharing pages and support or moderation contacts.
Controller and contact
The controller is Daniel Balastegui Julian, an individual operator established in Barcelona, Spain. Privacy requests may be sent to hello@readendar.com. No data protection officer has been appointed because Readendar’s present processing does not require one.
If a competent authority makes a valid request under applicable law, only the additional data strictly necessary to comply will be provided, after verifying the authority’s competence, the scope of the request and its legal basis.
What we process, why and for how long
| Purpose | Data | Legal basis | Recipients | Retention |
|---|---|---|---|---|
| Create and secure an account | Email, opaque account ID, authentication method, magic-link and refresh-token records, login security events | Performance of the contract; legitimate interest in preventing abuse | Hetzner infrastructure, Brevo for magic-link email, Google or Apple when that sign-in method is chosen | While the account is active. Short-lived login credentials expire automatically; security records are retained only as needed to investigate abuse |
| Provide the reading service | Profile name, language, timezone, avatar, library, progress, plans, events, quotes, reminders, clubs, memberships, polls, votes, custom fields, community ratings and reviews, and settings | Performance of the contract | Hetzner hosting, database and object storage | While the account is active; deleted from the live service when the account or relevant content is deleted |
| Display content you choose to share | Revocable share tokens, public club profile, public Social profile when published to Everyone, public poll content and aggregate results, according to the visibility selected | Performance of the contract and your deliberate publication choice | Cloudflare, Hetzner and visitors to the public URL | Until you revoke sharing, make the content private or delete it |
| Process uploads | Avatars, covers and poll images | Performance of the contract | Hetzner object storage | Until replaced or deleted. Unsaved poll media is staged for no more than 24 hours |
| Search and import books | Search terms, ISBNs and book metadata; data you choose to import from a file or an in-app browser | Performance of the contract | Hetzner-hosted Redis cache, ISBNdb and Open Library; the external Goodreads, StoryGraph, Bookmory, Babelio or Amazon page when you choose its web import | Raw search terms are cached without an account ID for up to 30 days and are not added to your profile. Imported books or quotes follow account retention |
| Send local reminders and provide capture tools | Event and quote data used for local notifications; images used for OCR; microphone audio used for dictation | Performance of the contract | Operating-system services on your device | Notifications and OCR are on-device. Dictation is unavailable unless the OS confirms genuine on-device recognition; audio and OCR images are not uploaded |
| Optional product analytics | Opaque account ID, app-instance/device identifiers, screen names and selected feature events; version, time and state of the consent choice | Consent; legal obligation/accountability for the consent evidence | Google Firebase Analytics; Hetzner stores the consent record | Events: no more than 2 months. The latest choice and its evidence remain until account deletion or as long as needed to establish compliance |
| Diagnose failures and performance | Crash information, stack traces, app/device version, technical context and a 5% sample of request performance traces. No session replay; request bodies, headers, cookies and query strings are not sent, and secret-bearing path segments are redacted | Legitimate interest in service reliability and performance | Sentry | No more than 90 days |
| Protect the service and keep access logs | IP address, timestamp, HTTP method, route, response status and duration | Legitimate interest in security, abuse prevention and availability | Cloudflare and Hetzner | Cloudflare necessarily processes the complete request URL at the edge. Workers Logs are disabled in deployment configuration and Readendar does not configure a Logpush destination. Origin logs redact secret tokens and queries and rotate within 30 days |
| Prevent deleted accounts being restored | Account ID and deletion-request timestamp in a private suppression marker outside the database | Legal obligation and legitimate interest in honouring erasure | Hetzner object storage | 35 days, covering the maximum backup lifetime plus a safety margin |
| If you joined an early-access list | Email, form language, source page and signup time | Consent | Slack as the internal work channel | Until access is offered, you withdraw consent or the list is closed, whichever occurs first |
| Answer feedback and support | Message, feedback category, account ID and technical context you deliberately send | Legitimate interest in answering and improving the service | Slack; Sentry when a linked error is investigated | Up to 12 months, unless needed longer for an active request or legal claim |
| Review reports and illegal-content notices | Reported URL/content, reasons, evidence, reporter contact details and moderation outcome | Legal obligation and legitimate interest in maintaining a safe service | Slack and the providers needed to investigate or comply with a lawful request | Up to 12 months after closure; longer only where required for proceedings or by law |
We do not sell personal data, use it for advertising or track you across other companies’ apps. Firebase Analytics is disabled by default. Accepting the Terms or reading this policy does not enable it; enabling it is a separate optional choice that can be withdrawn at any time in Settings.
Required and optional data
Email, authentication data, a display name, preferred language, timezone, acceptance of the Terms and the minimum account/service records are required to complete onboarding and use the account service. Without them, Readendar cannot authenticate you, configure the service or identify your contributions to you and other club members. Uploads, public links, imports, feedback and moderation contact data are required only when you choose those functions. Avatar, reading goals and Firebase Analytics are optional; refusing or withdrawing analytics has no effect on core functionality.
Sources of data
Most data comes directly from you or your device. Club administrators and members may provide your displayed membership role, poll participation or content concerning shared club activity. A reporter may provide a URL, account reference or allegation concerning content. Book metadata comes from ISBNdb and Open Library, and sign-in identity data comes from Google or Apple only when that sign-in method is selected. Where Article 14 GDPR applies, this section identifies those source categories; we will provide additional individual information when required and not disproportionate or legally exempt.
Account deletion and backups
Deleting your account removes the account and associated live database records in one operation. Object-storage deletion jobs are recorded durably and retried until the relevant avatar and cover objects are removed. Encrypted database backups are kept for no more than 30 days and are then automatically pruned. A deleted account is not restored from a backup except where strictly necessary for disaster recovery; any restored deletion state must be reconciled again.
Processors and international transfers
| Provider and service | Main processing location / transfer mechanism |
|---|---|
| Hetzner — hosting, database, Redis and object storage | European Union |
| Brevo — transactional email | European Union; approved sub-processors may use an adequacy decision or standard contractual clauses |
| Cloudflare — network delivery and security | Global edge network; transfers outside the EEA use the provider DPA, adequacy where applicable, or standard contractual clauses |
| Google — sign-in and optional Firebase Analytics | EU/United States and global infrastructure; adequacy where applicable or standard contractual clauses |
| Apple: Sign in with Apple | United States and global infrastructure; adequacy where applicable or standard contractual clauses |
| Sentry — error diagnostics | Provider infrastructure configured for the account; transfers outside the EEA use standard contractual clauses |
| Slack — restricted support/moderation workflows | EU/United States; adequacy where applicable or standard contractual clauses |
| ISBNdb and Internet Archive/Open Library — catalogue lookup | United States; standard contractual clauses or another applicable Article 46 safeguard where personal data is transferred |
Providers may use approved sub-processors. You may request information or a copy of the applicable transfer safeguard at hello@readendar.com, subject to redaction of confidential provisions.
The periods in the matrix are Readendar’s maximum controller retention limits. They must be enforced through each provider’s automated controls or scheduled deletion and evidenced in the provider register before production use. Firebase events are limited to two months, Sentry events to 90 days and Slack support/moderation records to 12 months. The controller reviews the applicable DPA, transfer mechanism, sub-processors, configured retention and dated evidence at least quarterly and whenever a provider or data flow changes.
Your choices and rights
You may:
- change or withdraw optional analytics consent in Settings;
- download a copy of your account data from the app;
- correct profile data or revoke public sharing;
- delete individual content or your entire account;
- request access, rectification, erasure, restriction or portability, and object to processing based on legitimate interests.
Contact hello@readendar.com. We may need to verify that the request concerns your account. Withdrawing consent does not affect processing already carried out lawfully. You may complain to your local supervisory authority; in Spain, this is the Spanish Data Protection Agency.
Children
Readendar is not intended for children under 16 and does not knowingly allow them to create accounts. See the Age and minors policy.
Changes
We will give reasonable advance notice of material changes. A new purpose that requires consent will not be activated without a new choice.
Social
If you activate Social, Readendar processes your unique handle, bio, discovery and approval settings, privacy tiers and per-book overrides, follow requests and accepted connections, blocks and mutes, activity components, reactions, inbox entries, reports and push installations to provide the feature. Everyone means publication on the public Internet. Searchable profiles may be included in our sitemap and indexed by external search engines; non-searchable profiles remain available by direct handle link with noindex instructions. Search-engine caches can persist after content is restricted or removed, and blocking cannot prevent anonymous viewing of content published to Everyone.
Social activity is retained for up to 12 months and Social inbox entries for up to 90 days. Profile-view statistics count each signed-in viewer at most once per profile and UTC day using a keyed, non-reversible HMAC token; tokens are deleted after 35 days and viewer identities are never shown. Firebase Cloud Messaging processes encrypted-at-rest installation tokens to deliver optional Social notifications. Raw push tokens are not logged or exported. Reports retain the reporter, reason, optional note, target snapshot, decision and audit timestamps as moderation evidence under the existing legal-retention policy.
A Social reset requires recent authentication and typed-handle confirmation. It removes the Social profile, graph, privacy and book overrides, activity, reactions, inbox, push installations and profile-view totals, while preserving personal ratings, reviews and private notes and any moderation evidence that lawfully must be retained. Full account deletion removes all live Social data immediately except that same minimal moderation evidence. Public-library links are a separate link-only channel and can bypass Social relationship tiers.