Privacy Policy

1. Introduction

Kabreads ("we", "our", or "us") operates the iOS application that lets friends read books together in real-time (the "App"). This Privacy Policy explains what personal data we process, why, for how long, who receives it, and the rights you have under applicable laws — including the EU General Data Protection Regulation (GDPR) and similar laws in the UK, Switzerland, and the jurisdictions where the App is available.

By creating an account or using the App you acknowledge this policy. If you do not agree, please do not use the App.

2. Data Controller

The data controller responsible for your personal data is the operator of the Kabreads App. You can contact us at support@kabibris.com for any privacy-related request.

3. Information We Collect

3.1 Account information

When you sign up we collect:

• Email address
• Display name
• Profile avatar (if you upload one)
• Authentication identifier from Sign in with Apple (a stable anonymous ID provided by Apple)

3.2 Reading and club activity

While you use the App we store:

• Reading progress (current page, time read per session)
• Clubs you create or join and the role you hold in each
• Quotes, highlights, and reactions you save
• Chat messages and AI-assisted discussion contributions within your clubs
• Presence data during synchronized reading sessions
• Milestones reached (books finished, quotes shared, etc.)

3.3 Books and uploaded files

When you upload an EPUB or PDF, the file is stored on our backend (Supabase Storage) and served only to members of the club you uploaded it to. You are responsible for having the right to upload any file you add.

3.4 WeRead photos

The WeRead feature lets you capture a daily photo of your reading moment. When you post a WeRead entry we store the photo, a timestamp, and any caption you add. WeRead photos are visible to your own feed and, if you choose, to members of your clubs. You can delete a WeRead photo at any time from the feed.

3.5 Technical data

We automatically collect:

• Anonymous device information (iOS version, device model, locale, time zone)
• App crash reports
• A push-notification token so we can deliver notifications
• Aggregate usage events (screens viewed, features used, session duration)

4. Why We Process Your Data (Legal Basis)

• Performing the contract (Art. 6(1)(b) GDPR) — to create your account, sync your reading with club members in real time, store your content, and deliver the features you use.
• Legitimate interests (Art. 6(1)(f) GDPR) — to diagnose crashes, prevent abuse, and improve the product through aggregated analytics. These interests are balanced against your rights; you can opt out of analytics through device settings.
• Consent (Art. 6(1)(a) GDPR) — for push notifications. You can withdraw consent at any time in iOS Settings.
• Legal obligation (Art. 6(1)(c) GDPR) — to respond to lawful requests from authorities and to keep records where required by law.

5. Service Providers We Share Data With

We do not sell your data, share it with advertisers, or use it to build ad profiles. We rely on a small set of processors, each under a data-processing agreement:

• Supabase — account authentication, database, real-time channels, and file storage.
• Firebase (Google LLC) — crash reporting, product analytics, push notification delivery, and remote feature configuration.
• Apple — Sign in with Apple for authentication and, where applicable, App Store transaction validation.

6. International Transfers

Our service providers may process data outside your country of residence, including in the United States. Where data leaves the European Economic Area we rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework to protect your data.

7. Data Security

Every table in our database is protected by Row-Level Security so members only see data they are authorized to see. All traffic between the App and our servers runs over HTTPS or secure WebSocket (WSS). Passwords are never stored — we use Apple-delegated authentication. No system is 100% secure, so if we become aware of a breach that affects your data we will notify you and the relevant authority as required by law.

8. Retention

• Account data — kept while your account is active.
• Reading progress, quotes, chat, WeRead photos — kept while you are a member of the relevant club, or until you delete them.
• Book files — kept while the club that uploaded them exists, deleted within 30 days of club deletion.
• Crash reports and analytics — retained for up to 14 months in aggregated form.
• Account deletion — when you delete your account, your personal data is deleted within 30 days except where law requires longer retention.

9. Your Rights

Depending on where you live, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — delete your account and personal data.
• Portability — request your quotes, reading progress, and WeRead posts in a machine-readable format.
• Restriction / Objection — object to processing based on our legitimate interests (including analytics).
• Withdraw consent — for anything you previously consented to (e.g. push notifications).
• Complain to a supervisory authority — if you live in the EU/UK you may lodge a complaint with your national data-protection authority.

To exercise any right, email support@kabibris.com. We respond within 30 days.

10. Children

Kabreads is not directed at children under 13 (or the equivalent minimum age in your country). We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

11. Invite Codes and Deep Links

When a host shares a club invite (via a kabibris:// link or a /join/CODE URL), the invite code is not personal data on its own — it only identifies the target club. The content of any message you send containing that code stays entirely on the messaging app you used.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent change. If the update materially affects how we process your data we will notify you in-app before it takes effect.

13. Contact

Questions, requests, or concerns? Email support@kabibris.com. We read every message.