Privacy Policy

The short version

This policy explains what is kept on your device, what leaves it, who receives it, and what you can do about it. It covers the Xoreader app for iPhone and this website, xoreader.app. It doesn’t cover the App Store, RevenueCat’s own services, or the websites you import from; they have their own policies.

Who we are

Xoreader is made by AxoLottaLove, the developer name under which Xoreader is published. For the EU and UK General Data Protection Regulations, Brazil’s Lei Geral de Proteção de Dados (LGPD) and similar laws, AxoLottaLove is the controller for the limited personal data described here.

Reach us at [email protected] about anything in this policy.

What stays on your device

Xoreader is local-first. The following is written to the app’s private storage on your iPhone, not to a Xoreader account or server:

• Your library. EPUB and TXT files you import (Xoreader keeps its own copy), text you paste, imported articles and video captions, and what the app extracts from them: text, chapters, covers, and the source link, title, author and date where available.
• Your reading. Reading positions and sessions, including the mode, pace, words read and any comprehension answers.
• Your games. Results, levels, personal bests, sorting-game rounds, your starting measurement (“Where you started”), XP, streak, medals and the daily counters for the free plan.
• Your Word Bank. Saved words, their definitions, the sentence you met them in and their review schedule.
• Your settings. Appearance, language, reading preferences, Gentle mode, haptics, sound, reminder time, and which notices you’ve seen.
• Your subscription status. The last known Pro status and when it was checked, so Pro keeps working offline for up to 14 days.

Sharing a file or link to Xoreader from another app hands it to Xoreader on the same iPhone; nothing is uploaded on the way.

You control all of this on the device. Deleting a reading from your library removes its stored copy and its reading data. Settings → Reset progress clears reading and game history, XP, streaks, medals and your starting measurement, while keeping your books and preferences. Deleting Xoreader removes all of its data from that iPhone.

If iCloud Backup is on, iOS may include Xoreader’s data in your iPhone’s backup, and restoring that backup can bring it back. Backups are controlled by you and Apple under Apple’s terms; we can’t read or delete them.

What each service receives

Xoreader has no servers of its own and no account system. This table lists every service the app or this website can contact. Like any internet request, each one receives your IP address and ordinary request details, such as the time and the app or browser making the request.

Xoreader contains no advertising, attribution, fingerprinting, social-login, analytics or crash-reporting SDK.

Purchases and Xoreader Pro

Xoreader Pro is sold by Apple through your App Store account and checked with RevenueCat, which acts as our service provider. RevenueCat creates a random, pseudonymous App User ID the first time the app runs. It isn’t derived from your name, email, device identifiers or reading, but it does identify one RevenueCat customer record and its purchase history, so we treat it as personal data rather than as anonymous data.

We don’t connect that record to anything else, and there’s no Xoreader account to link it to. If you contact us about a purchase, we may use the order details you give us to look it up. Pro status is also cached on your iPhone so it keeps working offline for up to 14 days. Restore purchases, on the Pro screen and in Settings, recovers Pro on an iPhone signed in to the same Apple Account.

Books, articles and captions you bring in

Files and pasted text

Xoreader copies EPUB and TXT files and pasted text into its private storage and processes them on your iPhone. It doesn’t upload them anywhere. Copy-protected (DRM) files are refused, not decrypted.

Web articles

When you import a link, Xoreader makes one request from your iPhone to that address, following any redirect, downloads up to 5 MB of the page’s HTML and extracts the readable text on your device. It doesn’t run the page’s scripts, load its images, send cookies or visit other pages. The site sees the request much as it would from a browser, with a user agent that names Xoreader:

YouTube captions

Importing a video’s captions asks YouTube for the video’s details and one caption track. Xoreader never downloads the audio or video.

After an import, everything is read offline. Please only import material you have the right to use; see the Terms of Use.

Reminders

Reminders are off by default. If you turn them on and allow notifications, Xoreader schedules at most one local reminder a day, at the time you choose. Reminders are created on your iPhone; there’s no push service and no server involved. You can turn them off in Settings at any time, and Xoreader won’t turn them back on by itself.

Exporting your data

With Pro, Settings → Export progress creates a JSON file and CSV files covering your reading and game sessions, sorting-game rounds, personal bests, medals and Word Bank cards, then opens the iOS share sheet. Xoreader doesn’t upload or keep a remote copy. Wherever you choose to send the files controls them from then on.

The files can reveal what and when you read, the words you saved and the sentences they came from, so share them with care.

If you email us

When you write to [email protected], we receive your email address and whatever you choose to include. We use it to answer and administer your request. We keep the thread while the request is active and afterwards only as long as it’s reasonably needed for follow-up, disputes, security or legal recordkeeping. We don’t add you to a mailing list.

What Xoreader never does

• It doesn’t require or offer an account, and doesn’t ask for your name, email, phone number or date of birth.
• It doesn’t show advertising and contains no advertising SDK.
• It doesn’t include third-party analytics or crash reporting, and it doesn’t track you across other companies’ apps or websites.
• It doesn’t ask for access to your contacts, photos, camera, microphone or location.
• It doesn’t sell or share personal information for cross-context behavioural advertising, under the California CCPA/CPRA or any similar law. There’s no reading profile to sell.
• It doesn’t send your books, notes or reading history anywhere, including to train AI models.

Children

Xoreader is a general-audience app. It isn’t directed at children under 13, we don’t knowingly collect personal information from them, and it isn’t offered in the App Store’s Kids category.

If you believe a child has sent us personal information by email, write to [email protected] and we’ll delete it.

Your choices and rights

The controls in your hands

Account deletion

Xoreader has no accounts, so there is no account to delete. Deleting the app removes its data from your device; subscription records held by Apple and RevenueCat are covered below.

Rights under the GDPR, UK GDPR, LGPD and US state laws

Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. Because your reading data never reaches us, we can’t access, correct or delete it for you; the controls above do that directly. For an email thread or a purchase record, write to us. For a purchase, include the date and plan so we can find it.

Where we process the small amount of personal data described here, we rely on performing our contract with you (providing the app and your subscription) and on our legitimate interest in running a secure, working service and answering you. Reminders only run if you allow notifications, and you can withdraw that at any time. We don’t make automated decisions about you or build profiles.

You can also complain to your data protection authority, including the ANPD in Brazil. If you’re in California, the list above is the whole picture: we don’t sell or share personal information, and exercising your rights will never get you a worse version of Xoreader.

Retention

• On-device data stays until you delete it with the controls above or remove the app. Device backups follow Apple’s controls.
• Purchase records are kept by Apple and RevenueCat under their published retention rules and for as long as needed to restore entitlements, prevent fraud, handle refunds and disputes, and meet legal and accounting obligations.
• Website logs are kept under the hosting provider’s operational and security settings, then deleted or aggregated. We don’t use them to build profiles.
• Support email is kept while your request is active and afterwards only as long as reasonably needed, then deleted.

Where data is handled

RevenueCat, Apple, Google (for YouTube imports) and the providers that host this website and our email operate internationally, including in the United States, so the limited data described here may be processed outside your country. Where required, transfers rely on safeguards those providers maintain, such as Standard Contractual Clauses.

Their own policies also apply: RevenueCat, Apple and Google.

Security

Subscription checks use encrypted connections. When you import a link, Xoreader uses the address you give it, so prefer https:// addresses. Your data sits in the app’s own storage area, protected by iOS and, on a modern iPhone, by device encryption tied to your passcode. No method of storage or transmission is perfectly secure, and we don’t claim otherwise.

Changes to this policy

If Xoreader starts doing something this policy doesn’t describe, we’ll update this page and its effective date before that change ships, and mention material changes in the app’s release notes.

Contact

See also the Terms of Use and the support page.