Legal
Karteado Tecnologia LTDA ("Karteado", "we") operates Readaily. This policy explains what data we collect, how we use it, when we share it, how long we keep it, and what choices you have. We have tried to write it plainly rather than defensively — where something about Readaily may surprise you, we say so directly instead of burying it.
Scope: This policy applies to the Readaily mobile apps (iOS and Android), the Readaily Apple Watch app, home-screen widgets, and the readaily.app website. Additional notices shown inside a specific feature take precedence over this document in case of conflict.
The short version. Your reading itself is private: your books, pages, session notes, and timers are yours. Three things are not private, and they are the ones people miss — your profile (name, photo, bio, streaks, reading stats), your book reviews, and your activity feed are visible to other Readaily users, published under your name and photo. Readaily also shows ads to users without a Pro subscription. Details in sections 3, 4, and 5.
identifierForVendor on iOS, the Android ID on Android). This identifier is stored on our servers and linked to your account so we can manage sessions and push delivery across your devices.We do not use your reading content to train machine learning models, and we do not perform automated decision-making that produces legal or similarly significant effects about you.
Readaily is free to use and is funded in part by advertising. If you subscribe to Readaily Pro, ads are switched off entirely and no ad requests are made from your device.
Notice for California residents (CCPA/CPRA). We do not sell your personal information for money. However, our use of ad mediation partners to show you personalized ads is treated under California law as "sharing" personal information for cross-context behavioral advertising. You have the right to opt out. To do so, decline personalized advertising in the app's privacy settings, or email us at hello@readaily.app with the subject "Do Not Sell or Share". Subscribing to Pro also stops all ad requests. We do not knowingly share the personal information of users under 16 for advertising.
This is the section most worth reading carefully. Readaily has a social layer, and several things are public by default.
Once you choose a username, other signed-in Readaily users can see your username, display name, avatar, biography, country, join date, current and longest streak, books completed, pages read, total reading time, session count, and your follower and following counts. You can restrict this by setting your profile to private in the app, which hides your statistics from people who do not follow you.
When you rate or review a book, that rating and review text are shown on that book's page to other users, alongside your display name and avatar. This is the single most commonly misunderstood part of Readaily, so to be explicit: a book review is a public post, not a private note. If you want a private record of your thoughts about a book, use session notes instead — those are never shown to anyone.
When you finish a reading session, complete a book, or rate a book, Readaily can post that activity to your followers' feeds. This sharing is on by default, and if you type a comment when finishing a session, that comment is published with the activity. There is a toggle in the session-completion screen to turn sharing off before you post. We are naming the default explicitly because "opt-out" and "opt-in" are not the same promise.
Anyone can follow a public profile without approval; private profiles must approve each request. The follow relationship itself is not secret. Nudges send a push notification to another user containing your first name and your avatar. Blocking someone is not disclosed to them.
Publishing your bookshelf is opt-in — nothing is shared until you deliberately publish it, and a published shelf is a static snapshot (titles, authors, colours, and optionally ratings) visible only to signed-in users who can already see your profile. It never includes your reading progress, dates, or Ink balance.
Members of a club can see each other's names, avatars, and progress through the club's book, expressed as a percentage rather than a raw page number.
Readaily has a cosmetic in-app currency called Ink, which you earn by reading and can also buy. We record your Ink transactions, the cosmetic items you own, and how you have arranged your shelf. Because the transaction ledger records when you earned Ink, it necessarily reflects when you were reading — so we keep it strictly private to your account and it is never exposed to other users. Purchases are processed by Apple or Google; we receive only a transaction identifier and entitlement status.
If you opt into friend discovery, Readaily reads the phone numbers in your address book, converts each to a scrambled form (a salted SHA-256 hash) on your device, and sends those hashes to our server, which compares them against the hashes of Readaily users and returns any matches. Your contacts' names are never uploaded, and the raw phone numbers are never uploaded.
We want to correct something directly. Earlier versions of the Readaily app displayed a permission message stating that phone numbers are "matched privately on your device and never uploaded". That was inaccurate. The matching happens on our server, not on your device, and a derived identifier for each of your contacts is transmitted to us. We are correcting that message in the app. We also want to be honest about the limits of the protection: because phone numbers are drawn from a small, predictable range, a hash of a phone number should be treated as personal data rather than as anonymous, and we treat it that way. We use the hashes solely to return matches, and we are separately working to strengthen this design.
You can decline this permission and use all of Readaily except friend discovery. If you have already used it, email us and we will delete your stored number and hash.
Push delivery is operated by OneSignal. To route and personalize a notification, OneSignal receives your account identifier, your email address, your app language, and a small set of properties about your reading (your current streak, the date of your last session, whether you belong to an active club, and whether you finished onboarding). When another user nudges you, their first name and avatar are also sent so the notification can be rendered. Notification content never includes the titles of books you are reading.
If you use Focus Mode, the list of apps you choose to restrict during reading is managed by iOS Screen Time and stays on your device. It is never uploaded to our servers.
Readaily is not intended for children under 13, and the minimum age is higher in some countries. We ask for your date of birth once and use it to apply the minimum age for social features where you are:
| Country | Minimum age for social features |
|---|---|
| Brazil, Australia, Vietnam | 16 |
| South Korea | 15 |
| Everywhere else | 13 |
If you are below the minimum age for your country, the social features of Readaily are not available to you, and your profile is not visible to other users. Reading, tracking, and statistics continue to work normally — the age check governs the social layer only.
We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us data, email hello@readaily.app and we will delete it promptly. If you are a parent or guardian and want to review or remove your child's information, contact us at the same address.
We do not sell your personal information. We share it in these cases only:
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Database and sync | Your account and reading data |
| Clerk | Authentication | Email, credentials, session tokens |
| RevenueCat | Subscription and purchase entitlement | Purchase receipts, account identifier, country, price paid |
| OneSignal | Push notifications | Account identifier, email, language, reading properties (section 5.D) |
| Firebase | Analytics, crash reporting, performance, remote config, in-app messaging | Usage events, device data, crash reports, installation identifier |
| Sentry | Error tracking | Errors and stack traces, account identifier, email, IP address |
| Google Books | Book search and metadata | Your search text, IP address |
| Google Fonts | Typeface delivery | Your IP address, on first load |
Google AdMob, Meta Audience Network, and AppLovin — as described in section 3. Unlike the providers above, these partners act as independent controllers of the data they collect.
As described in section 4.
Depending on where you live (GDPR in the EEA/UK, LGPD in Brazil, CCPA/CPRA in California, and comparable laws elsewhere), you may have the right to access, correct, delete, or export your data, to object to or restrict certain processing, to withdraw consent, and not to be discriminated against for exercising these rights.
To delete your account, email hello@readaily.app from the address on your account, or use the form at readaily.app/delete-account. We reply within 7 business days and complete deletion within 30 days. Readaily does not yet offer account deletion inside the app. We are building it; until it ships, the email route above is the way, and we would rather tell you that than imply a button exists.
How to exercise your rights: email hello@readaily.app. We may ask you to verify your identity. Authorized agents may submit requests with proper documentation. We respond within the timeframe your law requires.
We use administrative, technical, and organizational measures to protect your data, including encryption in transit and at rest, row-level access controls in our database, least-privilege access for our team, and continuous vulnerability review. No method is perfectly secure, and we do not claim otherwise. If a breach affects your personal data and the law requires it, we will notify you and the relevant supervisory authority within the required deadlines.
We operate globally. Your data may be processed in Brazil, the United States, and other countries where we or our providers operate. Where we transfer personal data out of the EEA, UK, or Brazil, we rely on adequate safeguards such as Standard Contractual Clauses or an equivalent mechanism, together with technical and contractual protections.
The Service may link to third-party sites or let you activate integrations. Those services are governed by their own policies, and we are not responsible for their practices. We tell you what data will be exchanged before an integration is activated.
We may update this policy to reflect changes in law, technology, or the Service. Every revised version is published here with a new date.
For material changes — a new category of data, a new purpose, a new recipient, or anything that meaningfully changes how we handle your personal data — we will email you at least 30 days before the change takes effect, stating what changed and when it applies, and show an in-app notice where we can. We send that email to every account, because it is a service notice rather than marketing: turning off marketing emails does not turn it off. Where a change requires your consent under the law that applies to you, we will ask for it rather than assume it.
Karteado Tecnologia LTDA (Readaily)
Email: hello@readaily.app
For EEA/UK users: if you believe your rights have been violated, you may lodge a complaint with your local supervisory authority. For Brazilian users: you may contact the ANPD. We would genuinely prefer you contact us first, and we will treat it seriously.