At Must Read ("we," "our," or "us"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website.
1. Information we collect
Information you provide
When you use Must Read, you may provide us with:
- Account information: When you sign in with Apple or Google, we receive your email address (which may be hidden with Apple), name, and a unique identifier.
- Reading data: Books you add, reading progress, reading sessions (duration, pages read), ratings, reviews, and notes.
- Imported library files: If you import your library from another service (such as Goodreads or StoryGraph), we store the file you upload in private storage so we can help recover or repair your import if something goes wrong. These files are accessible only to you and our support tooling, and are permanently deleted when you delete your account.
- Search queries: What you search for within the app, used to improve search results and recommendations.
- Purchases: Subscription plan and status, managed through Apple's App Store and RevenueCat.
- Preferences: Your reading goals, notification settings, and app preferences.
- Photos: Only when you choose to scan a barcode (camera) or set a profile photo (camera or photo library). We do not access your photos without your explicit action.
Information collected automatically
We automatically collect certain information when you use the app:
- Usage analytics: We track how features are used (e.g., screens viewed, books added, reading sessions started) to improve the app. Events are linked to an anonymous device identifier, not your personal identity.
- Crash reports: If the app crashes, we collect diagnostic information to help us fix bugs. This may include device type, OS version, and crash logs.
- Performance data: API response times and error rates, used to monitor and improve service reliability.
- Device information: Device model, operating system version, app version, locale, and language.
- Anonymous device ID: A randomly generated identifier stored on your device, used for analytics. It is not linked to your identity and cannot be used to identify you personally.
- Approximate location (IP-based): When you open the app, we use your IP address to determine your approximate location via the ipapi.co service. We store the city, region and country it returns, together with the approximate coordinates of that location, and use them for analytics and to show region-appropriate content such as curated book lists. These coordinates describe the area your connection appears to be in, not your device: the app never asks for location access, never records GPS positions, and never tracks your movements.
- Apple Ads attribution: If you install Must Read after tapping an Apple Ads ad, Apple provides an anonymous attribution token that our subscription service RevenueCat uses to tell whether a subscription came from that ad campaign. It does not include Apple's Advertising Identifier (IDFA), is not used for tracking across other apps or websites, and is used only to measure our own campaigns.
Information we do NOT collect
- We do not access your contacts, calendars, health data, or other personal data
- We do not sell your data to third parties
- We do not use advertising trackers or third-party ad networks
- We do not use Apple's Advertising Identifier (IDFA)
2. How we use your information
We use the information we collect to:
- Provide and maintain the Must Read service
- Sync your reading data across devices
- Send you notifications about your reading goals and streaks (if enabled)
- Improve the app based on anonymized usage patterns
- Respond to your support requests
- Process subscription payments through Apple
- Send you marketing emails and offer notifications, as described in Section 2.1
2.1 Marketing communications
We may send you marketing messages about Must Read itself, such as:
- Recaps of your reading
- Reading tips and recommendations
- New Must Read features and offers for Must Read Pro
We never pass your email address to anyone for their own marketing, and we do not send other companies' offers to readers who have not agreed to them.
When you create an account: a switch on the sign-in screen lets you choose whether we may email you.
- In the European Economic Area, Switzerland and Canada the switch starts off. We email you only if you turn it on, and that is your consent.
- In the United Kingdom, the United States and other countries the switch starts on. As a Must Read customer, you may receive our marketing emails about Must Read unless you turn the switch off now or later (in the UK this is the "soft opt-in" under the Privacy and Electronic Communications Regulations, regulation 22(3)).
Later in the app we may ask you once, "Email & notifications from Must Read?". If you say yes, that is your consent to emails, and to offers as notifications if you have allowed notifications on your device.
Changing your mind: you can turn emails or offer notifications off or on at any time in the app under Settings > Emails from Must Read, with the unsubscribe link at the bottom of every marketing email, or by emailing [email protected]. It is free and takes effect straight away.
Our record: we keep a record of each choice you make (what you chose, when, where in the app, your region and the wording you saw). Account and service messages, such as sign-in links and subscription confirmations, are not marketing and always arrive.
3. Data storage and security
Your data is stored securely using industry-standard practices:
- Local storage: Your reading data is stored on your device first and synced to our servers afterwards.
- Cloud sync: Data is synced to our servers (powered by Supabase) using encrypted connections (TLS 1.3).
- Authentication: We use Sign in with Apple for secure, privacy-preserving authentication.
- Encryption: All data transmitted between your device and our servers is encrypted.
4. Data sharing
We do not sell, trade, or rent your personal information. We may share data only in these limited circumstances:
- Service providers: We use trusted third-party services (see Section 7) who process data on our behalf to provide the Service.
- Legal requirements: If required by law, court order, or government request.
- Safety: To protect the rights, property, or safety of Must Read, our users, or others.
4.1 Affiliate links
Must Read may include links to purchase books from third-party retailers such as Bookshop.org and Amazon. These are affiliate links, meaning we may earn a small commission if you make a purchase through them. Clicking an affiliate link takes you to the retailer's website, which is subject to their own privacy policy. We do not share your personal data with these retailers.
5. Your rights and choices
You have control over your data:
- Access: You can view all your data within the app.
- Delete: You can delete your account and all associated data from within the app settings. This permanently removes your profile, library, reviews, reading history, and all other data.
- Notifications: You can enable or disable notifications at any time.
- Camera & photos: You can revoke camera or photo library access in your device settings at any time.
6. Children's privacy
Must Read is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.
7. Third-party services
Must Read integrates with the following third-party services:
8. International data transfers
Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.
9. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Significant changes will be communicated through the app.
10. Contact us
If you have questions about this Privacy Policy or our privacy practices, please contact us at:
11. Data retention
We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:
- Account & reading data: Retained until you delete your account.
- Imported library files: Retained until you delete your account, then permanently removed.
- Analytics & usage data: Retained for up to 24 months, then aggregated or deleted.
- Error logs & diagnostics: Retained for up to 90 days.
- Search queries: Retained for up to 12 months.
When you delete your account, all associated personal data is permanently removed from our servers.
12. Cookies and web tracking
When you use Must Read on the web (mustreadapp.com), we use the following:
- Anonymous ID cookie: A persistent cookie containing a randomly generated anonymous identifier, used for analytics. Expires after 1 year. Not linked to your identity.
- Session ID: A temporary session identifier stored in your browser's session storage. Cleared when you close the tab.
- Authentication cookies: If you sign in on the web, session cookies are used to keep you logged in.
We do not use third-party tracking cookies, advertising cookies, or cross-site tracking.
13. California privacy rights
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to request deletion of your data. To exercise these rights, please contact us at the email above.
14. European privacy rights
If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR), including:
- Right to access your personal data
- Right to rectification of inaccurate data
- Right to erasure ("right to be forgotten")
- Right to data portability
- Right to object to processing
To exercise these rights, please contact us at [email protected].