Legal

Privacy Policy

Effective: September 21, 2026

Tomeum is a personal museum of your reading. It is built to keep your library private. This policy explains, in plain words, what data the app handles and what happens to it.

The short version

Your library lives on your device. Tomeum works fully offline and does not require an account. If you choose to sign in, your library is backed up to a private cloud space that only you can access. The app keeps anonymous usage statistics (which you can switch off) and crash reports — neither contains your books or anything you write. If you subscribe, payment is handled entirely by the App Store or Google Play — we never see your payment details. We show no ads, do no ad tracking, and never sell or share your data.

Without an account

Everything you add — books, ratings, impressions, quotes, reading history, photos — is stored only on your device. We have no access to it.

If you sign in

Signing in with Apple or Google is optional and exists for one purpose: backing up your library and keeping it in sync across your devices. When you sign in, we store:

• Your e-mail address, received from Apple or Google, used only to identify your account. With Sign in with Apple you may hide your e-mail; note that accounts are matched by e-mail, so a hidden address will not connect to a later Google sign-in.
• Your library content: books and their metadata, ratings, notes, quotes, reading history, memory photos, and custom covers.

This data is stored on Supabase infrastructure in the European Union (Frankfurt, Germany). It is private to your account: access is enforced at the database level (row-level security), and images live in a private storage bucket readable only by you. We do not access, share, sell, or use your library for anything other than serving it back to your devices. To protect them against loss, images are also copied once a night to a backup bucket at Backblaze (European Union, Amsterdam). The backup is encrypted at rest and just as private; deleted images expire from it automatically within 30 days.

Book search

When you search for a book to add, your search query is sent to the Google Books API and to Open Library to find titles, covers, and metadata. Search queries are not linked to your Tomeum account.

Anonymous statistics

To understand which parts of Tomeum are used and where readers get stuck, the app records a small set of named events — for example “a book was added” or “a search ran” — together with the app version, platform, and interface language. These events never contain book titles, search text, notes, or anything else you write; there is no advertising identifier and no cross-app tracking. Events are processed by Mixpanel on servers in the European Union. You can switch statistics off at any time in the app (Me → Anonymous statistics), and the switch is honored immediately.

Crash reports

If the app crashes, a technical report — the error and the state of the code around it — is sent to Sentry (European Union) so the problem can be fixed. Reports are configured to exclude personal data: they carry no account details, and the app strips search text and screen-reader labels from the diagnostic trail before anything is sent.

Subscription and purchases

The optional Museum Keeper subscription is bought through the App Store or Google Play. The stores process the payment; Tomeum never receives your card number, billing address, or any other payment details.

To know whether your subscription is active, the app relies on RevenueCat, a subscription-management service (servers in the United States). RevenueCat receives a random per-install identifier, the purchase history for Tomeum (product, dates, store receipts) and basic device context such as platform and locale. It does not receive your name, e-mail, or anything from your library. This data exists so your purchase can be restored on a new device and so cancellations and refunds take effect in the app; it is retained while needed for these purposes.

What we don’t do

• No advertising and no advertising identifiers.
• No tracking across other apps or websites.
• No selling, renting, or sharing of personal data with third parties.
• No profiling: statistics are anonymous and never joined with your library.

Your data, your control

• Export: the app can export your entire museum as a single file at any time (Me → Export backup).
• Local data: data on your device is under your control and is removed when you delete the app.

Deleting your account

You can delete your account directly in the app: Me → Delete account. This permanently erases your account and everything stored in the cloud — every book, note, quote, reading, year phrase, and image. Books already on your device stay with you unless you choose to erase them too.

Deletion in the app is immediate. If you can no longer open the app, you can request deletion by writing to evgeniia.apps.dev@gmail.com from the e-mail address of your account. Such requests are handled by hand, normally within a few days and at most within 30, and you will receive a confirmation once the account and all associated cloud data are gone.

Data retention

Cloud data is kept for as long as your account exists and is deleted when you delete your account. We keep no copies afterwards, apart from short-lived backups that expire automatically: our hosting provider's infrastructure backups, and our own nightly image backup at Backblaze, which forgets deleted files within 30 days.

Children

Tomeum is not directed at children under 13, and we do not knowingly collect personal data from them.

Changes

If this policy changes, the updated version will be published at this address with a new effective date.

Contact

Questions about privacy: evgeniia.apps.dev@gmail.com