Privacy

TL;DR

Lesefluss is designed to collect as little as possible. The Android app works fully offline - no account needed. This website uses cookieless analytics and sets no tracking cookies. The only cookie you may receive is a login session cookie, and only if you sign in to use cloud sync.

What this site collects

Analytics (anonymous)

Pageviews are logged with a self-hosted Umami instance running on our own server. No cookies are set, no personal data is stored, and data never leaves our infrastructure. Recorded fields: page URL, referrer, browser, OS, device type, country (derived from IP - the IP itself is never saved).

Session cookies

If you sign in (cloud sync), a session cookie is set by Better Auth to keep you logged in. This cookie is strictly necessary to deliver the service you requested (authenticated access) and does not require consent under the ePrivacy Directive / GDPR. It contains no tracking identifiers and is not shared with third parties.

Server logs

Our host may keep short-lived request logs (IP, timestamp, path) for security and abuse prevention. These are not correlated with accounts and are rotated out quickly.

Error diagnostics

If error reporting is enabled, browser and server errors are sent to a self-hosted GlitchTip instance on our own infrastructure. Reports contain technical diagnostics such as the error message, stack trace, app version, browser, operating system, and affected page. We do not enable session replay, performance tracing, profiling, tracking cookies, or default collection of personal data.

The Android app sends anonymized diagnostics to our own server to help us find bugs that would otherwise be invisible (for example, a reading position that silently fails to save). These reports contain no account or personal data: an error type and message, the app version, platform, a coarse OS version, and a random session id that is regenerated every time the app starts. They are never linked to an identity or used for tracking. You can turn this off any time under Settings → Privacy in the app.

What we store when you sign in

Cloud sync is opt-in. When you create an account, we store:

• -Account: your email, a hashed password (or OAuth provider ID), and a display name.
• -Books: title, author, plain-text content, cover image, chapter list, word count, and your reading position - everything the app needs to restore your library on a new device.
• -Settings: RSVP and reader preferences (speed, theme, font, margins, etc.).
• -Highlights: the text ranges you highlight, their color, and optional notes.

Your data is stored on a server in the EU and is never sold, shared, or used to train models. Only you can read it.

Social profile

Social features are optional and only start once you pick a handle. Until then nothing about you is visible to other users. We process this data to provide the feature you opted into (Art. 6(1)(b) GDPR, performance of a contract).

• -Identity card: your handle, display name and avatar. This is shown to any user you legitimately interact with: friend requests, friend lists, invite pages and shared reading. It is shown regardless of your profile visibility setting, so a private profile is not an invisible one. Handles are not searchable and there is no public directory.
• -Profile visibility: either private (the default: your bio and profile sections are visible only to you) or friends (accepted friends see your bio and the sections you leave on: currently reading, finished books, reading stats and shared highlights). There is no public setting; profiles are shown only inside the app and only to friends.
• -Avatar: an image you upload, or your Google or Discord account picture if you explicitly choose it. Either way we resize it to 256 pixels, re-encode it and drop all embedded metadata (including EXIF and GPS data) before storing it. Choosing the account picture copies it once; we never link to the provider's image. You can replace or remove the avatar at any time.
• -Released handles: when you change your handle, the old handle string is held for 90 days so nobody else can take it over in the meantime; the hold remembers that it was yours so that only you can reclaim it, and it is never shown to anyone. Deleting your account keeps the hold but removes the link to you. After 90 days the handle is free for anyone.
• -Time zone: the app stores your device's time zone (for example Europe/Berlin) so that the dates on your profile and your "this year" reading stats follow your own calendar. It is used only for that and is never shown to other users.

Your social profile, avatar and settings are deleted with your account. Clearing your cloud data keeps them.

Friends and invite links

Nobody can look you up. Other users reach you only through a personal invite link you hand out yourself, or by sending a request while you read a book together. To run this we store:

• -Friendships: which two accounts are friends and since when. Friends see each other in their friend lists.
• -Friend requests: who asked whom and when, and whether it is still open. A declined request is kept for 90 days so that the same person cannot keep asking; requests that were never answered are dropped 30 days after they were sent. The sender is never told that a request was declined.
• -Blocks: whom you have blocked. Only you can see your block list; a blocked person is not told.
• -Invite links: your current link and when it expires (14 days). Anyone who opens it sees your handle, display name and avatar, whatever your profile visibility, so only share it with people you want as friends.

All of it is deleted with your account, including the rows in which you are the other party. Clearing your cloud data keeps it.

Inbox

The app's inbox is backed by social notifications we store for you: what happened (for example a friend request or an accepted request), who did it, when, and whether you have read it. Nothing is stored about declines, removed friends or blocks. Items you have read are deleted 90 days after you read them, and every item is deleted 365 days after it was created, or earlier when either account is deleted or one of you blocks the other.

Push notifications

The Android app can show inbox items as notifications. Nothing is sent until you allow notifications in the app and in Android, and you can switch each kind (friend requests, shared books, buddy reads, discussion) and message previews off under Settings → Notifications; that choice is stored with your account. The legal basis is your consent, which you can withdraw at any time there or in Android's settings.

For this we store a device token for each phone you are signed in on, together with its platform and the sign-in session it belongs to. A notification contains only the other person's display name, a short fixed text, the title of the book involved unless they hid it from their profile, and, if you have previews on, up to 100 characters of a reply to a passage you have already read, plus internal ids the app uses to open the right screen. It never contains book text, reading positions, email addresses or account ids. Notifications are delivered through Google Firebase Cloud Messaging (see Third parties). A device token is deleted when you sign out, when the session ends or expires, when Google reports it invalid (which happens the first time we try to reach a phone on which you turned notifications off for the app, on Android 13 and later), and with your account. Pending notifications are deleted once sent or after 24 hours. To limit how many notifications you get, we keep a record of who notified whom for one hour.

What friends see on your profile

With profile visibility set to private (the default), a friend sees only your identity card and since when you are friends. With friends, they also see your bio, how many friends you have, and each section you leave switched on: the books you are currently reading (title, author, progress), the books you finished (title, author, finish date, your star rating) and your reading stats (books finished this year, words read, reading time and reading speed as totals). Never shown: your review text, notes, tags, exact reading position, individual reading sessions, articles you imported from the web, or your email. Any book can be hidden from your profile in its edit sheet; a hidden book leaves every section and the stats. Nobody outside your friends can open your profile.

Sharing books

You can offer a synced book to one friend at a time. If they accept, the server copies the book into their account: the text, cover, chapters, links, title, author, description, language and where it came from. Not copied: your reading position, status, rating, notes, tags, highlights, glossary, reading sessions or the hide-from-profile flag. The copy then belongs to your friend and stays in their library even if you unfriend each other, block each other or delete your account. Only a takedown following a notice removes it.

For every share we store who offered which book to whom, when, and the outcome (open, accepted, declined, expired or withdrawn), plus the title, author and length as they were when you shared. Open offers expire after 30 days; closed records are deleted 90 days after they closed. Your one-time confirmation that you may share, with its timestamp, is stored with your account. Every book carries an internal origin marker so that two copies of the same book can be recognised for reading together and so that a takedown can reach every copy; the app only ever receives a scrambled form of it, never who uploaded the book. All of this is deleted with your account, except copies that friends accepted.

Buddy reads

A buddy read is a group of up to eight people reading the same book. For each one we store the book's title and author, who hosts it, an optional target date, who is a member with which of their books, when they joined, left or finished, and every invite (who invited whom, when, and the outcome). Only friends can be invited, and an invite tells the invitee who else is in before they join.

While you are a member, everyone else in the buddy read sees your handle, display name and avatar, how far you are in the book (percentage, chapter and position), whether you finished it and when you last read, even if you are not friends with them. We take this from your last synced reading position; no extra data is collected. Someone you blocked or who blocked you sees none of it. Members can send each other friend requests. When you leave, are removed, or your copy of the book is deleted, the others stop seeing your progress; the book stays in your library. A buddy read is deleted when its last member leaves, and your memberships and invites are deleted with your account. A joiner who does not have the book receives a copy exactly as with sharing.

Comments and shared highlights

In a buddy read you can write comments, reply to them, react with an emoji and share highlights. We store the text, where in the book it belongs, who wrote it and when, and who reacted. A shared highlight includes its note. Nothing is shared unless you share it, either one highlight at a time or with the "share all my highlights" setting, which you can switch off again. Only current members of the buddy read see these items, each only once they have read that far, and never someone you blocked or who blocked you. To decide what to show, we keep the furthest position you have reached in the book. If you leave, your comments stay and your shared highlights disappear. Everything is deleted with the buddy read. When you delete your account, your reactions and shared highlights are deleted and your comments are deleted too, except that a comment others replied to stays as an empty "removed" entry without your name.

Live reading activity

While you have a buddy-read book open, the app sends your reading position to our server every two seconds. The other members of that buddy read see that you are reading now, your position and your reading speed in the current sitting. The server keeps this in memory only while you read and never stores it. You can switch it off in the social settings; you then also see nothing live from others.

Activity feed

When you start or finish a book, we record that fact for the activity feed: which book, which of the two, and the day. We store no reading position and no review; a finished book shows the rating you gave it. Your friends see these entries only while your profile is visible to friends, the matching section ("currently reading" or "finished books") is on and "Share my reading activity in friends' feeds" is on, and only while the book is in your library and not hidden from your profile. Nobody else sees them, and nobody sees a time of day. You can remove a single entry, and switching the setting off deletes all of them. Entries are deleted after 90 days and with your account.

Notices and moderation

Anyone can report a profile or a shared book, in the app or through the public report form. For each notice we store: what was reported and where, the reason and explanation, who notified us (your account, or the name and email you typed into the form), a text snapshot of the reported item as it looked at that moment (for a profile the handle, display name and bio; for a book the sender, title, author and origin, never the book text), our decision, who made it and when, and whether the emails about it were delivered. The snapshot exists because the reported item can be edited or deleted before we review it.

The reported user is never told who notified us. If we restrict an account we email the affected user a statement of reasons and place it in their inbox; the notifier receives our decision by email or in their inbox. Notices are deleted 24 months after the decision. When an account is deleted, its restrictions end and its name and email are removed from the notices it submitted. The notices themselves stay until their 24 months are over, because we must be able to show that we acted on them. Removal records (which book was taken down from which account) are kept for good: they are what keeps a removed book from being uploaded again.

The Android app

The app runs fully offline by default. Books, settings, and highlights live in a local SQLite database on your device. Apart from the anonymized error diagnostics described above (which you can turn off under Settings → Privacy), nothing leaves the device unless you explicitly sign in to sync. Bluetooth is used only to talk to the optional ESP32 device and transmits nothing to us.

Browser extension

The Chrome/Firefox extension is optional and only works after you sign in. It stores your Lesefluss session token and account email in browser extension storage so it can import articles into your cloud library without asking you to sign in every time.

When you click Save this page or use the selection context menu, the extension reads the current page URL, page title, and the readable article HTML or selected HTML. That content is sent to Lesefluss only for the page or selection you explicitly save, converted to plain text, and stored as a book in your synced library. The extension also checks the active tab URL against your library to show whether the page was already saved.

The extension does not run analytics, does not collect browsing history, does not capture pages automatically, and does not sell or share extension data. You can remove imported articles or delete your account from Lesefluss to delete synced extension imports.

Third parties

• -Google Sign-In - see the dedicated Google user data section below for a full disclosure of what we receive from Google, how we use it, and how it is stored.
• -Discord Sign-In - if you choose to sign in with Discord, Discord processes the request under its own privacy policy and shares your email address and username with us to create your account. We do not request any other scopes and never act on your behalf with Discord services.
• -Resend - account emails (verification, password reset) are delivered via Resend, acting as a data processor on our behalf. Only your email address is shared, and only when we send you one of these messages.
• -Google Firebase Cloud Messaging - delivers push notifications to the Android app, acting as a data processor on our behalf. It receives the device token and the notification text described under Push notifications, and only when notifications are on. Google LLC may process this data in the United States, under the EU-US Data Privacy Framework and the standard contractual clauses in Google's data processing terms.
• -GitHub - if you download the APK or view the source, GitHub processes the request under its own privacy policy.
• -Dictionary lookups - in-app word lookups query our own catalog service, not a third party. Only the word and the book's language are sent; no account or identifier.

There are no advertising networks, no social-media pixels, no third-party analytics.

Google user data

This section describes how Lesefluss accesses, uses, stores, and shares Google user data, in accordance with the Google API Services User Data Policy, including the Limited Use requirements.

What we access

When you choose to sign in with Google, we use Google's standard OAuth 2.0 sign-in flow with only the following default scopes:

• -openid - your Google account identifier (sub) so we can recognise returning users.
• -email - your Google account email address and whether it is verified.
• -profile - your display name and profile picture URL.

We do not request any other Google OAuth scopes. Lesefluss never accesses Gmail, Google Drive, Contacts, Calendar, Photos, YouTube, or any other Google service on your behalf, and never reads, writes, or modifies any data in your Google account.

How we use it

The data received from Google is used exclusively to:

• -Create your Lesefluss account on first sign-in and link subsequent sign-ins to the same account.
• -Authenticate you and maintain your signed-in session so cloud sync (books, settings, highlights) works across devices.
• -Display your name or email in the app UI (e.g. on your profile page) and send you transactional account emails such as email verification and password reset.

Google user data is never used for advertising, never sold, never shared with third parties for their own purposes, and never used to train AI or machine-learning models.

How we store it

Your Google account identifier, email, name, and profile picture URL are stored in our authentication database (PostgreSQL, hosted in the EU) alongside your Lesefluss account. Access is restricted to the Lesefluss backend and the project maintainer. We do not store Google OAuth refresh tokens beyond what Better Auth needs to keep your session valid, and we do not request offline access.

How we share it

We do not share Google user data with any third party. The only processors involved are: our EU database host (storage), and Resend (transactional email delivery - only your email address, only when sending you an account email). Both act solely on our behalf under data processing terms.

Retention and deletion

Google user data is retained for as long as your Lesefluss account exists. You can delete your account at any time from within the app; doing so permanently erases your account record (including the Google-provided identifier, email, name, and picture URL) as well as any synced books, settings, and highlights. You can additionally revoke Lesefluss's access from your Google Account permissions page.

Your rights

Under GDPR you can request access to, correction of, or deletion of your personal data. For account data, you can delete your account from within the app to purge everything we have on you. For any other request, email privacy@lesefluss.app.

Changes

If we change what the site or app collects, we'll update this page and note it at the top. For significant changes affecting existing users, we'll notify you in-app.