Privacy Policy

1. Who we are and what this policy covers

ByTheBook is operated by Víctor Albertos Gil, who is the data controller. Full statutory information is available in the Legal Notice. Privacy and rights requests: team@learnbythebook.com.

This policy applies to the ByTheBook mobile apps, learnbythebook.com, support and the related reading, audio, glossary, assessment, review-deck and Premium services. ByTheBook is intended for people aged 16 or over.

2. Data we process

• Account and identity: an automatically generated guest account and backend UUID; device/application identifier; and, if you connect an account, your email address, sign-in provider and Firebase identity.
• Settings and learning activity: language, timezone and preferences; assessment answers and results; saved stories; reading sessions and progress; reading history; glossary bookmarks; review notes, cards and results; requests, feedback and notification preferences.
• Premium: product, store, entitlement state, renewal state and expiry. Apple or Google processes payment-card details; ByTheBook does not receive or store them.
• First-party product metrics: limited server-side events derived from completed product actions. They are linked to your backend UUID while your account exists and are not anonymous.
• Operations and security: IP address and request metadata in short-lived service logs; security/admin audit events; backend errors in Sentry; and app crash and diagnostic data in Firebase Crashlytics. Crash reports are not intentionally linked to your ByTheBook account.
• Website and communications: newsletter email if you ask to subscribe, and messages you send to support. The website does not use advertising trackers or cross-site profiling cookies.

3. Why we process data

• To provide the service and perform our contract: create and secure accounts, remember progress, deliver reading and review features, synchronize devices, provide Premium access and support purchases.
• Legitimate interests: protect the service, prevent abuse, diagnose faults and use proportionate first-party metrics to understand and improve the product. These interests are balanced against your rights, with data minimization, restricted access and deletion with the account.
• Consent: send the optional newsletter or carry out any future optional processing that specifically asks for consent. You may withdraw consent at any time.
• Legal obligations and claims: comply with applicable law and establish, exercise or defend legal claims when strictly necessary.

4. Product-improvement metrics and your right to object

ByTheBook does not use Firebase Analytics. Product metrics are created by the backend only for approved product actions, use a strict set of event names and dimensions, and contain no email, provider identity, token, IP address, reading text or free-form content. They remain linked to your UUID so that they can be deleted with your account. You may object at any time by writing to team@learnbythebook.com. We will stop this processing unless compelling legitimate grounds require it.

5. Service providers and international transfers

We use Google Cloud and Firebase for infrastructure, authentication and crash reporting; Cloudflare for network delivery and content storage; RevenueCat for subscription-state management; Sentry for backend error monitoring; and Apple App Store or Google Play for app distribution and billing. A newsletter provider will be named here before that feature is enabled.

Providers receive only the data needed for their role and act under their applicable data-processing terms. Where data is processed outside the European Economic Area or the United Kingdom, we rely on an applicable adequacy decision or contractual safeguards such as the European Commission’s Standard Contractual Clauses, as appropriate.

6. How long we keep data

• Account identity, learning data, Premium state and account-linked product metrics: while the account exists, then deleted with it.
• Newsletter email: until you unsubscribe or ask us to delete it.
• Ordinary Cloud application logs: up to 30 days.
• Sentry backend error events: up to 90 days. Firebase Crashlytics events: 90 days.
• Minimized security and admin audit records: up to 12 months. RevenueCat webhook idempotency records: 12 months; these records contain no payload, signature, authorization value or backend user ID.
• Deleted account data may remain inaccessible in encrypted rotating database backups for up to 35 days, after which those backups expire. A restored backup must reapply completed deletions before serving users.
• Support correspondence is removed when the request is resolved unless a limited period is necessary for a legal obligation or legal claim.

7. Account deletion

You can delete guest and connected accounts from the app. If you cannot access the app, follow the instructions on our account-deletion page or email team@learnbythebook.com. Deleting your ByTheBook account does not cancel an Apple or Google subscription.

8. Your rights

Depending on applicable law, you may request access, correction, deletion, portability or restriction of your personal data; object to processing based on legitimate interests; and withdraw consent without affecting earlier lawful processing. Requests are free in ordinary cases. Write to team@learnbythebook.com; we may verify your identity and will normally respond within one month.

You may complain to the Spanish Data Protection Agency (AEPD) or the supervisory authority where you live or work. People in the United Kingdom may also complain to the Information Commissioner’s Office (ICO). ByTheBook’s controller is established in Spain and does not claim to have a UK representative.

9. Security, children and tracking

We use access controls, encryption in transit, restricted service credentials and monitoring designed to protect personal data. No internet service can guarantee absolute security.

ByTheBook is not directed to children under 16 and does not knowingly offer accounts to them. Contact us if you believe a person under 16 is using the service.

We do not sell personal data, use it for advertising profiling or perform cross-app tracking. We do not make decisions producing legal or similarly significant effects solely by automated means.

10. Changes and contact

We will update the date above and give an appropriate in-app or email notice before material changes take effect. Questions, objections and rights requests: team@learnbythebook.com.