Reading Lobster — Privacy Policy
DRAFT v0.6 — 2026-07-22 — for lawyer review, not published. Plain-language rewrite of v0.4, plus: reporting purchase-consumption information to Apple on refund requests (Sections 4 and 6, mirroring Terms §5), and honest disclosure of product analytics (PostHog) and crash reporting (Sentry) — the previous "no analytics SDKs" claim was factually wrong. Placeholders marked
[⚠️ …]. Sources: repo audit + vendor research 2026-07-05, code re-audit 2026-07-08 (seedocs/legal/README.md).
Effective date: [⚠️ set at publication]
1. Who we are
Reading Lobster is an iOS app for learning German through reading. It is run by one person:
Anastasiia Kirzhanova (sole trader) Am Kutscherhaus 6, 12555 Berlin, Germany Email: hello@readinglobster.com
I am the data controller under the EU General Data Protection Regulation (GDPR). This policy covers the Reading Lobster iOS app, the API at api.readinglobster.com, the AI-assistant connector (MCP), and the website readinglobster.com.
2. The short version
- We collect what the app needs to work: your account, your learning profile, the texts you read, your vocabulary, your progress.
- No advertising, no ad identifiers, no sale of data, no cross-app tracking. To improve the app we use privacy-configured product analytics (PostHog) and crash reporting (Sentry), both EU-hosted: no reading texts, no card words, no session recordings. Analytics has an off switch in the app.
- Your voice recordings from shadowing practice stay on your phone. They are never uploaded.
- Three AI services process your German texts, always through our server. Anthropic Claude (translations, cards, stories) and Google Gemini (reading the text in photos you import) do not use your content to train their models. ElevenLabs (audio) receives only the German text being voiced, never your name or account data, and may use that text to improve its models.
- You can delete your account with all its data yourself, in the app, at any time.
3. What data we process
3.1 Stored on our servers
| Category | What it includes | Source |
|---|---|---|
| Account | Your email address (email sign-in), Apple ID identifier (Sign in with Apple), or Google account email and identifier (Sign in with Google), plus an internal user ID | You |
| Profile | Display name, German level (CEFR), interests, translation and card language, reading voice, daily goal, promo code if you entered one | You |
| Your texts | Texts you import (paste, file, URL, photo), AI stories you request, per-sentence translations | You, or generated for you |
| Vocabulary | Words you save, generated card content, your personal notes, learning status | You, or generated for you |
| Reading progress | Position, percent read, finished flags, timestamps | Automatic |
| Audio | Audio files generated for your texts, with their word timings | Generated for you |
| Usage accounting | A ledger of your plan usage ("vocabulary card created", "page voiced"), with timestamps | Automatic |
| Subscription | Product ID, subscription status, expiry date, store transaction identifiers | Apple / RevenueCat |
| Connector (optional) | Your personal MCP access token; OAuth client and token records (tokens stored as hashes) if you connect your own AI assistant | You |
| Support | Emails you send us | You |
| Server logs | IP address, time, and technical request data whenever the app or website talks to our servers. Used only for security and diagnostics, deleted within 14 days [⚠️ configure log rotation before publication] | Automatic |
| Product analytics | Named feature events ("card created", "text opened") with counts and your level, tied to your account ID, plus app version, device model and OS. Never your texts, card words, prompts, or audio | Automatic (PostHog), unless you switch it off in the app |
| Crash reports | Stack trace, device and OS details, UI navigation breadcrumbs. No account identifier, no email, no text content | Automatic (Sentry) |
3.2 Stored only on your phone
- Voice recordings from shadowing practice, where this feature is available. They live in the app's local storage and are deleted when you sign out, delete your account, or delete them in the app. They are never uploaded.
- Sign-in tokens (encrypted, in the iOS Keychain), local preferences, cached audio and content.
3.3 What we deliberately avoid
- No advertising and no ad identifiers. The app shows no App Tracking Transparency prompt because we do not follow you across other companies' apps or websites.
- Analytics without your content: session replay and screen capture are off, and events never carry your texts, card words, prompts, or audio. Crash reports are not linked to your account. The readinglobster.com website sets no cookies and runs no analytics.
- No profiling with legal or similarly significant effects, and no automated decision-making within the meaning of Art. 22 GDPR.
- We never ask for passwords, financial data, or government ID numbers. Please keep them out of the texts you import, too.
4. Why we process it
The GDPR requires a legal basis for every purpose. Here are ours:
| Purpose | Legal basis (GDPR) |
|---|---|
| Running the service: account, sync, translations, audio, cards, progress, subscription entitlements | Art. 6(1)(b), performance of contract |
| Enforcing usage allowances, preventing abuse and fraud, securing the API (storing connector tokens as hashes, short-lived server logs) | Art. 6(1)(f), legitimate interest in a secure and economically viable service |
| Affiliate attribution when you enter a promo code yourself | Art. 6(1)(f), legitimate interest; the code is data you typed in yourself |
| Product analytics: understanding which features help learning (PostHog) | Art. 6(1)(f), legitimate interest; switch it off any time in the app (Cabinet) |
| Crash reporting: finding and fixing crashes (Sentry) | Art. 6(1)(f), legitimate interest in a working app |
| Reporting how much of a purchase you used to Apple, when you ask Apple for a refund (see Terms of Service, Section 5) | Art. 6(1)(f), legitimate interest in giving Apple accurate facts for its refund decision |
| Legal obligations, e.g. tax records for purchases | Art. 6(1)(c), legal obligation |
| Optional future communications, e.g. a newsletter | Art. 6(1)(a), consent. Only if you opt in, revocable any time |
To use the service you need an email (or Apple/Google sign-in) and a German level. Everything else in the profile is optional.
5. AI processing: what goes where
Reading Lobster calls external AI models, always from our server. The app itself holds no AI-provider keys, and the providers never see your name or email; only our server authenticates.
- Anthropic (Claude models; contracting entity Anthropic Ireland, Ltd.) receives: German text you import or select, the prompts you write for AI stories, and, for vocabulary cards, your learning context (CEFR level and interests) — plus, only when Google is temporarily unavailable, photos you import (as an OCR fallback). It uses them to translate, build cards, write stories, and, in the fallback case, recognize text. Anthropic does not train models on this data (API terms) and keeps API inputs and outputs for a limited period, currently up to 30 days, for abuse prevention.
- Google (Gemini models; contracting entity Google Ireland Limited) receives photos you import, sent as images for text recognition (OCR), and returns the recognized text. We use Google's paid API tier, under which Google does not use your content to train or improve its models and stores inputs only temporarily for abuse and policy monitoring.
- ElevenLabs (text-to-speech) receives only the German text of the pages you voice, never your name, email, or account data. ElevenLabs may use submitted content to improve its models. The generated audio is AI-made; ElevenLabs is rolling out machine-readable marking (inaudible watermarking) across its output, and we preserve such markings in our processing.
A photographed letter travels as a full image, including everything visible on the page. Importing texts and photos is part of the service you request (Art. 6(1)(b)). Please do not import texts or photograph documents that contain other people's sensitive data.
AI-generated content (translations, cards, stories, audio) can contain errors. The Terms of Service explain what that means in practice.
6. Who else receives data
These companies process data for us under Art. 28 GDPR data processing agreements:
| Processor | What they do | Location and transfer safeguard |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Frankfurt); SCCs with Supabase Pte. Ltd for support access |
| Hetzner Online GmbH | Server hosting (API) | Germany; no third-country transfer |
| Anthropic Ireland, Ltd. / Anthropic PBC | AI text and image processing (translation, cards, stories, OCR fallback) | US processing; EU Standard Contractual Clauses (SCCs) |
| Google Ireland Limited / Google LLC | AI image text recognition (photo OCR) | US processing; EU Standard Contractual Clauses (SCCs) |
| ElevenLabs Inc. | Text-to-speech | US; EU-US Data Privacy Framework certification, SCCs as fallback |
| RevenueCat, Inc. | Subscription status management | US; SCCs |
| Twilio Inc. (SendGrid) | Transactional email (sign-in codes) | US; EU-US Data Privacy Framework + SCCs |
| PostHog, Inc. | Product analytics | EU-hosted ingestion (Frankfurt); SCCs with the US entity for support access |
| Functional Software, Inc. (Sentry) | Crash reporting | EU data residency (ingest.de.sentry.io); SCCs as fallback |
Apple (App Store, in-app purchases, Sign in with Apple) and Google (Sign in with Google) act as independent controllers for their own services. Their own privacy policies apply there. One case where we actively send Apple data: if you ask Apple to refund a purchase, we report to Apple, at its request, how you used that purchase — delivery status, the share of the credits or subscription allowance already used, whether free sample content was available to you, and your account status — so Apple can decide your request (Terms of Service, Section 5).
Where data leaves the EU/EEA, we rely primarily on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); DPF certifications, where they exist, are an additional safeguard. Email hello@readinglobster.com for a copy of the relevant safeguards.
7. How long we keep it
| Data | How long |
|---|---|
| Account, profile, texts, vocabulary, progress, audio, connector tokens | Until you delete your account (in the app: Cabinet → Delete account). Database records and stored files (generated audio, uploads) are deleted immediately; stragglers are swept within 30 days. We also instruct RevenueCat to delete your subscriber record [⚠️ configure RC_API_KEY in production before publication]. What remains: a de-identified note that a deletion happened (date only, no account identifier) and the legally required records below. |
| Uploaded source files and photos | Deleted right after a completed import; abandoned uploads are swept daily, at the latest within 30 days |
| Residual copies in encrypted database backups | Purged automatically within 30 days of deletion |
| Records we must keep by law, e.g. purchase records | For the statutory retention periods, kept minimal |
| Server logs | Deleted within 14 days [⚠️ configure log rotation before publication] |
| Analytics events and crash reports | Provider retention schedules [⚠️ set before publication: analytics ≤ 12 months, crashes ≤ 90 days; wire PostHog person deletion into account deletion] |
| Local voice recordings | On your phone only; wiped on sign-out and account deletion |
8. Your rights
Under the GDPR you can access your data (Art. 15), correct it (Art. 16), delete it (Art. 17), restrict processing (Art. 18), take your data with you (Art. 20), and object to legitimate-interest processing (Art. 21). Any consent you give, you can withdraw with future effect.
How to do it:
- Delete: in the app, Cabinet → Delete account.
- Correct: edit your profile in the app.
- Export: your vocabulary exports as CSV, PDF, or Markdown right in the app. For a complete copy of your data, email hello@readinglobster.com; we answer within one month.
- Everything else: hello@readinglobster.com.
Right to object (Art. 21 GDPR): where we rely on legitimate interest (Section 4), you can object at any time, for reasons arising from your particular situation, by emailing hello@readinglobster.com. We then stop that processing unless we can demonstrate compelling legitimate grounds.
You can also complain to a supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit (datenschutz-berlin.de) or the authority where you live.
9. Security
Everything travels over TLS. Row-level security in the database keeps each account's data separate. Sign-in tokens live in the iOS Keychain. Connector tokens (OAuth and personal MCP tokens) are stored server-side only as SHA-256 hashes. You can revoke your personal connector URL in the app at any time. AI-provider keys never leave our server.
No system is perfectly secure. If a breach affects your data, we notify the supervisory authority and, where required, you, in line with Arts. 33 and 34 GDPR.
10. Children
Reading Lobster is for users 16 and older. We do not knowingly process data of children under 16. If you believe a child has created an account, contact us and we will delete it.
11. Changes
When the service or the law changes, we update this policy, publish the new version at readinglobster.com/privacy with a new effective date, and notify you in the app about material changes.
Version 0.6 (draft, 2026-07-22). Prior versions: none published.