BookichPrivacy Policy
Reading Diary — Bookich · Last updated 14 October 2026
Summary. The app stores the diary on your device. It has no accounts, no sign-in and no synchronisation.
Diary data leaves the device only when you request book recommendations. It is sent for that request without your name or contact details and is not stored by us.
The app contains no advertising, analytics, tracking or cookies. We do not sell or rent personal data.
1. Controller
The controller of the personal data described in this policy, within the meaning of the General Data Protection Regulation (GDPR), is the developer of the app (referred to below as “we”):
- a private individual resident in Poland, publishing on Google Play under the developer name Diuna Labs;
- contact: [email protected].
The controller's full legal name and country are published by Google in the developer information on the app's Google Play listing and are also provided on request. The full postal address is provided on request, including to a data protection supervisory authority. The competent supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), Warsaw, Poland.
This policy applies to the Android application Reading Diary — Bookich, published on Google Play by Diuna Labs (referred to below as “the app”).
An earlier web version of the app at book-cemetery.pages.dev has been closed.
Data it saved remains in the browser's storage for that address, to which we have no access. It
is removed by clearing the site data for that address in the browser settings.
2. Data stored on your device
Data you enter is stored in the app's own storage on your device. It is not transmitted automatically, and we have no access to it. It comprises:
- Diary — for each book: title, author, genre, rating, status (reading, finished or abandoned), date of reading, notes, and the address of the cover image, if one was found;
- Saved list — books you intend to read;
- Hidden suggestions — recommendations you dismissed, kept so that they are not offered again;
- Settings — display name, colour theme, language, yearly reading goal, reminder settings (which reminders are on, and their days and time), the date of the last export, and the date you agreed to send the diary for recommendations.
The app uses no cookies. The display name is not transmitted; it is used only on the device.
3. Data not collected
The app does not request, collect or transmit your name, email address, contacts, location, photos, phone number, advertising identifier or usage statistics. It contains no analytics tools and no crash reporting other than that performed by Google Play itself (section 6).
4. Data transmitted from your device
4.1 Recommendation requests
A request is sent only when you request recommendations. It contains:
- the diary: title, author, genre, rating, status and notes of each book;
- the titles and authors of books to be excluded: saved, hidden, currently being read, or just shown;
- the text of your wish, if entered;
- the interface language;
- the device identifier described in section 4.4;
- a Google Play verification token, described in section 4.4;
- if you have a subscription, the subscription identifier described in section 4.6;
- your IP address, which is visible to every server the device connects to.
The request is sent to our endpoint, hosted on Cloudflare Pages, which adds the API key and forwards it to Google's Gemini service. The response is returned by the same route. We do not store the diary.
Notes are part of the request. The request includes the notes of every book, because recommendations are based on them. A recommendation cannot be requested without them.
A reading history may by itself reveal a person's beliefs, health, political opinions or sexual orientation, regardless of the notes. If you do not wish such information to be sent, do not enter it in your notes, or do not use Recommendations. All other features of the app work without an internet connection.
4.2 Processing by Google
Recommendations are generated by the Gemini API, operated by Google. As the developer is established in the European Economic Area, Google applies the data terms of its paid service to every request sent by the app, whether or not the request is billed. Under those terms Google does not use the content of requests or responses to improve its products or train its models. Google processes that content on our behalf as a data processor under its “Data Processing Addendum for Products Where Google is a Data Processor”, and keeps a log of requests and responses for a limited period, solely to detect and prevent violations of its Prohibited Use Policy and for legally required disclosures. The applicable terms are published by Google as the “Gemini API Additional Terms of Service”.
Only the data listed in section 4.1 is sent to the Gemini API, and only when recommendations are requested. The diary, statistics, saved list, reminders, export and import do not use it.
4.3 Book search and cover images
Text typed into the book search field is sent to openlibrary.org to suggest
titles, authors and covers; cover images are loaded from covers.openlibrary.org.
Open Library is operated by the Internet Archive, a non-profit organisation based in the United
States. These requests go directly from your device to that service, which receives your IP
address and the search text. We do not control that service and receive no data from it.
Search is optional; a title and author can be entered manually.
The same service is queried for covers in two further cases, using the title and author of a book rather than typed text: after a backup is restored, once for each book in the diary and saved list that has no cover, as a backup file contains no cover images; and for each book in a set of recommendations. In both cases Open Library receives those titles and authors together with your IP address.
4.4 Request limit and device verification
The number of free recommendation requests per device is limited. To distinguish devices, each request includes the identifier that Android assigns to the app (ANDROID_ID). Android stores this value outside the app's storage, so it does not change when the app is reinstalled or its data is cleared. It is not the advertising identifier.
Each request also includes a verification token from Google Play. Before sending a request, the app asks Google Play's integrity service to confirm that the app was installed from Google Play and has not been modified, and that the device runs its manufacturer's unmodified system. The resulting token can be read only by Google and contains a one-way hash of the identifier, so it cannot be used with any other identifier. Our endpoint sends the token to Google to obtain the verdict, refuses the request if the verdict is negative, and retains nothing from the token. On a device that fails this check — for example a rooted device, a device with an unlocked bootloader or a modified system, or an emulator — recommendations are not available; the other features work as usual. Data gathered by Google Play to produce the verdict is processed by Google on its own account and is governed by Google's privacy policy.
Our endpoint does not store the identifier. It computes a keyed hash of it — a value derived with a secret key held only by the endpoint, which cannot be reversed into the identifier or matched against it by anyone else — and keeps one record under that hash in Cloudflare's D1 database. The record contains only the date of the device's first recommendation request and the number of requests in the current period; it contains no titles, notes or names.
The record is deleted automatically no later than one year after the device's last recommendation request; each new request moves that date forward. It is used for no other purpose. Apart from reports you send (section 4.5) and, if you have a subscription, the record described in section 4.6, it is the only data relating to you held on any server we operate.
When a request fails, our endpoint writes a technical error entry to Cloudflare's logs for fault diagnosis. These entries describe the nature of the failure and are retained in accordance with Cloudflare's retention periods.
4.5 Reports about recommendations
Each suggested book has a button for reporting it as offensive or inappropriate. When it is pressed, and only then, the app sends that card to our endpoint: the title, the author and the three texts on the card (why it was suggested, what it is about, and the review). The endpoint stores the report in Cloudflare's D1 database with the time of receipt, for the purpose of reviewing it and improving recommendations.
A report contains no device identifier, diary, notes or name, and your IP address is not stored with it. The “why” text, however, is written about you and may refer to books in your diary and their ratings. Reports are deleted automatically after 90 days.
4.6 Subscription
Where the app offers a paid subscription, it is bought and paid for through Google Play. Payment details are handled by Google and do not reach us.
To show the subscription offer and to know whether a subscription is active, the app uses RevenueCat, a service that manages subscriptions on our behalf. The app sends RevenueCat an identifier generated at random by the app, which is not linked to your name or account, the interface locale and currency, and, once you buy a subscription, the purchase records Google Play provides for it. RevenueCat also receives your IP address, as every server the device connects to does.
A recommendation request from a subscriber also includes that identifier. Our endpoint uses it to ask RevenueCat whether the subscription is active, and keeps in Cloudflare's D1 database one record for each month of the paid period: RevenueCat's identifier of the subscription and the number of requests made in that month. The record contains no titles, notes or names and is deleted automatically when that month ends.
5. Legal bases
Each purpose of processing relies on a legal basis under Article 6 of the GDPR:
| Purpose | Legal basis |
|---|---|
| Storing the diary, settings and lists on your device so that the app works | Performance of a contract — Article 6(1)(b). |
| Sending the diary and notes to the Gemini API to generate recommendations | Explicit consent — Article 6(1)(a) and, as a reading history and notes may reveal special categories of data, Article 9(2)(a). Consent is given in the app before the first recommendation request, after the data sent is described. It can be withdrawn at any time in Settings; withdrawal does not affect the lawfulness of earlier processing. |
| Searching Open Library and loading cover images | Performance of a contract — Article 6(1)(b); the request is made because you search for a book. |
| The request limit, the device identifier it is kept under, and the Google Play check of each request | Legitimate interests — Article 6(1)(f): preventing abuse of a free service and keeping its costs bounded. The data is limited to a keyed hash, a date and a count, and is deleted no later than one year after the device's last request. |
| Selling and checking a subscription, and counting the requests it includes | Performance of a contract — Article 6(1)(b). Showing the offer before a purchase relies on legitimate interests — Article 6(1)(f): offering the subscription, with only a random identifier, the locale and the currency sent. |
| Storing a reported recommendation | Legitimate interests — Article 6(1)(f): reviewing reported content in order to prevent offensive recommendations. A report is sent only when you press the button, contains only the card, and is deleted after 90 days. |
6. Recipients
| Recipient | Data | Purpose |
|---|---|---|
| Cloudflare, Inc. (USA) | The recommendation request in transit, your IP address, the request counter, and reports | Hosting of this policy and of the endpoint that forwards recommendation requests |
| Google LLC (USA) | The content of the recommendation request listed in section 4.1 | Generation of recommendations through the Gemini API, as our data processor |
| Internet Archive (USA) | Search text, the titles and authors of books for which a cover is requested, and your IP address | Operation of Open Library, which supplies book data and cover images |
| RevenueCat, Inc. (USA) | The random identifier, the interface locale and currency, the purchase records of a subscription, and your IP address (section 4.6) | Managing subscriptions on our behalf, as our data processor |
| Google Ireland Ltd. / Google LLC | Data collected by Google Play when an app is installed and run from its store, the purchase and payment of a subscription (section 4.6), and the verification token of each recommendation request (section 4.4) | Distribution of the app, payment for a subscription, and confirmation for each recommendation request that it comes from the unmodified app on an unmodified device. Distribution and payment are Google's own processing, governed by Google's privacy policy. |
Personal data is not disclosed to any other recipient. It is not sold, rented, shared for advertising or disclosed to data brokers. The app contains no advertising networks, analytics providers or tracking services.
7. Transfers outside the European Economic Area
The service providers listed in section 6 are established in the United States; the data described in sections 4.1 to 4.6 is therefore transferred outside the EEA. These transfers rely on the safeguards the providers apply under Chapter V of the GDPR — the EU–U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses — as set out in each provider's data processing terms.
8. Retention
- Data on your device — until you delete it (section 10).
- The request counter — deleted automatically no later than one year after the device's last recommendation request.
- Reports about recommendations — deleted automatically after 90 days.
- The subscription record — deleted automatically at the end of each month of the paid period.
- Purchase records held by RevenueCat — for as long as they are needed to manage the subscription and for the period the law requires for accounting.
- The content of recommendation requests — not stored by us. Google keeps it in its abuse-monitoring log for a limited period set by its terms, which do not specify a number of days (section 4.2).
- Technical error logs — in accordance with Cloudflare's retention periods.
We hold no other copy of data entered in the app and cannot restore it if the device is lost. The export function is described in section 12.
9. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, objection and data portability, the right to withdraw consent, and the right to lodge a complaint with a supervisory authority (section 20).
As the data is stored on your device rather than on our servers, most of these rights are exercised directly in the app:
- Access — all data held by the app is displayed in the app.
- Portability — “Export diary” in the profile writes the complete diary to a JSON file, a structured, machine-readable format.
- Rectification — any entry can be edited or deleted at any time.
- Erasure — section 10.
- Withdrawal of consent — in Settings; after that no recommendation request is sent until consent is given again.
Other requests may be sent to the address in section 1. We cannot identify a person from a device identifier and cannot access, retrieve or delete data stored on a device.
10. Erasure
In short: everything you entered in the app is erased by “Erase all data”, and no request to us is needed for that. What is kept elsewhere is deleted automatically, as described below; a report and the purchase records of a subscription can also be deleted earlier on request. You may still write to us about any of this (section 20).
“Erase all data” in the profile permanently deletes the diary, the saved list, the hidden suggestions and the settings from the device. The deletion cannot be undone; no copy exists from which we could restore the data.
The device identifier (section 4.4) is stored by Android, not by the app, and is not changed by “Erase all data”, by clearing the app's storage in the Android settings, or by uninstalling the app. On our side, only the record under its keyed hash exists (section 4.4); it is deleted automatically no later than one year after the device's last recommendation request. As we keep only the hash and not the identifier, we cannot determine which record relates to you, nor find it by email address.
A report (section 4.5) contains nothing linking it to you or your device and therefore cannot be found by its sender; it is deleted automatically after 90 days. Earlier deletion may be requested by writing to us with the title of the reported book and the approximate date of the report.
Subscription data (section 4.6) is not removed by “Erase all data”. The monthly record on our side is deleted automatically when its month ends. Deletion of the purchase records held by RevenueCat may be requested by writing to us with the order number from the Google Play receipt, as we hold no name or email address to find them by; records the law requires for accounting are kept for the required period.
11. Android system backup
Android may include app data in the backup of your Google account. If that backup is enabled, the diary may be copied to your own Google account. The backup is performed by the operating system, not by the app; we neither perform it nor have access to it.
As the diary contains notes, the app permits this cloud backup only where Android can encrypt it end-to-end, which requires a screen lock on the device. Without a screen lock, Android does not perform the cloud backup. Direct device-to-device transfer, which does not pass through a server, is not affected. The backup can be disabled in the Android settings.
12. Export
“Export diary” creates a file containing the complete diary, including notes in plain text, and passes it to the device's standard sharing dialog. Where the file is sent is your choice; once it leaves the app, it is subject to the privacy practices of the service it is sent to.
13. Import through an external AI service
The app can help transfer an existing reading list into the diary by providing a text to be copied, together with the list, into an AI chat service of your choice; the answer is then pasted back into the app.
This step takes place outside the app. We send nothing, do not select the service and have no access to what is entered in it. Data entered in that service is governed by that service's privacy policy.
14. Reminders
Reminders, if enabled, are scheduled through the device's notification system. They are created and stored on the device, and no data is transmitted to produce them. A reminder may contain the title of the book currently being read and may therefore be visible on the lock screen. Reminders are off by default and can be disabled in Settings.
15. Children
The app is not directed at children and is not intended for persons under the age of 16. We do not knowingly process data of children under 16. Concerns about use of the app by a child may be sent to the address in section 1; as such data is not stored on our servers, deletion is performed on the device.
16. Security
All network requests made by the app use encrypted HTTPS connections. The API key for the Gemini service is held only on the server and is not included in the app. Apart from the request counter (section 4.4), reports (section 4.5) and the subscription record (section 4.6), we hold no server-side records relating to users.
The security of data on the device depends on the device and its settings. A screen lock also enables encrypted backups (section 11).
17. Territorial scope
The app is published through Google Play only in the countries selected in its Google Play listing and is directed at users in those countries only. That list is maintained in the Google Play Console and may change. The availability of an interface language does not by itself constitute an offering directed at any particular country.
18. Notice for residents of California
We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act, and have not done so in the past. The categories of information, the purposes and the recipients are set out in sections 2, 4 and 6.
19. Changes to this policy
Changes to this policy are indicated by the date at the top of this page. A change that materially affects the processing of your data — a new recipient, a new category of data transmitted from the device, or a new purpose — is announced in the app before it takes effect.
20. Contact and complaints
Questions about this policy and requests to exercise the rights in section 9 may be sent to [email protected]. We respond without undue delay and in any event within one month of receipt, in accordance with Article 12(3) of the GDPR.
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA member state of your habitual residence, your place of work or the place of the alleged infringement (Article 77 of the GDPR).