Tibby app icon: a ginger tabby on a stack of booksTibbyFrançais

Tibby privacy policy

Updated October 10, 2026

Tibby is made by Appthalmology Inc. in Ottawa, Ontario, Canada. You can use the mobile app without a Tibby account. This policy covers the mobile app, including iOS 1.0.1. It does not describe the optional account and sync service planned for a later update. We will update this policy before that service starts.

What stays on your device

Your library, shelves, reading records, goals, notes, profile answers, and photos you add to your shelves are saved on your device. If you give your age range, it stays on your device too. It is used there to suit Tibby’s Picks to you. For ages 13 to 17, the Picks include more young-adult books and leave out books with explicit sex scenes or sexual violence. You can see or clear your age range in Settings → Your data. Tibby does not keep a copy of your library in an account. The widget and iOS share extension use storage shared with the app on the same device. Imported files are read on the device. Tibby sends book details from an import for catalogue matching, as explained below.

What leaves your device

  • Book facts. Our server looks up public facts about books, such as their series and reading order, from sources like Wikidata and Open Library, and through OpenRouter with Anthropic’s Claude AI model. It sends only a book’s title, authors and book numbers, never anything about you. The app requests facts by book ID. We keep anonymous counts of requests made when books are added, with no reader identifier, to decide which books to research. Your own edits stay on your device and are never added to the shared catalogue. If you report a mistake, your report uses Talk to us, described below.
  • Book lookup. Searches, ISBNs and barcodes, and book details used to match an import or a photographed book go to Tibby’s book server. It looks up editions through ISBNdb and may use Open Library. The app also requests covers and some book details directly from ISBNdb, Open Library, or the cover address supplied with a catalogue result. Those services see the book requested and the usual network information needed to answer the request.
  • App and purchase checks. Tibby’s book server runs on Cloudflare. To use it, the app confirms it is a genuine copy of Tibby: on iPhone and iPad with Apple’s App Attest and the app’s App Store record, and on Android with Google Play Integrity and a random installation ID. After a purchase, the app sends the server your App Store purchase record or Google Play purchase token, which the server confirms with Google Play. The server keeps a random app ID from these checks, never linked to your name or email, to apply Tibby’s usage limits and your plan.
  • Photo and voice recognition. If you choose this feature and agree on its consent sheet, your photo or recording goes to our book server. The server passes it through OpenRouter to Google’s Gemini model to read book titles. Our server does not store the photo or recording. Google says it can retain Gemini API prompts, context, and outputs for 55 days for abuse monitoring. Turning off Read photos and voice with AI in Settings → Your data stops future requests. Search, barcode scanning, and manual entry still work.
  • Plans and purchases. Apple handles App Store payments. Google handles Google Play payments on Android. We do not receive your card number. On iPhone and iPad, Superwall handles the purchase flow when configured and Share how you use Tibby is on. While that switch is on, it receives a random app identifier, your setup answers and progress except your age, plan views and outcomes, and plan and price details. We use those records to understand setup and plan performance. Superwall also infers an approximate location, such as your country, region, or city, from your IP address, for analytics. Superwall also receives identifiers provided by iOS and its SDK, app, operating system, SDK and build versions, the device model, language, region, currency, time zone and device settings such as appearance, text size and low-power state. It receives session and subscription state, configuration-fetch timing, retry and cache information, and technical errors. These records are used for analytics and to run and troubleshoot subscriptions. On Android, Tibby keeps its setup answers on the device and uses Google Play Billing. Google Play sends Superwall a notice of each subscription purchase, renewal and cancellation, and Superwall reads that subscription’s plan, price and country or region from Google Play, so we can see our sales. These records don’t include your name or email.
  • Usage analytics on iPhone and iPad. When Share How You Use Tibby is on, Tibby uses PostHog’s US Cloud service to understand how people use the app. Sharing is on by default and can be turned off in Settings → Your Data. In App Store and TestFlight builds, we send onboarding screen numbers and names, fixed-choice onboarding answers except age, the number of books added and how they were added, paywall views, subscription attempts, completed purchases and restores, and reading-session minutes and page counts. We also send the subscription plan, price and currency, app version and build, and a random identifier shared with Superwall. This identifier does not contain your name or contact details. We never send PostHog book titles, your name or any text you type. We do not enable automatic interaction capture, session replay, surveys or feature flags, and we do not collect an advertising identifier for this analytics. These records are used for analytics, not to track you across other companies’ apps or websites. Turning sharing off stops new PostHog records and requests and discards records still waiting to be sent; it does not delete records already received by PostHog. Turning it back on resumes recording from that point. Network requests reach PostHog’s servers in the United States.
  • Hardcover on iPhone and iPad. If you connect Hardcover, Tibby signs in with Hardcover and reads your Hardcover library for the import you request. The sign-in tokens stay in the device Keychain. Tibby does not send them to its book server. This option appears only when the Hardcover connection is configured.
  • Barcode scanning on Android. Google’s ML Kit reads the camera image on the device. Google says the SDK sends device and app information, an app-install identifier, performance and use metrics, and error information for diagnostics and analytics. It does not send the camera image or decoded barcode to Google. Tibby sends the ISBN to its book server when you look it up.
  • App measurement. iOS sends setup and purchase conversion values through Apple’s AdAttributionKit when applicable. The first release has no Meta or TikTok SDK and does not ask to track you across apps. We do not sell your data or use it for cross-app ad tracking in this release. If you install Tibby after tapping one of our ads in App Store search results while Share how you use Tibby is on, Apple may tell Superwall which of our ad campaigns and search keywords led to the install. Apple shares only these ad details, without an advertising identifier, and we use them only to measure our own ads.
  • When you contact us or share. The app’s support email draft includes the app version, operating system version, and device model. Your email app sends what you choose to write to us. If you share a shelf or reading image, the app you choose to share it with receives that image. Tibby does not post it for you.
  • Talk to us. Message text, optional reply email and a spine request’s title and ISBN go to our server, linked to a random install ID, to answer you and improve Tibby.
  • What stopped you? After you first close the plans screen, your chosen “What stopped you?” answer goes to PostHog and Superwall, while sharing is on, to improve plans.

These outside services may process requests outside Canada.

How long we keep it

Talk to us. Messages are kept; email is deleted when marked replied or after 180 days from receipt, whichever comes first.

Other server records

Tibby’s server keeps only what it needs to run and to apply its usage limits. None of it is linked to your name or email.

  • Sessions that prove the app is genuine, and your IP address: up to 20 minutes.
  • Daily and monthly usage counts: up to about a month.
  • A photo’s or voice note’s reading: up to 1 hour.
  • The app’s security key, on iPhone and iPad: up to 400 days after its last use.
  • Book lookups: we keep book data and covers in a lasting catalogue, and search text, counts, dates and whether anything was found in a lasting search log. Both are linked to no one. Book data refreshes on lookup after 24 hours; “not found” answers last 1 hour. We delete a source’s data when we stop using it, ISBNdb data within 30 days of cancellation, and covers within 14 days of a removal notice.
  • Photos, voice recordings, and request logs: not stored by us.

Superwall does not publish a fixed number of days for keeping end-user records. Its Data Processing Addendum says personal data is kept until our agreement with Superwall ends or expires. When that agreement ends, we have 30 days to request return or secure deletion of the data, subject to Superwall’s standard backup and archival practices.

Usage records already received by PostHog are not deleted when you turn sharing off or erase local Tibby data. To request deletion of these records, write to hello@tibbyreads.com.

Your choices, copies, and deletion

On iPhone and iPad, Share How You Use Tibby is on by default. Tibby sends setup and usage records to Superwall, our subscription partner, and PostHog, our analytics partner; PostHog also receives the reading-session minutes and page counts described above. You can turn this off in Settings → Your Data → Share How You Use Tibby. When it is off, Tibby stops recording and sending new usage records to these partners, and records not yet sent are deleted from your device. Records already sent stay with the partners; write to hello@tibbyreads.com to ask us to have them removed. Turning sharing back on resumes recording from that point. Purchases work either way.

Your device keeps its Tibby data until you delete it or remove the app. In Settings → Export and backup, you can save a copy of your library and shelves, including your own photos. Tibby does not encrypt or upload that ZIP file. Keep it somewhere private. You choose where to save it; a cloud drive or device backup you use may keep its own copy. Android also permits system backup. Deleting Tibby data does not remove a backup you saved elsewhere.

Use Settings → Your data → Delete all my data to erase Tibby’s local library and settings. This does not cancel a subscription or remove information already sent to Superwall, PostHog, Google, Apple, Hardcover, or a book service. To ask us about data held by us, Superwall or PostHog, write to hello@tibbyreads.com. For Superwall records, we will pass your deletion request to compliance@superwall.com, following its deletion request instructions. With no Tibby account, we may need details that let us find a record, and some catalogue requests may not be identifiable as yours. You can also manage a purchase with Apple or Google and a Hardcover account with Hardcover.

Your privacy rights

You can ask what personal data we hold, request a copy, correct it, or ask us to delete it. You can withdraw permission for optional photo and voice requests, and clear your age range, in Your data. Where the law gives you more rights, including under Canada’s PIPEDA, Quebec’s private-sector privacy law, the EU and UK GDPR, and California law, you can also ask us to restrict or object to a use, or receive portable data. California residents may ask about sale or sharing for advertising; we do neither in this release. We will verify a request only as far as needed and explain if we cannot find the data or must keep something by law. Write to the address below.

Younger readers

Tibby is for readers aged 13 and up. We do not knowingly collect personal information from children under 13. If you are younger than the age at which the law where you live lets you agree to online services on your own (16 in some EU countries), ask a parent or guardian before using features that send information, such as photo and voice recognition. Your age range stays on your device.

Where the law requires it, currently for new Apple Accounts in some U.S. states, Tibby asks Apple for your age range once on iPhone and iPad. The range stays on your device and is never sent to us or our partners. Tibby uses it only to keep books tagged as mature out of Picks for readers under 18 and, where required, to ask a parent’s permission for significant updates.

Changes and contact

We will date changes to this policy and explain material changes in the app or on the policy page. We will update it before adding accounts or sync. For privacy questions or requests, email hello@tibbyreads.com. The company responsible is Appthalmology Inc., Ottawa, Ontario, Canada.