Legal
Privacy Policy
Last updated: 11 October 2026
This policy explains what data the WordReader app (iOS, iPadOS and Android) and this website collect, why, who we share it with, and the choices you have. WordReader is published by Ulaş Sancak ("we", "us"), who is the data controller. Contact: admin.wordreader@roxyapps.net.
1. Data we collect
- Account data. If you create an account: your email address, or the name, email and profile picture that Apple or Google share when you sign in with them. If you start without an account, we create an anonymous account with a random identifier.
- Reading data. The sources you follow, the WordPress sites you add, your current source and the articles you save. We store these on your account so they sync between devices.
- Usage data. Firebase Analytics records screens you view and actions such as signing in, following a source, saving an article and searching (including the search term), together with device model, operating system, app version, approximate location derived from your IP address and an app instance identifier.
- Crash data. Firebase Crashlytics collects crash reports (device state, stack trace, app version) to fix bugs.
- Notification data. If you allow notifications, Firebase Cloud Messaging gives your device a push token, and we store the notification channels you subscribe to.
- Advertising data. If you do not have Pro, Google AdMob shows ads and may collect your IP address, device information, ad interactions and your device's advertising identifier. On iOS the advertising identifier (IDFA) is only used if you allow tracking in Apple's App Tracking Transparency prompt. On Android in the EEA, the UK and Switzerland, Google's consent form asks for your choice before ads are personalized.
- Purchase data. If you subscribe to Pro, RevenueCat receives your purchase receipts from Apple or Google, linked to your account identifier, to unlock Pro on your devices. Payments are handled by Apple or Google; we never see your card details.
- Support emails. If you email us, we keep the message and your email address to answer you.
2. Content from WordPress sites
WordReader loads posts, images and categories directly from the public WordPress REST API of the sites you read. Those sites therefore receive your IP address and device information like any website visit, under their own privacy policies. When you open an article in the browser or share it, the browser or the app you share to applies its own policy.
3. How we use data, and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide your account, sources, saved articles and sync | Contract |
| Provide and restore Pro subscriptions | Contract |
| Send notifications you asked for | Consent (device permission, which you can withdraw in system settings) |
| Understand usage and fix crashes | Legitimate interest in a working, improving app |
| Show ads to users without Pro | Legitimate interest for non-personalized ads; consent for personalized ads and tracking |
| Answer support requests, keep records required by law | Legitimate interest; legal obligation |
We do not make decisions about you based solely on automated processing.
4. Service providers
We share data only with these providers, who process it to run the service:
| Service | What it does | Policy |
|---|---|---|
| Supabase | Account sign-in, database for sources and saved articles | supabase.com/privacy |
| Google Firebase (Analytics, Crashlytics, Cloud Messaging) | Usage statistics, crash reports, push notifications | firebase.google.com/support/privacy |
| Google AdMob and User Messaging Platform | Ads for users without Pro, ad consent | policies.google.com/privacy |
| Google Sign-In, Sign in with Apple | Optional sign-in | Google, Apple |
| RevenueCat | Subscription status and purchase history | revenuecat.com/privacy |
| Apple App Store, Google Play | App download, payment and billing | Apple, Google |
We may also disclose data if the law requires it, to protect rights and safety, or as part of a sale or transfer of the app, in which case this policy continues to apply.
5. Selling and sharing
We do not sell your personal data for money. Personalized ads from Google AdMob may count as "sharing" for cross-context behavioral advertising under California law. You can stop it by declining tracking (iOS), deleting or resetting your advertising ID (Android), choosing non-personalized ads in the consent form, or subscribing to Pro, which removes ads.
6. International transfers
Our providers process data on servers outside your country, including in the European Union and the United States. Where the law requires it, transfers rely on adequacy decisions, the European Commission's Standard Contractual Clauses or equivalent safeguards offered by the providers.
7. How long we keep data
- Account and reading data: while your account exists. When you delete your account it is removed from our database within 30 days.
- Analytics and crash data: kept by Google under the retention settings of our Firebase project, then deleted.
- Purchase records: kept by RevenueCat, Apple and Google as long as tax and accounting law requires.
8. Deleting your account
Delete your account in the app under Settings → Delete account. If you signed in with email you can also use the account deletion page. Or email admin.wordreader@roxyapps.net from the address on your account. Deleting your account does not cancel a subscription; cancel it in your App Store or Google Play account settings.
9. Your rights
Depending on where you live (for example under the GDPR, the UK GDPR, California law or Türkiye's PDPL), you can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent at any time. You also have the right to complain to your data protection authority. We will not treat you differently for using these rights. Email admin.wordreader@roxyapps.net; we answer within 30 days. Users in Türkiye can also read our PDPL Information Notice.
You can also act directly: change notification and tracking permissions in your device settings, reopen ad privacy choices in the app where shown (Android), and edit or delete your account in the app.
10. Children
WordReader is not directed at children under 13 (or the minimum age in your country) and we do not knowingly collect their data. If you believe a child has given us data, email us and we will delete it.
11. Security
Data travels over encrypted connections (HTTPS). Account data is protected by access rules in our database, and sign-in tokens are kept in the iOS Keychain or Android's private app storage. No system is perfectly secure; if a breach affects your data we will notify the authorities and you as the law requires.
12. This website
wordreader.roxyapps.net uses no cookies, no analytics and no ads. It stores your language choice in your browser's local storage. The site is hosted on GitHub Pages, which logs visitor IP addresses for security (GitHub Privacy Statement). The account deletion page sends your email and password only to our Supabase sign-in service.
13. Changes
We will post changes on this page and update the date above. If a change is significant, we will tell you in the app.
14. Contact
Ulaş Sancak, WordReader. Email: admin.wordreader@roxyapps.net