Log InGet Booklet free

Privacy Policy

Last updated: September 19, 2026

Booklet is a language-learning app: you read books in a foreign language, and the words you look up become flashcards and exercises. This policy explains what we collect while you do that, why, who else sees it, and what you can ask us to do with it.

Booklet App ("we", "us") is based in Italy and is the data controller for the information described here. European data protection law (the GDPR) applies to it.

The short version

  • We collect what the app needs to work: your account, your learning settings, what you have read, the words you looked up and how you answered the exercises.
  • Books you upload are yours. They are visible only to your account, never to other readers.
  • Text you look up is sent to Google so it can be translated, read aloud or turned into an exercise.
  • We do not sell your data and we do not run advertising.
  • You can ask us for a copy of your data, or for its deletion, by emailing the address at the bottom of this page.

What We Collect

What you give us

  • Account details: your email address, a username, and a password. The password is stored only as a hash by our authentication provider — we never see it.
  • Learning settings: the language you are reading, the language you translate into, your level, your review mode and your theme.
  • Books you add: the file you upload, its text, its title and author, and any cover image you choose for it.
  • What you do while learning: the words you look up, the translations you keep or reject, your answers to exercises, which chapters you have finished, your reading streak and when you last opened a book.
  • Anything you write to us: feedback left in the app and messages you send us by email.

What is collected automatically

  • Technical data: your IP address, browser and version, device type, operating system and the pages you opened, with the date and time.
  • Error reports: when something breaks, we record what failed, where, and the account id it happened to — not your name or your email.
  • Session recordings: an error report links to a replay of the session that produced it, so we can see what went wrong. Everything you type is masked, and so is the text of the book you are reading: the replay shows the shape of the page, not its content.

Cookies and local storage

We use a cookie to keep you signed in, and browser storage to remember your settings and to tie an error report to the session it came from. We set no advertising or cross-site tracking cookies.

Why We Use It

  • To give you the service you signed up for — your library, your translations, your flashcards and your progress. Without this data there is no app, so the legal basis is the contract between us.
  • To keep it working and secure — diagnosing failures, preventing abuse, and understanding which parts of the app break. The legal basis is our legitimate interest in a service that works.
  • To improve it — reading the feedback you send and the aggregate picture of which features are used. Again, legitimate interest.
  • To contact you about your account, a security issue or a change to this policy. We do not send marketing email, and if we ever do it will be because you asked for it, and you will be able to stop it in one click.
  • To comply with the law, where we are required to keep or disclose something.

Translation, Speech and AI

When you look up a word, ask for a sentence to be read aloud, or work through an exercise, the text involved — the word, its sentence, and sometimes the answer you wrote — is sent to Google's translation, text-to-speech and generative AI services so that it can be processed. Only the text needed for that request is sent; your name, your email and your account id are not.

We do not use your content to train models of our own, and we do not sell it to anyone.

Who Else Sees It

We keep the list of companies that process your data on our behalf short, and each one receives only what its job requires:

  • Supabase — accounts, sign-in, and the database holding your library and your progress.
  • Cloudflare — hosting, and storage for book covers.
  • Google — translation, text-to-speech, generative AI, and the language analysis that turns a word into a flashcard.
  • PostHog — error reports and the session replays attached to them, on its European servers.
  • Better Stack — server logs and traces.

Beyond that, we disclose personal data only when the law requires it, when it is necessary to protect our rights or someone's safety, or with your consent. If Booklet is ever sold or merged, your data would transfer with it, and we would tell you before it became subject to a different policy.

Where It Is Stored

Our providers operate globally, so your data may be processed outside the European Economic Area — in particular in the United States. Where that happens, the transfer is covered by the European Commission's standard contractual clauses or an equivalent safeguard in our agreement with the provider.

How Long We Keep It

Your account and everything attached to it — your library, your words, your progress — is kept for as long as the account exists, because that is what the app is for. Ask us to delete the account and it goes, bar anything we are legally required to retain.

Session recordings are deleted after 30 days. Logs and error reports are kept for a short period, for diagnosis. Translations and dictionary results are cached without being tied to you, so they survive deletion in a form that identifies nobody.

Your Rights

Under the GDPR you can ask us to:

  • give you a copy of the personal data we hold about you;
  • correct it, if it is wrong;
  • delete it, along with your account;
  • export it in a portable format, or restrict or object to how we use it;
  • withdraw a consent you have given, at any time.

Some of this you can do yourself: your settings are editable in the app at any time. For the rest, email us at the address below and we will answer within one month. If you think we have got it wrong, you can complain to your local data protection authority — in Italy, the Garante per la protezione dei dati personali.

Security

Connections are encrypted, passwords are hashed by our authentication provider, and access to the database is limited to what the service needs. No method of transmission or storage is completely secure, though, so we cannot promise absolute security.

Children

Booklet is not directed at children under 14, and we do not knowingly collect their personal data. If you are a parent or guardian and believe your child has given us theirs, contact us and we will remove it.

Links to Other Websites

The app may link to sites we do not run. We have no control over them and take no responsibility for what they do with your data — their own privacy policy governs your visit.

Changes to this Privacy Policy

We may update this policy. The new version is posted on this page with a new "Last updated" date, and if the change is significant we will tell you by email or in the app before it takes effect.

Contact Us

Questions about this policy, or a request about your data? Email e.courthoud@gmail.com.