Privacy Policy
Effective August 10, 2026
The short version
GemReader collects nothing. No accounts. No cloud. No analytics. No crash reports. No telemetry. Your books, highlights, notes, and reading habits stay on your device, encrypted, and are never transmitted anywhere. The app reaches the network only when you ask it to — to browse the built-in book catalog, to fetch a file you asked it to download, or to open a page in the in-app browser — never to report on you.
Data collection
We collect no personal data. GemReader does not require account registration, and there is no GemReader server for it to send data to. The app contains no analytics SDKs, no crash reporting libraries, and no telemetry of any kind.
The website
This policy covers both the GemReader app and gemreader.com. The app collects nothing. The website is hosted on Vercel and uses Vercel Web Analytics, which counts page views without cookies and without building a cross-site profile of you. We also keep one aggregate counter of how many times the APK download link has been used — a single number, with nothing attached to it. Neither touches the app, your library, or anything inside it.
Downloading the app
The Download APK button redirects to a release asset on the public GitHub repository cnohall/gem-reader-releases. GitHub serves the file, and like any web server it sees your IP address and browser user agent for that request — that is GitHub's log under GitHub's privacy statement, not ours. Installing from Google Play instead puts that transaction under Google's terms.
Book storage and encryption
Every book you import — EPUB, PDF or otherwise — is encrypted at rest using AES-256 GCM before being written to your device's storage. Decryption happens in memory only — plaintext never touches your file system. Encryption keys are derived locally and never transmitted.
PIN-locked folders
PIN-protected folder keys are derived from your PIN using PBKDF2. The derived key is not stored in recoverable form. After 3 failed PIN attempts, the folder's encrypted files are permanently deleted and the keys are destroyed. There is no recovery mechanism — this is by design.
Screenshot and clipboard protection
When a locked folder is open, GemReader programmatically blocks the OS screenshot API and suppresses your content from appearing in the recent apps switcher. If you background the app while in a secure folder, the clipboard is wiped automatically.
The in-app book catalog
GemReader can browse and search catalogs of freely available books — Project Gutenberg, Standard Ebooks and Wolne Lektury are included, and you can add any HTTPS catalog you trust. When you open the catalog, search it, or download a book, your device talks directly to that site. Like any web server it sees your IP address and user agent for those requests, and that is logged under its privacy policy, not ours. Nothing about you or your library is attached: no account, no device identifier, no list of what you already have. There is no GemReader server in between — we never see that you opened the catalog, what you searched for, or what you downloaded. Books you download are encrypted on arrival exactly like the ones you import yourself. Ignore the catalog entirely and the app never contacts these sites.
Third-party services
No SDK from any external company is compiled into the app — no advertising networks, no analytics providers, no data brokers. The only outside servers the app ever contacts are the ones you point it at yourself: a book catalog, a Gem List download, or a page you open in the in-app browser. The website is a different matter and is covered above: Vercel hosts it, GitHub hosts the APK, and Google Play distributes the store build.
Children's privacy
GemReader does not collect data from anyone, including children under 13. No personal information is gathered at any point.
Changes to this policy
If this policy changes materially, the updated version will be posted here with a new effective date. Since we collect no data, changes are unlikely to affect you in any practical way.
Permissions
File storage: used solely to read and write the books you import — no file content is transmitted outside your device. Network access: used only when you explicitly reach for it — browsing or downloading from the in-app book catalog, downloading a book listed in a Gem List, or opening the in-app browser; the app never contacts a GemReader server, because there isn't one. Camera (optional): used only when you choose to scan a QR code — the feed is processed locally in real time and is never recorded, saved, or transmitted. Biometrics (optional): used only for app lock, and verified by Android on-device. Notifications (optional): used only to display playback controls while a book is being read aloud. The Android permission list also shows RECORD_AUDIO, which is declared by the audio-playback and QR-scanning libraries GemReader depends on; the app contains no recording code and will never prompt you for microphone access.
Data deletion
All data stored by GemReader — encrypted books, annotations, reading progress, and encryption keys — resides exclusively on your device. Uninstalling the app permanently removes all of this data. There is no server-side data to delete.
Contact
Questions about this policy? Reach us at support@gemreader.com.