Privacy Policy
The short version. Tesoroteca keeps your reading life, and that's all it keeps. We collect only what's needed to sign you in and sync your books between your devices. There are no ads, no analytics, and no tracking, and we never sell or share your data with advertisers or data brokers. You can delete your account and everything in it from inside the app at any time.
This policy covers the Tesoroteca iPhone app and this website. It's provided by Chico Automation & Software Technologies LLC ("we" or "us").
What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Your name and email address | Sign in with Apple shares these when you first sign in, if you choose to. The email may be an Apple private relay address. A few accounts we set up by hand (for example, for App Review) sign in with an email address and password instead; Firebase stores the password securely, and we never see it. | To identify your account and show it in Settings |
| Account ID | Created when you sign in | To keep your data separate from everyone else's |
| Device ID | A random identifier the app creates on each device. It isn't your phone's advertising identifier or serial number. | To sync changes between your devices |
| Your library | What you add in the app: books (title, authors, ISBN, cover link, page count, publication date), reading status, owned and format, dates added, started, and finished, ratings, notes, and your to-be-read order | To back up your library and sync it to your other devices |
| Book searches | The text or ISBN you search for, or scan | To find the book you're looking for |
Our servers also keep standard request logs, which include your IP address, the page or feature requested, and the time. We use them only to keep the service running and secure. They're deleted automatically after about 30 days.
What stays on your device
- Camera. When you scan a barcode, the camera image is read on your iPhone. It's never saved or sent anywhere. Only the ISBN it finds is used to look up the book.
- Reading stats. Stats are calculated on your device from your library.
Who else handles your data
We use a few service providers. They process data only to run Tesoroteca for us:
- Apple handles Sign in with Apple.
- Google Cloud and Firebase host our servers, handle authentication, and store your synced library in the United States.
- Google Books and Open Library supply book details. Our server sends them your search text or ISBN, but not your name, email, or account. Your device loads book cover images directly from their servers, which, like any website, can see your IP address when an image is requested.
We don't use your data for advertising, don't track you across other companies' apps or websites, and don't sell or rent your data. We would disclose data only if the law required it.
How long we keep it
Your library stays on our servers until you delete it or delete your account. Request logs are deleted after about 30 days.
Your choices
- Delete your account. In the app, go to Settings → Delete Account. This permanently deletes your account and every book in it from our servers and from all your devices, and, if you signed in with Apple, revokes Tesoroteca's access to your Apple Account. Deletion usually happens immediately, and always within 30 days. Deleted data can remain in Google Cloud's automatic recovery storage for up to 14 days before it's gone for good.
- Sign out. Signing out removes your library from that device. It stays in your account and comes back when you sign in again.
- Hide your email. When you sign in, choose "Hide My Email" and Apple will share only a relay address.
- Ask us. To request a copy of your data, a correction, or deletion, email james@cast.llc. Depending on where you live, you may have further rights under laws such as the GDPR or CCPA, and we'll honor them.
Security
All data is sent over encrypted connections (HTTPS) and stored on Google Cloud, which encrypts data at rest. Only your signed-in account can read or change your library through the app.
Children
Tesoroteca isn't directed at children under 13, and we don't knowingly collect personal information from them. If you believe a child has given us data, email us and we'll delete it.
Changes
If this policy changes, we'll update the date at the top of this page. If the changes are significant, we'll also tell you in the app.
Contact
Chico Automation & Software Technologies LLC
james@cast.llc