Privacy

What we collect, and why

Your email address — it’s how you sign in (a one-time code; there are no passwords to breach) and where we send the occasional note about your books. If you use Sign in with Apple, we ask Apple for your email address and nothing else — not your name — and you may give a private relay address in its place. Account data lives with Supabase.

Your reading — the books you open, your place in them, your bookmarks, and the lines you keep in your commonplace book with any notes you write on them. This is the product; without it nothing syncs. It’s stored per-account and no other reader can see it.

Search and resurfacing — to find a kept line by meaning, to bring one back at the right moment, and to answer a catalog search, the text of your kept lines (with the book and speaker; never your private notes) and the searches you type are sent to Google’s Gemini API, which returns a numeric representation of the text (an embedding) that we store. The gallery’s short texts are written by the same service from a few reading signals: recent searches and the books you opened. Google does not use what we send to train its models, and nothing beyond the text goes with it — no email, no account id.

How the app is used — we use PostHog for usage analytics (which features get used, where people get stuck) and Sentry for crash and error reports. The app asks PostHog not to look up where you are: its events carry a flag that switches off the usual city-from-IP lookup, and the app has no location permission and never requests one. This is how a two-person operation finds bugs. If the App Store account you use is registered in the United Kingdom or the European Economic Area, none of that happens: usage analytics and crash reporting are switched off automatically — in the app and on our servers, so nothing about your reading reaches either one — and there is nothing for you to configure. Everywhere else they are on. Our marketing site at chromatics.mobile uses the same PostHog analytics — which pages get read, which demos get played, which buttons get tapped, and there, session recordings of those visits — so we can tell which pages actually help people.

Purchases — subscriptions run through Apple and RevenueCat. We never see your card number; we see that an account is subscribed.

Notifications — if you allow push notifications, a device token is held by OneSignal. Sign-in codes and emails go through Resend. Every notification type has its own toggle in Settings, email and push separately.

Your integrations stay yours

If you connect Notion or Readwise, the access token is stored server-side and used for exactly one thing: sending the lines you kept to the workspace you chose. We read nothing back but what we wrote. Disconnect anytime; what was exported stays in your workspace, because it’s yours.

What we don’t do

We don’t sell or share your data for advertising. We don’t show ads. We don’t train AI models on your notes or your kept lines. We don’t ask for your contacts, your device’s location, or your name — the app collects no location at all, and it no longer asks Apple for your name when you sign in.

Leaving, with everything

Take your reading with you anytime: your commonplace book exports to Markdown, CSV, Notion, and Readwise from inside the app — no permission needed, it’s a feature.

Delete your account in the app: Settings → Account → Delete account. Deletion removes your account, your nightstand, your keeps and notes, your gallery, any connected Notion or Readwise, and our record of your purchase, within 30 days. An active App Store subscription is separate: cancel it in your Apple ID settings, because deleting the account doesn’t stop Apple billing. If you’d rather, write to hello@chromatics.mobile from your account email and we’ll do it, and confirm when it’s done.

Questions

Write to hello@chromatics.mobile — a person reads it. This page was last updated September 12, 2026; if our practices change, this page changes first.