Privacy Policy

Bookmuse · Last updated November 3, 2026

The short version: You can read in Bookmuse without an account, and then your library stays on your device. If you sign in (with Apple, Google or an email and password), we store your library on our servers in Japan so it syncs between your devices. Online features send only what they need. We don't show ads, sell your data or track you across other apps and websites. You can delete your account and its data at any time, in the app or by email.

Who we are

Bookmuse is made by Quan Ngo, an independent developer ("we", "us"). This policy covers the Bookmuse apps for iPhone, iPad, Mac and Android, this website (bookmuse.wanngo.com) and the web dashboard (bookmuse-app.wanngo.com). Questions: admin@bookmuse.wanngo.com.

Without an account

Signing in is optional. Without an account, your books, saved words, highlights, notes, reading progress, stats and settings are stored only on your device, and we receive none of them. Some features still go online when you use them; they are described under "Online features" below.

Your account

You sign in with Apple, with Google, or with your email and a Bookmuse password. From an Apple or Google sign-in we receive:

• An account ID from Apple or Google, which identifies you to us.
• Your email address and whether it is verified. With Apple's Hide My Email, this is a private relay address that Apple forwards to you. If the same verified email signs in with both Apple and Google, it is one Bookmuse account.
• Your name. Apple shares it only the first time you sign in, if you choose to. Google shares the name on your Google Account. You can change it in the app.
• Your Google profile photo (Google only): if your Bookmuse account has no picture yet, we copy it once as your profile picture. Later changes to your Google photo don't follow, and you can change or remove the picture in the app.

If you use an email and password, we email you a 6-digit code to prove the address is yours when you create the account, add a password or reset it. These emails are sent through Oracle Cloud Infrastructure Email Delivery. We keep your password only as a one-way hash (argon2id), never the password itself, and the codes only as hashes. After 10 wrong passwords in a row we lock sign-in for that email for 15 minutes.

Each sign-in on a device, the web dashboard or an AI agent is a session. For each one we keep the device type, the app version and when it was last used. We keep sign-in tokens only as one-way hashes. We also count how much you use limited features (cloud storage, BookMuse AI, share links, feed posts) so we can apply the free plan's limits.

What syncs with your account

When you're signed in, Bookmuse keeps your library in your account so it is the same on all your devices and on the web dashboard:

• Your books' details (title, author, language, file name and size), reading position, finished state and the theme and text size each book uses.
• Highlights, underlines, bookmarks and notes, with the text they mark.
• Saved words with their translations, tags and review progress, and your lookup history from the last 30 days.
• Your Ask AI conversations about each book.
• Reading and listening time per day, folders, reminders, settings, and the addresses of book catalogs you add (catalog passwords are never sent to us).
• A random ID for each installation of the app, so sync knows which device made a change.

Book files and covers

The EPUB files you add, and their covers, are uploaded to private storage in your account, up to your plan's storage limit. They are reached only through short-lived signed links made for you. When several people add exactly the same file, we may keep a single stored copy for all of them; no one can see who else has it. Your copy is yours: no one else can open your library.

Where your data is stored

Our servers and storage run on Oracle Cloud Infrastructure in Japan (the Osaka region). Our websites and apps reach them through Cloudflare, which delivers and protects the traffic. Everything travels over encrypted connections (HTTPS), and Oracle encrypts stored data. If you live outside Japan, this means your data is transferred to and stored in Japan.

We don't keep backups of the database, so data you delete can't be restored.

Sharing a book

Share Book makes a link that works for 7 days. Anyone with the link can see a public page with the book's cover, title, author, file size and your display name ("Shared by …"), and anyone who signs in to Bookmuse can add a copy of the book to their own library. A copy someone added stays theirs. Your highlights and notes are never shared. Deleting the book or your account ends its links early.

Feed and profiles (optional)

The feed is public. You agree to its rules before you use it. What you post there can be seen by anyone, including people who aren't signed in:

• Your posts (the book's title, author and cover, your text, star rating, quote, and a share link if you add one), your comments and your likes.
• Your profile: display name, profile picture, when you joined, your number of posts, and who you follow and who follows you.

We also keep the reports and blocks you make. A report hides that post, comment or picture from you at once and from everyone after several reports. To keep the feed safe, we may remove posts, comments and pictures, and stop an account from using the feed. Deleting a post or comment removes it from the feed at once; its text stays hidden in our database until you delete your account (see "Deleting data" below). Words on a block list can't be posted.

Google Drive and Dropbox (optional)

You can connect Google Drive or Dropbox to import books. The connection is kept in your account so all your devices can use it.

• Google Drive: Bookmuse asks only for the drive.file permission, so it can open only the files you pick in Google's own file picker, plus the email of that Google Account to show which account is connected. It can't see the rest of your Drive.
• Dropbox: Bookmuse can read your Dropbox account's email, browse your folders and file names, and download the EPUB files you choose to import. It can't change or delete anything in your Dropbox.

Our server keeps the connection's refresh token encrypted (AES-256-GCM) and gives your devices short-lived access tokens. Your devices download the files straight from Google or Dropbox; the files don't pass through our server, and are then added to your library like any other book. We use this access only to import the books you choose. Disconnect in Settings › Connections, or delete your account, and we revoke the access with Google or Dropbox. You can also remove it from your Google Account or Dropbox settings.

Bookmuse's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, don't sell it, don't use it to train AI models, and no person reads it unless you ask us to (for example in a support request), it is needed for security, or the law requires it.

Searching for books to post about (Open Library)

When you post about a book that isn't in your library, the book search sends what you type in the search field to Open Library, a service of the Internet Archive (openlibrary.org), straight from your device. Like any web request, it carries your device's IP address and Bookmuse's name and version. We don't see or store your searches. The book you pick reaches us only as the title, author, Open Library number and cover number that appear in your post, and our server then downloads that cover from Open Library. See the Internet Archive's terms and privacy policy.

BookMuse AI

BookMuse AI is the built-in AI for lookups, follow-up questions and Ask AI. It needs an account. When you use it, the app sends our server what the feature needs: the text you look up and any context from the book the feature uses, your questions and, for Ask AI, the parts of the book it reads to answer (such as the table of contents, the page on screen and passages it searches for). Our server passes this to Anthropic, whose Claude model writes the answer, under their own terms.

Our server doesn't store or log this content, unless you report an answer (see below). It sends Anthropic a one-way scrambled form of your account ID, not your name or email, and it counts your daily calls for the plan's limits (the counts are deleted after 40 days). We don't use your content to train AI models. The answers you keep, in your lookup history, saved words and Ask AI conversations, are stored in your account so they sync, as described above. Without an account, lookups use on-device translation and stay on your device. If BookMuse AI is offline or you've reached its limit, lookups use on-device translation too.

Reporting an AI answer

If an AI answer is wrong or offensive, you can report it from the chat (the flag button, Report an Answer). The report sends us the answer you pick and the question right before it, the AI model, which chat it came from, the book's title, the reason and any note you add, with the time and the app's platform and version. Nothing else from the book or the chat is sent. You can report with or without an account; when you're signed in, the report is linked to your account. We review reports to improve the AI and keep it safe. A report is deleted after 180 days, or earlier when you delete your account; Erase All Data doesn't remove it.

AI agents (optional)

You can let an AI agent, such as Claude, ChatGPT or Cursor, use your Bookmuse library. You sign in on our connect page and choose Allow. The agent can then read, add, change and delete your books, words, highlights, notes and folders, as the app can. What it reads is sent to that agent's company under its own privacy policy. We keep the agent's name and its session until you disconnect it in the agent or delete your account. Agents can't delete your account, erase your data or use BookMuse AI.

Online features

• Book catalogs. When you browse Project Gutenberg or a catalog server you add (such as Calibre, Komga or Stump), the app talks to that catalog's server directly. A catalog's password goes only to that server.
• Downloads. Bookmuse voices download from our public GitHub release, Apple Translation languages from Apple, and Android translation languages from Google.

These services receive your device's IP address, like any internet request, and handle what they receive under their own privacy policies.

Translation on Android (Google ML Kit)

On Android, translation and language detection run on your device with Google's ML Kit. The text you translate stays on your device. ML Kit sends Google diagnostics and usage data, whether or not you're signed in: device model and Android version, app version, how long translations take, error codes, event types, the translation languages and detected languages, and an ID for this installation. Google uses it to keep ML Kit working, as described in Google's ML Kit data disclosure. On Apple devices, Apple Translation runs on your device under Apple's privacy terms.

Website, dashboard and cookies

bookmuse.wanngo.com has no analytics, ads or tracking cookies. The web dashboard uses a sign-in cookie, a short-lived cookie during sign-in, and your browser's storage for preferences such as language; all of these are needed for it to work. Apple's and Google's sign-in buttons load from Apple and Google when you sign in. Cloudflare may set a strictly necessary security cookie.

Server logs and security

For each request our server logs the time, the address path, the result, how long it took, the app's platform and version, and your account ID if you're signed in. Logs never contain your books, notes, words, AI content, passwords or tokens, and they are kept only for a short time. Cloudflare and our servers use IP addresses to deliver traffic and to limit abuse; we don't store them with your account.

Other protections: private storage reached only through short-lived signed links, sign-in tokens stored as hashes, provider tokens encrypted, passwords kept only as one-way hashes, and a fresh sign-in or your password required before an account is deleted. No system is perfectly secure, but we work to keep your data safe.

What we don't do

• No ads, no advertising ID, no selling or renting of your data.
• No tracking across other companies' apps or websites.
• No analytics or crash-reporting tools in the apps, apart from ML Kit's diagnostics on Android described above.

Who receives data

Only the companies that run parts of Bookmuse for us, each for its part: Oracle (servers, storage and sign-in emails), Cloudflare (network delivery and protection), Anthropic (BookMuse AI), Apple and Google (sign-in, and ML Kit on Android), Open Library (Internet Archive) when you search for a book to post about, and Google Drive or Dropbox if you connect them. What you publish in the feed or through a share link is visible as described above. We may disclose data if the law requires it. If Bookmuse is ever transferred to someone else, this policy keeps applying to the data collected under it.

How long we keep data

• Your account and library: until you delete them or your account.
• Emailed sign-in codes: deleted within a day.
• Lookup history: 30 days. AI usage counts: 40 days. Reported AI answers: 180 days. Ended sessions: deleted within about a week.
• Share links stop working after 7 days.
• Items you delete (a highlight, word, note, chat or post) disappear from your devices and the feed at once. Their last text stays hidden in your account until you use Erase All Data or delete your account, and then it is deleted.

Deleting data

• Delete Account (Settings › Account › Delete Account, on iPhone, iPad, Mac and Android) deletes your account and everything in it right away. Stored files are removed within minutes. What is deleted, what is kept, and how to ask by email.
• Erase All Data (Settings) deletes your library from your account and all your devices but keeps the account, your profile, your feed posts, the AI answers you reported and your Drive or Dropbox connections.
• You can also delete single books, words, highlights, posts and comments, remove your profile picture, and disconnect Drive, Dropbox or an AI agent.
• If you delete your Apple Account, Apple tells us and we delete your Bookmuse account.

Your rights

You can see and correct your data in the app and on the web dashboard, download your books, export your highlights (Markdown) and words (CSV), and delete your data or your account. You can also email us to ask for a copy of your data, a correction or a deletion, or to object to how we use it; we answer within 30 days. Depending on where you live (for example in the EU, the UK or California), you have these rights by law and can complain to your local data protection authority.

Where the law asks for a legal basis, we use your data to provide the service you asked for (your account, sync, AI and sharing), for our legitimate interest in keeping Bookmuse secure and the feed safe, and with your consent for optional connections, which you can withdraw by disconnecting them.

Children

Bookmuse is for people aged 13 and over (or older, where your country's minimum age for these services is higher). It isn't directed at children, and we don't knowingly collect data from children under 13. If you think a child has given us data, email us and we will delete it.

Bookmuse 1.3 and earlier

Versions up to 1.3 on the App Store had no account: they stored your library on your device and synced it through your own iCloud, which we can't access. BookMuse AI in those versions sent lookups from your device directly to OpenRouter. Updating to a newer version starts with an empty library on the device; nothing is moved from iCloud to our servers.

Changes and contact

If this policy changes, we will post the new version here with a new date. Questions or requests: admin@bookmuse.wanngo.com.