1. Introduction
At Booklet ("we," "us," or "our"), we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information when you use our mobile application ("the App") and our website (collectively, the "Service"). By using the Service, you acknowledge the collection and use of information as described in this policy.
2. Information We Collect
In the last 12 months, we have collected the following categories of personal information:
- Identifiers: Real name, email address, IP address, and unique device identifiers (e.g., IDFA, Android Advertising ID, Google Advertising ID).
- Customer Records: Account profile information and login credentials.
- Commercial Information: Subscription status and purchase history (processed by Apple/Google; we do not receive or store payment card details).
- Internet Activity: Interactions with the App, including study habits, flashcards created, progress metrics, and app usage logs.
- Advertising & Identifier Data: For users who have not purchased an ad-free subscription and have consented to tracking where required, we and our advertising partner (Google AdMob) collect advertising identifiers (such as IDFA or Android Advertising ID), approximate location derived from IP address, and ad interaction data (impressions, clicks) to deliver and measure advertising. See Section 6 ("Advertising and Tracking") for details on consent and opt-out.
- Sensitive Personal Information: Account credentials (e.g., password) that, in combination with your account identifier, allow access to your account. We collect this only as necessary to authenticate you and do not use it for any purpose beyond providing the Service.
3. Sources of Information
We collect data from the following sources:
- Directly from you: Information you provide during registration or while using the App.
- Automatically: Collected via your device when you interact with the Service (e.g., usage logs, device data, advertising identifiers).
- Third Parties: Payment processors (Apple/Google), analytics partners, and our advertising partner (Google AdMob), which may provide us with aggregated or device-level data depending on your consent choices.
4. Legal Bases for Processing (EEA/UK Users)
If you are located in the European Economic Area (EEA) or UK, we process your data under the following legal bases:
- Contractual Necessity: To provide the Service you requested (e.g., syncing flashcards, account authentication).
- Legitimate Interests: To improve the App, ensure security, prevent fraud, and conduct internal, non-advertising analytics.
- Consent: For advertising identifiers, ad personalization, and any tracking technology that is not strictly necessary to operate the Service. You may withdraw this consent at any time; doing so does not affect the lawfulness of processing carried out before withdrawal. Where consent is required, we will not process the relevant data until you provide it.
- Legal Obligation: To comply with applicable laws and regulations.
5. Third-Party Services
We use the following categories of third-party providers:
- Analytics (non-advertising): Firebase (Google) and Mixpanel help us understand app performance and user engagement. This data is not used to serve ads and is not shared with advertising networks for cross-context behavioral advertising.
- Advertising: We use Google AdMob to display advertisements to users on the free tier of the App. Depending on your consent and platform settings, AdMob may collect and process advertising identifiers, approximate location, and ad-interaction data, and may combine this data with information from other apps and services for ad personalization and measurement. Where you decline tracking (see Section 6) or have not provided required consent, AdMob serves only non-personalized advertising based on contextual signals.
- Infrastructure: Cloud hosting providers that store and help secure your data.
- Payments: All payments are handled by Apple (App Store) or Google (Play Store). We do not store or have access to your payment card details.
We do not sell personal information for monetary consideration. Depending on your jurisdiction, our use of advertising identifiers through AdMob may be considered "sharing" (CCPA/CPRA) for cross-context behavioral advertising, or may require your prior consent (GDPR/ePrivacy). See Sections 4, 6, and 11 for your rights and choices.
6. Advertising and Tracking
The free, ad-supported version of the App displays advertisements served by Google AdMob. Users on our paid, ad-free subscription do not see advertisements and are not subject to the advertising-related data collection described in this section.
iOS (App Tracking Transparency)
On iOS, the first time the App would use your device’s advertising identifier (IDFA) for tracking, you will be shown Apple’s App Tracking Transparency prompt. If you select "Ask App Not to Track," we and AdMob will not access your IDFA for cross-app tracking, and you will be shown non-personalized advertising. You can change this choice at any time in your device Settings under Privacy & Security > Tracking.
EEA/UK and other consent-required jurisdictions
Where applicable law requires your prior consent before we or our advertising partner may use cookies, advertising identifiers, or similar technologies that are not strictly necessary to operate the Service, we will request that consent through an in-app consent prompt before any such processing occurs. You may withdraw consent at any time through the App's privacy settings, which will reset your choice for future sessions.
Users under 18
If you are between 13 and 17 years old, you will be shown only non-personalized, contextual advertising. We do not knowingly use precise location or cross-app tracking identifiers to personalize ads for users in this age range.
Your choices
You can limit ad tracking through your device's operating system settings (iOS: Settings > Privacy & Security > Tracking; Android: Settings > Privacy > Ads), through Google's Ads Settings (adssettings.google.com), and through the in-app privacy settings described above.
7. International Transfer of Data
Your data may be transferred to and processed in countries other than your country of residence, including the United States. For users in the EEA/UK, we rely on Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or other approved safeguards for transfers by us and by our service providers, including our advertising and analytics partners. You may request a copy of the relevant safeguard by contacting us using the details in Section 14.
8. Data Retention
| Data Category |
Retention Period |
| Account Information |
Duration of account + 30 days post-deletion |
| Usage & Analytics Data |
Up to 14 months |
| Customer Support Records |
3 years from last interaction |
Note: We may retain data longer where required by law, to resolve disputes, or to enforce our agreements. Our advertising partner may apply its own retention periods to data it processes as an independent controller; see Google's privacy policy for details.
9. Your Privacy Rights
Regardless of your location, you have the following rights regarding your data:
- Access: Request a copy of the data we hold about you.
- Rectification: Request correction of inaccurate information.
- Erasure: Request deletion of your data (subject to certain exceptions).
- Portability: Request a transfer of your data to another service.
- Object/Restrict: Object to or limit specific types of processing, including advertising-related processing.
To exercise these rights, contact [email protected]. We will verify your identity before fulfilling requests to protect your security.
10. Additional Information for EU/EEA and UK Residents
In addition to the rights above, EU/EEA and UK residents have the right to:
- Withdraw consent at any time for consent-based processing, including advertising identifiers and ad personalization, without affecting the lawfulness of prior processing.
- Lodge a complaint with their local Data Protection Authority (DPA) or, for UK residents, the Information Commissioner's Office (ICO).
11. Additional Information for California Residents
Under the CCPA/CPRA, California residents have the right to:
- Know: What categories of personal information we collect, and the categories we disclose for advertising purposes (see Section 5).
- Opt-Out of Sharing: Request that we do not "share" your personal information (including advertising identifiers) for cross-context behavioral advertising. You can exercise this right by declining tracking via the App Tracking Transparency prompt (iOS), your device’s advertising settings (Android), or by contacting us at [email protected]. We do not sell personal information for monetary consideration.
- Limit SPI: Limit the use of Sensitive Personal Information to purposes necessary to provide the Service.
- Non-Discrimination: We will not discriminate against you for exercising your privacy rights. Choosing not to be tracked for advertising does not affect your ability to use the Service; it only changes whether you see personalized or non-personalized ads on the free tier. Subscribing to the ad-free tier is a separate product choice and is not conditioned on, and does not require, any waiver of your privacy rights.
12. Children's Privacy
The Service is intended for users aged 13 and older and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will take steps to delete that information promptly.
For users we are aware are between 13 and 17 years old, we apply the advertising limitations described in Section 6 (non-personalized advertising only). If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at [email protected].
13. Security of Data
We use industry-standard encryption and security measures designed to protect your data. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.