Privacy Policy

1. Who is responsible

Talemi is run by Wrapp Group, email: wrappgroup@gmail.com. We are the controller of the personal data described here, under the EU General Data Protection Regulation (GDPR) and Polish law. We have not appointed a data protection officer; write to wrappgroup@gmail.com about anything in this policy.

This policy covers the Talemi mobile app for iOS and Android, Talemi Plus subscriptions, the website talemiapp.com and the early-access list.

2. The short version

• We collect what the app needs to work: your account, the books you track and your activity with friends.
• We show no ads, do not sell or share your data for advertising and do not track you across other apps or websites. The app contains no advertising or analytics SDKs.
• Our servers are in Warsaw, Poland. Subscription records are handled by RevenueCat in the USA, with the safeguards described below.
• Payments are processed by Apple or Google. We never see your card details.
• Your profile is visible to friends by default, your lists are private by default, and your email address is never shown to other readers.
• You can get a copy of your data or delete your account at any time.

3. Data we process in the app

• Account: email address, username, display name, password (stored only as a one-way hash), time zone and the dates your account was created and updated.
• Onboarding and goals: your reading goal, daily page target and whether you finished onboarding.
• Profile: your bio and profile photo if you add them, and your visibility settings.
• Reading data: the books on your shelves and their status, pages and minutes you log with their dates, ratings if you add them, streaks, goals and the statistics calculated from them.
• Social data: friends, friend requests, people you block, challenges you create or join and their scores, custom book lists, your activity feed and in-app notifications.
• Book search: the text you search for in the catalog. To fill thin results our server may send the search text, without anything that identifies you, to Open Library. Cached searches are stored without a link to your account and are deleted regularly.
• Device and security: the device model name (so you can recognise your sign-ins), sign-in tokens, and technical request data such as IP address, time and app version, used for security and rate limiting.
• Support: what you write to us and our replies.

Stored only on your device: your appearance and language choices, a copy of your profile so the app opens offline, and your sign-in token, which is kept in the system’s secure storage (Keychain on iOS, Keystore on Android).

4. Talemi Plus subscriptions

Talemi Plus is planned and not on sale yet. This section describes how purchases will be handled once we offer it in the app.

Talemi Plus is bought through the App Store or Google Play. Apple and Google process the payment as independent controllers under their own privacy policies; we never receive your payment card or bank details.

To check purchases and decide whether Talemi Plus is active, we use RevenueCat, Inc. (USA) as our processor. RevenueCat receives your Talemi account ID (a random identifier, not your email or name), a temporary anonymous ID before you sign in, purchase and subscription details (product, price, currency, purchase and renewal dates, store transaction identifiers, trial and renewal status), your store country, device type, operating system and app version, and your IP address. RevenueCat also displays the subscription offer and the subscription management screen (Customer Center) in the app.

5. What other readers can see

• Any signed-in reader can find you by username or display name and see your profile card: display name, username, bio and profile photo.
• Your profile details, statistics and shelves are visible to friends by default. You can make them public or private.
• Your reading activity (for example finishing a book) is shown to friends by default. You can change this.
• Custom lists are private by default; you choose for each list whether friends or everyone can see it.
• People in a challenge with you see your name and your progress in that challenge.
• Your email address, password, device names and subscription status are never shown to other readers.

6. Why we use your data and on what legal basis

• To create and run your account and provide the app’s features, including friends, challenges and statistics: performance of our contract with you (Art. 6(1)(b) GDPR).
• To sell Talemi Plus, verify purchases and give you access to paid features: performance of the contract (Art. 6(1)(b) GDPR).
• To keep the service secure, prevent fraud and abuse, limit requests, moderate reported content and enforce our Terms of Use: our legitimate interest in a safe service (Art. 6(1)(f) GDPR).
• To answer your messages and tell you about important changes to the service: the contract and our legitimate interest in communicating with users.
• To comply with legal obligations and to establish, exercise or defend legal claims: Art. 6(1)(c) and 6(1)(f) GDPR.
• To manage the early-access list: your consent (Art. 6(1)(a) GDPR), see section 9.

You need to give us your email address, a username and a password to create an account; without them we cannot provide the app. Everything else is optional. We do not use your data for advertising or profiling, and we make no decisions based solely on automated processing that have legal or similarly significant effects on you.

7. Who processes your data

• MyDevil.net (Poland) hosts our website, API, database and cache on servers in Warsaw, as our processor.
• RevenueCat, Inc. (USA) handles subscription records, as our processor (section 4).
• Resend, Inc. (USA) delivers emails such as password reset codes, as our processor. It receives your email address and the message.
• Umami Software, Inc. (USA) provides cookie-free visit statistics for the website only, as our processor (section 9).
• Apple and Google distribute the app and process payments as independent controllers.
• Book covers are loaded by your device directly from Open Library (covers.openlibrary.org), a service of the Internet Archive (USA). It receives your IP address and standard request information under its own privacy policy.
• Public authorities, only when the law requires us to disclose data.

We do not sell your personal data and do not share it for cross-context behavioural advertising.

8. Transfers outside the European Economic Area

Account and reading data is stored in Poland. RevenueCat and Umami are based in the USA, so data they process may be transferred outside the EEA. We do this only with the safeguards required by Chapter V GDPR: the European Commission’s standard contractual clauses in our data processing agreements or, where the recipient is certified, the EU–US Data Privacy Framework. You can ask us for a copy of these safeguards.

9. The website and early-access list

An early-access signup stores your email address, page language, signup placement, signup date and privacy-notice version. We use these to manage the list and respond to your request for access. Signing up does not create an app account or subscribe you to a newsletter.

The legal basis is your consent (Art. 6(1)(a) GDPR), given by voluntarily submitting the form. You can withdraw it at any time without affecting the lawfulness of earlier processing. We need an email address to put you on the list. We keep list entries until you withdraw consent, for no longer than 12 months after signup, and do not reuse them for unrelated campaigns.

The public website uses Umami Cloud, a visit-statistics tool that sets no cookies and stores nothing on your device. When a page loads, your browser sends Umami the page address (of its query parameters we keep only campaign tags such as utm_source and the on-page placement a click came from; all others are removed before sending), the referring page (without parameters), the page title, browser language, screen resolution and your device, browser and operating system type. Your IP address is used only to derive an approximate location (country, region, city) and to create a one-way hash that, combined with browser details and a periodically rotated random value, counts unique visits. Umami does not store the IP address itself. We also record page-load timings (Core Web Vitals) and a few events: use of signup buttons and where on the page they sit, starting, submitting, success and the type of error of the form (without its contents), reaching key homepage sections and the end of an article, clicks on links leaving the site (such as app stores, with the destination site’s name), finishing one of the free tools (only which tool, never its result), opening FAQ questions, a book on the shelf and the table of contents, menu clicks, article cards and switching language. Events carry only predefined values, such as a section name, the type of page (for example article or tool) or language, plus the page version. We do not link this data to waitlist email addresses or app accounts, and do not use it for advertising or profiling.

10. Website statistics: legal basis and objecting

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in learning which content is read and whether the website works, without identifying visitors. You can object at any time. The statistics script does not load at all when your browser sends a Do Not Track or Global Privacy Control signal. You can also turn statistics off on this device with the button below. It saves a single opt-out flag (umami.disabled) in browser storage to remember your choice.

11. Cookies and storage on your device

The website uses no cookies, neither our own nor third-party. Fonts are served from our own server, with no Google Fonts requests. The form does not save your email address in the browser. The only browser-storage entry is created when you turn statistics off yourself.

The app stores the preferences and sign-in token described in section 3 on your device. It does not use the advertising identifier (IDFA or Google Advertising ID) and does not track you across other companies’ apps or websites.

12. How long we keep data

• Account, profile, reading and social data: for as long as you have an account. When you delete your account we delete this data from our live systems without undue delay and at the latest within 30 days; any copies in backups are overwritten within a further 30 days.
• Content tied to other people, such as a finished challenge, keeps a record that you took part, without your profile, so other participants’ results stay correct.
• Sign-in tokens: until you sign out, sign out of all devices, or they expire.
• Security logs and rate-limiting data: no longer than 30 days, unless needed to investigate a specific incident.
• Subscription records at RevenueCat: while your account exists. When you delete your account we ask RevenueCat to delete your customer record, except transaction data the law requires us to keep, for example for tax or accounting purposes.
• Support messages: as long as needed to handle your request and then for up to 3 years in case of claims.
• Early-access list: until you withdraw consent, at most 12 months. Website statistics: at most 24 months.

13. Your rights

You have the right to access your data and get a copy, to have it corrected or erased, to restrict its processing, to receive the data you gave us in a portable format, to withdraw consent at any time, and to object to processing based on our legitimate interest (Art. 21 GDPR). Website statistics do not let us identify you, so we may be unable to link specific records to you (Art. 11 GDPR).

You can correct most of your data yourself in the app, and delete your account in Settings → Delete account. To get a copy of your data or use any other right, write to wrappgroup@gmail.com from the email address on your account. We reply within one month. Deleting your account does not cancel a Talemi Plus subscription bought in the App Store or Google Play; cancel it in your store account settings.

You can also complain to a supervisory authority: in Poland the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw), or the authority where you live or work.

14. Children

Talemi is not directed at children. You must be at least 16 years old to create an account. If we learn that an account belongs to someone younger, we will delete it. If you believe a child has given us data, please contact us.

15. Security

Connections to the app, API and website are encrypted (HTTPS). Passwords are stored only as hashes, sign-in tokens can be revoked from the app, access to production data is limited to people who need it, and requests are rate-limited. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the supervisory authority as the law requires.

16. Changes to this policy

We publish changes here with a new update date. If a change materially affects how we use your data, we will also tell you in the app or by email before it takes effect.