The short version
- We do not sell your data. Not to anyone, for any price.
- We show no ads inside Paguely. We do advertise Paguely on Facebook and Instagram, and the app includes the Meta SDK to measure whether those ads work. It tells Meta that the app was installed and opened, that an account was created, and that a first reveal happened, along with a device identifier. It never sends your books, ratings, reviews, or mood answers. In the EU, the EEA, the UK, and Switzerland this is off unless you say yes. Elsewhere it is on until you turn it off. See Ad measurement.
- We do not send your name, email, or account ID to any AI service. It sees books, moods, and ratings, never who you are. The one exception is the help chat, where it sees whatever you choose to type.
- You can delete everything, permanently, from inside the app. Settings, then Delete account.
- Your reading is yours. Your shelf visibility is yours to set, and your reviews are private unless you make them public.
Who we are
Paguely is operated by Mereltech LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States ("Paguely", "we", "us"). For privacy questions, and for any request described in the Your rights section below, contact [email protected].
For users in the EEA and the UK, we are the data controller for the data described here.
What we collect, and why
We only collect what the app needs to work. Here is the whole list.
| What | Why | Legal basis (EEA/UK) |
|---|---|---|
| Email address | To create and secure your account, and to reset your password. Handled by our auth provider. | Contract |
| Display name and avatar | Shown on your profile. If you sign in with Google or Apple, these come from that account. If you sign up by email, your display name is taken from the part of your email before the @. You cannot upload a photo; there is no image upload in Paguely. | Contract |
| Taste profile | The genres you pick at onboarding, a few books you have loved, and your reading pace. This is what makes your first match better than random. | Contract |
| Mood quiz answers | Every reveal starts with a short mood quiz. We store the answers so the match can be made and so recommendations improve over time. | Contract |
| Reading data | Books on your shelf, reading progress, start and finish dates, ratings, reviews, reading-session times, streaks, and which cards you swiped left or right in Browse. | Contract |
| Taste vector and Reading DNA | A six-axis summary of your taste (pace, tone, length, intensity, setting, complexity) derived from what you read and rate, plus a few descriptive tags. It powers matching and the Reading DNA screen. | Legitimate interests (making the product work as described) |
| Social activity | Who you follow, comments, reactions, poll votes, book recommendations you send, reading groups you join, and group posts. | Contract |
| Time zone | Your IANA time zone (for example Europe/Sarajevo), so streak deadlines and reminders land at your local midnight and not ours. This is a region, not a location. | Contract |
| Approximate location (optional) | Only if you tap "Find it near you". Your device's own location services (Apple or Google) turn your approximate position, or a city or ZIP you type, into a city. Coordinates rounded to about a kilometre are sent to our server to look up nearby libraries and bookshops. They are not stored with your account and are never sent to analytics. If you pick a library, your postal code is used to find it. | Consent |
| Push notification token | A device token from Apple or Google so we can send notifications you have turned on. | Consent |
| Crash and diagnostic data | Stack traces, device model, and OS version when the app crashes. Tagged with your account ID, never your email or name. | Legitimate interests (keeping the app working) |
| Usage analytics | Product analytics: which screens are used, whether onboarding was finished, whether a paywall converted. Tied to your account ID when you are signed in, never to your email or name, and to an anonymous device ID when you are a guest. See the section below. | Legitimate interests |
| Install source (Android only) | Which link or campaign led to the install (its source, medium, and campaign name), if the Play Store tells us. Recorded in our analytics so we can see where readers come from. It is not sent to Meta. | Legitimate interests |
| Ad measurement data | Sent to Meta so we can see which of our Facebook and Instagram ads work: that the app was installed and opened, that a new account was created (and whether by email, Google, or Apple), that a first reveal happened, and identifiers for your device and this install of the app. On iPhone the advertising identifier is included only if you allow tracking when asked. On Android the advertising ID is included while ad measurement is on. See the Ad measurement section below. | Consent in the EU, the EEA, the UK, and Switzerland. Elsewhere it is on until you turn it off. |
| Purchase status | Whether your Paguely+ subscription is active. We never see or store your card details. | Contract |
We do not collect: your precise location (the nearby feature asks only for approximate location, and only while you are using the app), your contacts, your photos, your microphone or camera, or your browsing outside the app. Your advertising ID is used only for ad measurement, as described in the Ad measurement section. On iPhone that means we ask for App Tracking Transparency permission, and the advertising identifier is shared only if you allow it.
How AI is used
First, some perspective: Paguely is a reading app, not an AI chatbot or a wrapper around one. Your library, your streaks, your swipes, and the six-axis taste vector that scores your matches are all handled by our own code. AI does four things:
- It writes the short, playful clues you read before a reveal, the "Why this book" note, and the wording of your Reading DNA.
- It suggests books: a few candidates for each reveal, your For You picks, and the results of Find similar books. Our own code still chooses the reveal match.
- It tells us whether a book is part of a series, so a reveal does not hand you book three.
- It answers questions in the help chat.
All of it is done by OpenAI (model gpt-4o-mini). Your phone
never contacts OpenAI. Requests go to our own server, which adds the instructions and
passes them on, so OpenAI sees our server's address and not your IP. Because this is the
part people ask about most, here is what is sent.
What OpenAI receives
- For clues and "Why this book": the matched book's title, author, description, genres, mood tags, page count, and publication year, and your mood quiz answers, for example "Feeling: Wistful. Pace: Slow burn."
- To widen the search for a reveal: your mood quiz answers and up to five genres you usually read.
- For Reading DNA: your six-axis taste vector, as numbers, and up to 40 books you have read, with their authors, genres, and the star rating you gave them.
- For For You: your taste vector and up to 10 books you rated four stars or higher, with their authors, genres, and ratings.
- For Find similar books: your taste vector and the title and author of the book or books you started from. If you ask again because nothing appealed, also the titles you were shown and did not tap.
- For the series check: titles and authors of candidate books. Nothing about you.
- In the help chat: the messages you type and the assistant's replies, up to the last ten. Please do not type anything there you would not want sent.
What OpenAI never receives from us
- Your name, your email, your username, or your account ID.
- Your reviews or your notes.
- Your IP address or anything about your device.
The help chat is the one place where your own words are sent. We add nothing that identifies you, but OpenAI will see whatever you write.
We send this data through OpenAI's API, and OpenAI states that data submitted through its API is not used to train its models.
AI-generated clues can be wrong, odd, or occasionally miss the book's tone. They are a game, not a review. The same goes for the help chat: if it cannot help, you can send your question to us by email from the same screen.
Analytics and session replay
We use PostHog (US region) to understand how the app is used, so we can fix what is broken and improve what is not working. When you are signed in, this is tied to your account ID, never to your name or email. When you use the app as a guest, it is tied to an anonymous identifier for your device.
Alongside your account ID we send a few facts about the account: whether you have Paguely+, whether you finished onboarding, how many reveals you have used this month, your daily reading goal in minutes, and whether you have a username (not the username itself).
The events we record are things like: onboarding started, onboarding finished, a paywall was viewed, a purchase completed, a share card was created, an outbound book link was tapped, a book was finished or rated, and your answer to the ad measurement question. Some events carry our internal ID for the book involved, a star rating, or a progress percentage. No event carries a review, a mood answer, or anything you have typed.
When something fails inside the app we also record an error event: which part of the app failed, the kind of error, and a short error code. The error's message is not sent to PostHog, because messages can contain data. Like other events, it is tied to your account ID when you are signed in.
On Android we also record which link led to the install (its source, medium, and campaign name), if the Play Store tells us. This is attached to your analytics events. iPhone installs carry no such source.
Analytics is on for everyone. There is no switch for it in the app. To object, email [email protected].
Session replay is enabled. PostHog records the structure of screens you visit, your navigation, and your taps and gestures, so we can see where the app confuses people.
All text and all images are masked before they leave your device. That means your shelf, your reviews, your clues, your book covers, and anything you type are blocked out in the recording. A replay shows the shape of the interface and where you tapped, not what you read or wrote.
Ad measurement
We do not show ads inside Paguely. We do advertise Paguely itself on Facebook and Instagram, and we want to know which of those ads bring readers who actually use the app. For that, the app includes the Meta SDK.
What Meta receives
- That the app was installed and opened.
- That a new account was created, and whether it was by email, Google, or Apple. This is sent once per account.
- That a first reveal was completed on your device. This is sent once, and it is sent for guests too.
- Identifiers for your device and for this install of the app, plus what any service you connect to sees, such as your IP address and device type.
- On iPhone, your advertising identifier, only if you allow tracking when your phone asks. If you decline, Meta still receives the events above, without that identifier.
- On Android, your advertising ID, while ad measurement is on. You can reset or delete it in your phone's settings.
- Subscription events (a trial started, a subscription or purchase made or renewed). These are sent to Meta by RevenueCat, our subscription provider, and not by the app. So that RevenueCat can match them to an install, the app gives RevenueCat Meta's identifier for this install and your device identifiers.
What Meta never receives from us
- Your books, your shelf, your ratings, your reviews, or your mood quiz answers.
- Which book a reveal matched you with.
- Your name, your email, or your account ID.
Meta uses what it receives under its own privacy policy, and may connect it to a Facebook or Instagram account you have.
Where it is on, and where we ask first
In the EU, the EEA, the UK, and Switzerland, ad measurement is off unless you say yes. The app asks you once you are inside it. Until you answer yes, Meta's software inside the app is not started at all, so the app makes no contact with Meta. We send none of the above, we give RevenueCat no identifiers for Meta, and the iPhone tracking prompt is not shown. If you close the question without answering, it stays off and we ask again later.
Everywhere else, ad measurement is on until you turn it off.
We decide which rule applies from the region set on your phone, not from your location. If the region cannot be read, we ask first.
The iPhone tracking prompt
On iPhone, when ad measurement is on, iOS asks whether Paguely may track you. This appears once you are inside the app, after onboarding, and never at launch. Your answer decides one thing: whether your advertising identifier is shared with Meta. You can change it in your iPhone's Settings, under Privacy & Security, then Tracking.
How to change your choice
Open Privacy choices and use the Ad measurement switch. You will find it at the top of the Privacy page inside the app, and in Settings. It is available to guests too. Turning it off takes effect at once: the app stops sending events to Meta, and asks RevenueCat to remove Meta's identifier and your device identifiers from your record. Meta's software stays loaded, switched off, until you close the app, and is not started again while the switch is off. Your choice is saved on your phone.
Buy and borrow links
When you tap Buy or Borrow, we open your browser to Amazon (print or Kindle), Bookshop.org, Audible, or Open Library. From "Find it near you" we may also open Barnes & Noble, WorldCat, Libby, a shop or library's own website, or your maps app for directions. Some of those links are affiliate links, which means we may earn a commission if you buy. It costs you nothing extra, and it does not change which book you get matched with.
The link carries the book's identifier and a single affiliate tag that is the same for every Paguely user. No identifier of you is ever attached. Once you land on that site, it is their site: they will see your IP and may set their own cookies, under their own privacy policy, not ours.
What stays on your device
Some things never leave your phone at all:
- The email address you last signed in with, saved so we can pre-fill the sign-in form.
- Your reading rhythm: roughly which hours of the day you tend to read, used to time the optional smart reminder. This is computed and stored locally, and is never uploaded.
- The book and page shown on your home-screen widget.
- The place you saved for "Find it near you" (a city name, a postal code, and rounded coordinates) and the library you picked. These are saved only on your phone. The rounded coordinates and postal code are sent for each lookup as described above, and are not kept with your account. They are removed from your phone when you clear them in Settings or sign out.
- Onboarding progress flags and the counters that decide when to show the "rate us" prompt.
Share cards are rendered on your device and handed to your system share sheet. We never upload them. Where a card goes is entirely your choice.
What other people can see
Paguely has a social layer, so some things are visible to others by design. You control this.
- Your shelf defaults to public. You can change it to Friends (mutual followers) or Private at any time, in Settings, and you can override the setting for individual books.
- Your reviews are private by default. A review only becomes visible to others if you explicitly mark it public.
- Your profile, follows, comments, reactions, and poll votes are visible to other signed-in users.
- Your mood quiz answers, your reveals, your reading sessions, your swipes, and your streak history are private to you.
Your rights
Delete everything
Open Settings, then Delete account. This permanently deletes your account and every row attached to it: your shelf, reveals, ratings, reviews, reading sessions, swipes, follows, comments, group posts, and push tokens. It is immediate and it cannot be undone. We do not keep a shadow copy.
Get a copy of your data
Email [email protected] and we will send you a machine-readable export of your data within 30 days.
Correct, restrict, or object
You can edit much of your data in the app directly. For anything else, including correction, restriction of processing, objection to processing, or withdrawal of consent, email [email protected].
Withdraw consent to ad measurement
Open Privacy choices, at the top of the Privacy page inside the app or in Settings, and turn off Ad measurement. You do not need an account to do this, and it takes effect at once. It stops what the app sends from then on. It does not erase what Meta has already received, which Meta keeps under its own policy.
If you are in the EEA or UK you also have the right to complain to your local data protection authority. If you are in California, you have the right to know, delete, and opt out of "sale" or "sharing" of personal information. We do not sell personal information. Sending ad measurement data to Meta may count as "sharing" under California law, and you can opt out of it at any time with the Ad measurement switch under Privacy choices. You can also contact us.
How long we keep things
- Account and reading data: as long as your account exists. Delete the account and it is gone.
- Crash reports: up to 90 days, per Firebase Crashlytics defaults.
- Analytics events: retained by PostHog. Events recorded while you were signed in are linked to your account ID. Events recorded as a guest are linked only to an anonymous device ID.
- Ad measurement data: held by Meta under Meta's own retention policy. We do not control how long Meta keeps it.
- Backups: deleted data may persist in encrypted database backups for up to 30 days before those backups roll off.
Security
Data is encrypted in transit (HTTPS) and at rest. Access to your rows is enforced at the database level with row-level security, so one user cannot read another user's private data. We never see your password: authentication is handled by our auth provider, and passwords are stored only as salted hashes.
No system is perfectly secure. If we ever discover a breach affecting your personal data, we will notify you and the relevant regulator without undue delay, and within 72 hours where the law requires it.
Children
Paguely is not for children. You must be at least 13 years old to use it, and at least 16 if you are in the European Economic Area, unless your country sets a lower age and your parent or guardian consents.
We do not knowingly collect data from children under those ages. If you believe a child has created an account, email [email protected] and we will delete it.
Changes to this policy
If we change how we handle your data in any way that matters, we will update the date at the top of this page and tell you in the app before the change takes effect. We will not quietly start doing something with your data that this page says we do not do.