ReadKick Privacy Policy

Last updated: 27 October 2026

This Privacy Policy explains how personal data is processed when you use the ReadKick mobile app for iOS and Android, the ReadKick website and the ReadKick server (together, the "Service"). ReadKick helps you learn English and Spanish by reading books, building a personal dictionary, training words, listening to audio and using AI explanations and translations.

1. Who is responsible for your data

The controller of your personal data is Aleksei Prokhorov, a private individual based in Spain, who operates ReadKick ("we", "us").

• Email for all privacy questions and requests: support@readkick.app
• Website: https://readkick.app

We have not appointed a Data Protection Officer because the law does not require one for a service of this size. You can contact us directly at the address above.

2. Summary

• You can use ReadKick without giving us your name or email: the app creates an anonymous guest account.
• Books, articles and texts you import into the app stay on your device. They are not uploaded to our server.
• Your personal dictionary, learning progress, reading positions, notes and settings are stored on our server so they can be synced and restored.
• When you use AI features, the word and the sentence around it (or the passage you selected) are sent to an AI provider to generate the answer. They are not used to train AI models.
• We do not show ads, we do not sell your data and we do not use advertising trackers.
• You can export your data and delete your account at any time, in the app or on the web.

3. What data we process and why

Account data. If you create an account with email, we store your email address, a password hash (never the password itself) if you set a password, an optional display name, your interface language and the language you are learning. We send you one-time codes by email to confirm your address, sign you in, reset your password or confirm account deletion. We do not send marketing emails.

Guest account. On first launch the app creates an anonymous guest account without an email, so that your progress is saved from the first minute. It is linked only to a random identifier and a session token stored on your device. If you later sign in, the guest account becomes your full account and keeps its data.

Sign in with Apple and Google Sign-In. If you choose one of these options, we receive from Apple or Google an account identifier, your email address (with Apple this may be a private relay address) and, with Apple, your name if you agree to share it. For Sign in with Apple we also store a token that allows us to revoke the connection with Apple when you delete your account.

Learning data. To provide the Service and sync it between your devices we store: your personal dictionary (saved words, their translations and the example sentences saved with them), learning and training progress, daily goal and streak, which catalog books and dialogues you opened and where you stopped reading or listening, your notes and the text passages you highlighted, and app settings. A short history of previous versions of these records (up to 14 versions) is kept so that sync conflicts and mistakes can be undone.

Your own books, articles and texts. Files and texts you import (for example EPUB, PDF, DOCX, TXT or a web article) are processed and stored only on your device. We do not receive their content or titles. The following can still leave your device: words and example sentences you save to your dictionary, notes and highlighted passages, your reading position (linked to a random identifier of the imported item) and the sentences or passages you send to AI features (see below). Imported files may be included in your device backup (iCloud or Google) according to your device settings; that backup is controlled by you and Apple or Google, not by us.

Articles by link. When you add an article by its web address, your device downloads the page directly from that website. The website receives your IP address and the usual technical information of a web request, as with any browser. We do not receive the address or the content of the page.

AI explanations and translations. When you ask for the meaning of a word, a translation of a sentence or a translation of a selected passage, the app sends to our server: the word, the sentence and a limited amount of surrounding text, the selected passage (up to about 150 words), your language, the language you are learning and the identifier of the book. Our server forwards this text, without your name, email or account identifier, to our AI provider OpenRouter, which routes it to the model provider that generates the answer. We configure the requests so that they are only routed to providers that do not use the data to train their models. To save cost and answer faster we keep the answers in a cache: answers about catalog books are shared between users and contain no personal data; answers about your own texts are kept in a personal cache linked to your account. Our AI request log contains no texts and no answers, only technical data such as the time, type of request, language, model, response time, cost and result code. If you report a wrong AI answer, we receive the sentence and the answer so we can check the mistake.

Audio. Catalog books and dialogues come with recorded narration that is downloaded from our server. Your own texts are read aloud by the voice built into your device; this happens on your device. Where the app offers server voicing of your own text, the text you choose is sent to our server and to our text-to-speech provider (through OpenRouter) to produce the audio, and the text and audio are deleted from our server after 30 days.

Purchases and plan. Subscriptions are sold and charged by Apple (App Store) or Google (Google Play). We never see your card or payment details. We use RevenueCat to check the status of your subscription. RevenueCat receives your store purchase data (product, purchase and renewal dates, store transaction identifiers, country and price as reported by the store) together with a pseudonymous ReadKick user identifier, and tells our server whether Premium is active and until when. We also count how much of the free plan you have used each month (catalog books opened, AI requests, imported books, articles and texts) to apply the limits of your plan.

Support and feedback. When you send feedback or a bug report, we receive your message, your email if you provide it or if you are signed in, the app version, your platform (iOS or Android) and the random installation identifier, so that we can answer and fix the problem.

Technical and security data. When the app talks to our server we process your IP address, a random installation identifier created by the app (it is not a hardware or advertising identifier), your device model and operating system version, the app version, and the time of requests. We use them to keep you signed in, to show you the list of your signed-in devices, to protect the Service against abuse (for example by limiting the number of requests and code attempts), to diagnose errors and to keep the Service secure.

Our own usage statistics. Our server counts, per day, how many installations were active and how often catalog content was downloaded, and keeps simple daily counters of app events (for example "a lesson was completed"). These statistics are used in aggregated form to run and improve the Service and to plan server capacity. We also look at aggregated statistics of the words saved in dictionaries (for example which words are saved most often) to improve the dictionary and the catalog.

Optional analytics and crash reports (Firebase). The app contains Google Firebase Analytics and Firebase Crashlytics. Analytics tells us which screens and features are used (with catalog identifiers and counters only, never your words, texts or notes); Crashlytics sends technical reports when the app crashes. Both use an identifier generated by Firebase for the app installation; we do not give Firebase your name, email or account identifier. In the European Economic Area, the United Kingdom and Switzerland, both stay switched off unless you switch them on in Settings → Privacy. In other countries they are switched on by default and you can switch them off at any time in Settings → Privacy. The "Ad measurement" switch is described in section 9.

Reminders. Daily reminders are scheduled and shown by your device. We do not use push notification services.

4. Legal bases

We process personal data on the following legal bases under the EU General Data Protection Regulation (GDPR):

• Performance of our contract with you (Art. 6(1)(b) GDPR): creating and running your guest or full account, sign-in, sync, the personal dictionary, progress, notes, AI explanations and translations you request, audio, applying free and Premium limits, checking your subscription, sending sign-in and verification codes, answering your support requests and deleting your account.
• Our legitimate interests (Art. 6(1)(f) GDPR): keeping the Service secure and preventing abuse and fraud, diagnosing errors, aggregated usage statistics, improving the dictionary and AI answers based on aggregated data and your reports, defending legal claims, and, outside the EEA, the UK and Switzerland, analytics and crash reports that you can switch off. You can object to processing based on legitimate interests at any time (see section 7).
• Your consent (Art. 6(1)(a) GDPR and Art. 22(2) of the Spanish Law 34/2002, LSSI): Firebase Analytics and Crashlytics in the EEA, the UK and Switzerland, and any ad measurement. You can withdraw your consent at any time in Settings → Privacy; this does not affect the lawfulness of processing before the withdrawal.
• Legal obligations (Art. 6(1)(c) GDPR): handling your privacy requests, keeping the records the law requires, and responding to lawful requests from authorities.

You do not have to give us your email or name: you can use the app as a guest. Some data, such as the technical data needed to deliver content and the text you send to AI features, is necessary to provide the Service; without it the related feature cannot work.

5. Who receives your data

We do not sell your personal data and we do not share it with third parties for their own advertising. We use the following service providers, who process data on our behalf under data processing agreements and only according to our instructions:

• Hetzner Online GmbH (Germany): hosting of our server and database in data centres in the European Union.
• Cloudflare, Inc. (USA): encrypted storage of database backups (Cloudflare R2) and DNS for our domains.
• Resend (USA): delivery of emails with one-time codes.
• RevenueCat, Inc. (USA): subscription status management.
• OpenRouter, Inc. (USA) and the AI model providers it routes requests to: generation of AI explanations and translations and, where offered, server voicing of your own texts. The models currently used are made by OpenAI and DeepSeek and are run by OpenRouter's hosting partners.
• Google (Google Ireland Limited and Google LLC), Firebase: optional analytics and crash reports as described in section 3.

Apple and Google also process your data as independent controllers when you download the app, buy a subscription, sign in with Apple or Google, or use their operating system features. Their own privacy policies apply to that processing.

We may disclose data if the law requires it, to protect our rights or the safety of users, or to a successor if the Service is transferred; in that case we will inform you in advance.

6. International transfers

Some of our providers are located in the United States or may process data outside the European Economic Area. When personal data is transferred outside the EEA, we rely on an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework where the provider is certified) or on the Standard Contractual Clauses approved by the European Commission (Decision (EU) 2021/914), together with additional safeguards where needed, such as encryption in transit and data minimisation (for example, AI providers do not receive your name, email or account identifier). You can ask us for more information or a copy of the relevant safeguards at support@readkick.app.

7. How long we keep data

• Account, learning data, notes and settings: until you delete your account or your data.
• Guest accounts: deleted automatically after 6 months without use, unless they have an active Premium subscription.
• Unfinished sign-ups (email entered but never confirmed): deleted after 7 days.
• One-time codes: stored only as a hash and valid for 15 to 60 minutes.
• Personal AI answer cache: 180 days, or until you delete your account.
• AI request log (no texts or answers): 90 days; when you delete your account, the log entries are unlinked from it.
• Server voicing of your own texts (where offered): text and audio 30 days.
• Support and feedback messages: until the issue is resolved and for no longer than 24 months; deleted earlier when you delete your account, unless we need them to handle an ongoing request.
• Subscription status and monthly usage counters: until you delete your account.
• Security and error logs: error reports up to 90 days; server access logs with IP addresses are overwritten automatically within a few weeks; records of security-relevant actions (such as account deletion) up to 12 months.
• Daily statistics by installation identifier: up to 400 days; aggregated statistics without personal data may be kept longer.
• Firebase Analytics data: up to 14 months; Crashlytics reports: up to 90 days.
• Backups: copies of the database are overwritten within 30 days, so deleted data disappears from backups within 30 days.
• RevenueCat: purchase records are kept by RevenueCat for as long as needed for subscription management and accounting, and are deleted when we request deletion of your customer record after you delete your account.

8. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy;
• rectify inaccurate data;
• erase your data;
• restrict processing;
• object to processing based on legitimate interests;
• data portability, receiving your data in a structured, machine-readable format;
• withdraw your consent at any time, without affecting earlier processing.

You can do much of this directly in the app: Settings → Account → Export my data gives you your dictionary, progress, settings, reading positions and notes as a JSON file; Settings → Account → Delete account (or Delete my data for a guest) erases your data; Settings → Privacy controls analytics and crash reports. For anything else, write to support@readkick.app. We will answer within one month (this can be extended by two more months for complex requests, in which case we will tell you). We may ask you to confirm that the account is yours, for example by a code sent to your email.

You also have the right to lodge a complaint with a data protection supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You can also contact the authority of the EU country where you live or work. We would appreciate the chance to resolve your concern first.

9. Advertising and tracking

ReadKick contains no advertising. We do not track you across apps and websites owned by other companies. On Android, Firebase Analytics may read the device's advertising identifier while the "Ad measurement" switch in Settings → Privacy is on (it is off by default in the EEA, the UK and Switzerland); we use it only for aggregated statistics and you can switch it off there at any time, or reset or delete the identifier in your Android settings. On iOS we do not access the advertising identifier.

10. Deleting your account

• In the app: Settings → Account → Delete account. Guests: Settings → Account → Delete my data.
• On the web: https://readkick.app/account/delete (also available at https://api.readkick.app/account/delete). Enter the email of your account and confirm with the code we send you.

When you delete your account we immediately delete your account data, sign-in identities, sessions and devices, dictionary, progress, notes, settings, sync history, plan and usage counters, personal AI cache and voiced texts, and we revoke the Sign in with Apple connection. Copies in backups are overwritten within 30 days. Data on your device (including imported books) is removed by the app when you delete your account or data, and in any case when you uninstall the app.

Deleting your account does not cancel your subscription. Subscriptions are managed by Apple or Google: cancel yours in your App Store or Google Play account settings.

11. Children

ReadKick is not directed at children. You must be at least 16 years old to use the Service. We do not knowingly collect personal data of anyone under 16. If you believe that a child under 16 has given us personal data, please contact support@readkick.app and we will delete it.

12. Security

We protect your data with appropriate technical and organisational measures, including: encryption of all connections between the app and our server (HTTPS); passwords stored only as salted scrypt hashes; one-time codes and session tokens stored only as hashes on the server; session tokens kept in the secure storage of your device; limits against password and code guessing; restricted administrator access protected by two-factor authentication; encrypted off-site backups; and keeping personal data out of AI requests and analytics. No system is completely secure, but we work to protect your data and will notify you and the authorities of a personal data breach where the law requires it.

13. Automated decisions

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. AI features only generate learning content that you request.

14. Changes to this policy

We may update this policy when the Service or the law changes. We will publish the new version with a new date on this page and, for significant changes, inform you in the app before they take effect.

15. Contact

Aleksei Prokhorov, Spain. Email: support@readkick.app. Website: https://readkick.app.