Privacy policy
Last updated 30 September 2026
FinnBook is an ebook reader for iPhone and iPad, made by Maziar Rezvani. This policy covers the FinnBook app and this website. It is written to be read, not to be survived, so it says plainly what leaves your device and what does not.
Nothing about what you read is ever part of our analytics. Not titles, authors, series, tags, file names, the addresses of your Calibre servers, your searches, your bookmarks, or your place in a book. Two things you choose can send some of it. If you are on Pro and sign in to sync, your library is stored on our servers so that your devices can share it, used for nothing else, and deleted when you ask. And if you tap Enhance chapter list with AI on a book, that book's headings are sent to be read, once, and not kept.
What stays on your device
Your library and everything about it — the book files themselves, covers, reading positions, bookmarks, notes, themes, goals and your reading history — are stored on your device. There is no account unless you sign in to sync, and there is never a password to give us.
What we do collect
One thing: a small set of anonymized product counts, so we can tell whether features work. This is the complete list of events, and there are no others.
The reading insights FinnBook shows you — your hours, your streak, which books took the time — are worked out on your device. They are never part of these counts, and nothing below mentions them; if you sync, they travel with your library as described under Sync.
| Event | What it carries |
|---|---|
| App opened | Nothing else. It is the denominator that makes the rest meaningful. |
| Import finished | How many books succeeded and how many failed. Counts only. |
| Calibre connection tested | Whether it worked, and if not, the kind of failure — unauthorized, timed out, TLS, server, other. Never the message, never the address. |
| Calibre download finished | The file format: epub or mobi. |
| Paywall shown | Whether you already subscribe. |
| Purchase completed | Whether the plan was monthly or yearly. No amount, no transaction, no storefront. |
| Book opened | Whether it opened, whether it was the first time, and whether it came from an import or from Calibre. |
Every event also carries the app version and a random identifier generated on your device the first time you open FinnBook. That identifier is not your Apple Account, not your device ID, not an advertising identifier, and is not derived from anything about you or your device. It exists only so that two events from the same install can be counted as one install. Delete the app and it is gone for good.
We also switch off the location lookup our analytics provider would otherwise perform: every event is sent with the IP address blanked and geolocation explicitly disabled. We do not know where you are.
Turning it off
The switch is on by default. We would rather say so here than have you find out later: an opt-in default answers none of the questions this exists for, because the people who tick a box are not the people whose import silently failed. Sending as little as possible is the honest mitigation, which is why the list above is as short as it is.
To switch it off, open Settings → Privacy in FinnBook and turn off Help improve FinnBook. It takes effect immediately — nothing is queued on the device, so there is no backlog to send. The same list is repeated in the app next to the switch.
What we do not do
- No tracking. Nothing is combined with data from other companies' apps or websites, and no advertising identifier is read. This is why FinnBook never asks for permission to track you.
- No advertising, and nothing is sold or shared for advertising.
- No crash reporting and no session replay.
- No screen recording, no autocapture, no scroll or tap logging.
Sync
Sync is part of FinnBook Pro, and it only starts when you sign in with Apple in Settings → Sync. Then your book files and covers, reading positions, bookmarks, themes, settings, reading insights and Calibre servers are stored on our servers, which run on Cloudflare, so each of your devices can pick up where another left off. It is used for that and for nothing else.
Signing in with Apple gives us a random identifier for your Apple Account and nothing more: we do not ask for your name or your email address, and we do not keep them. The only thing we learn about your subscription is whether it is active and when it ends, which Apple tells our server directly.
Your Calibre passwords are encrypted on your device with a key kept in your iCloud Keychain, which we never hold. Our servers store the encrypted form and cannot open it.
Delete Account, on the same screen, deletes everything we hold for you at once. If your Pro subscription ends and you do not come back, everything we hold for you is deleted 90 days after it ends. Signing out, or ending Pro, never touches what is on your device.
Connections FinnBook makes on your behalf
Your Calibre server
When you connect a Calibre content server, your device talks to your server directly. Nothing is proxied through us and we never learn the address. If the server needs a username and password, they are held in the iOS Keychain on your device and sent only to that server.
Project Gutenberg
Searching or downloading from Project Gutenberg sends that request to Project Gutenberg, who will see it as any website sees a visitor. We are not in the middle of it. See their privacy policy.
Updating a book's metadata
FinnBook Pro can look a book up and offer you a better cover and description. When you tap Update metadata and search, the words you typed into the search field are sent to a small service we run at api.finnbook.app, which passes them to Hardcover, the books catalog that answers. Only what you typed is sent. Nothing about your library, your files, your Calibre server or where you are in a book goes with it, and the search is not logged or associated with you.
The service uses Apple's App Attest to check that the request came from a real copy of FinnBook. That involves a random key created on your device; it identifies the installation to the service and nothing about you. Nothing is searched unless you ask for it.
Enhancing a book's table of contents
Some books arrive with a contents list that is missing or wrong. FinnBook Pro can find the chapters: when you tap Enhance Table of Contents with AI, your device picks out the short lines in that book that could be headings, with the first few words that follow each, and sends them to the same service at api.finnbook.app, which passes them to Anthropic's Claude to find the chapter starts. You see the list it found before anything changes, and nothing changes unless you tap Apply.
Only those lines are sent, from that one book, when you ask. Not the rest of the book, not its title or author, not the file name, not where you are in it and nothing about the rest of your library. We do not store or log what is sent or what comes back; the service keeps only a count of how many times a device used it that day. It is fenced with App Attest in the same way as metadata lookups.
Purchases
FinnBook Pro is sold through Apple's In-App Purchase. Apple handles the payment and tells the app only whether a subscription is active. We never see your payment details — no card number, no billing address, no name.
Who else touches the data
Three processors. PostHog stores the product counts described above, on servers in the European Union. They process it on our instructions and for no purpose of their own. Their policy is at posthog.com/privacy. Cloudflare runs the servers that hold your library if you sign in to sync, on our instructions and for no purpose of their own; their policy is at cloudflare.com/privacypolicy. Anthropic reads the headings of a book when you ask FinnBook to enhance its table of contents, to answer that request and for no purpose of its own; it does not use them to train its models. Their policy is at anthropic.com/legal/privacy.
Apple is involved as described above, for signing in, for purchases and for App Attest. Hardcover receives a search only when you ask for one, as described above. That is the entire list. Nobody else receives anything, and nothing is ever sold.
How long it is kept
Analytics events are kept for up to 12 months and then deleted. Because they carry nothing that identifies you, they cannot be traced back to a person after they are sent. The headings sent to enhance a table of contents are not kept by us at all. What you sync is kept until you delete your account, or for 90 days after your Pro subscription ends. Everything else lives on your device, for as long as you keep it.
Your rights
Depending on where you live, you may have the right to ask what data is held about you, to have it corrected or deleted, or to object to how it is used. In practice, for FinnBook:
- Deleting everything we hold is switching off Help improve FinnBook, which stops any further events, and deleting the app, which destroys the random identifier.
- Deleting your library is deleting the app, and — if you used sync — Settings → Sync → Delete Account, which deletes everything our servers hold for you at once.
- If you want to make a request in writing anyway, get in touch and we will answer.
Our legal basis for the product counts, where UK or EU law applies, is legitimate interest in knowing whether the app works — narrowed by sending as little as possible and by giving you a switch.
Children
FinnBook is not directed at children under 13, and we do not knowingly collect anything from them. There is nothing in the app that asks a user who they are.
This website
finnbook.app is a handful of static pages served by Cloudflare Pages. There are no cookies, no analytics and no trackers on it. Cloudflare keeps standard server and security logs, which is outside our control; see Cloudflare's privacy policy.
Changes
If this policy changes in a way that affects what is collected, the date at the top changes and the app's release notes will say so. Material changes will not be applied quietly.
Contact
Questions about any of this: support@finnbook.app.