Information stored on your device
The current app keeps its reading library on your device. Depending on the features you use, local records can include:
- Local profile name and email, plus password-verification data (a salted bcrypt hash).
- Book titles, authors, genres, page totals, current page or reading position, status, notes, ratings, reading time, and cover-image references.
- Reading-session dates, durations and notes; timer state; and scheduled reading-session details used to display local reminders.
- Theme and language preferences, plus a local sign-in session marker.
- PDF/EPUB files you select, copied into the app’s private document area, and cover images you choose from your device.
Local profiles and passwords
The current app stores local profile passwords as SHA-256 pre-hashes followed by individual random-salt bcrypt hashes (cost factor 10); new passwords are not stored as plain text. Existing local credentials have a migration path to the hash format. Passwords and hashes are not sent to a Librix server because profiles are device-local. Librix does not encrypt the SQLite database, so protect access to your device and avoid reusing an important password. These safeguards apply only to app builds that include this update; older installed builds may still store passwords in plain text.
No Librix cloud library or advertising profile
The inspected version does not implement a Librix-operated account backend, cloud library synchronization, or an advertising or analytics SDK. Your profile, book list, progress, notes and reading history are not uploaded to a Librix server by the app. This describes the current app code and may change in a future version.
Backups and sharing
The current JSON export includes the local profile ID, name and email but excludes both the password and its hash. Restoring a backup asks you to create a new local password. The export can also include book records and progress, reading sessions, notes, preferences, scheduled sessions, timer state and file references, but it does not embed PDF/EPUB contents. Librix does not encrypt exported JSON. Older app builds may have created backups containing a plain-text password; treat those older files as sensitive and delete them separately.
Third-party websites and technical requests
PDF and EPUB files are processed in the app’s embedded reader. Page-count analysis uses a PDF.js copy bundled with Librix. Opening a PDF in the reader loads PDF.js from cdnjs, so that provider may receive ordinary request metadata such as your IP address and device/browser details. The inspected reader passes PDF bytes to the embedded WebView for local processing and does not intentionally upload the PDF to the CDN. The in-app browser can also open Google or other sites you choose; those services process visits under their own policies.
Notifications and permissions
Reading reminders are scheduled as local notifications through the operating system; the inspected app does not use a Librix push-notification server. You can deny or later change notification permission in device settings. The app requests access to a document only after you select it, and requests photo-library permission when you choose a cover image.
Retention and deletion
The current app provides Account → Delete profile. After confirmation, it deletes the local profile and associated books, reading history, preferences, timer state and scheduled-session records; cancels local reminders; and attempts to remove app-managed book/cover files and cached export copies where the operating system permits. If cleanup reports a warning, clear Librix storage in device settings. Backups saved or shared outside the app remain separate and must be deleted by you. This control is available only in builds that include the update; use the device-level instructions below if you do not see it.
Security
The current app stores password verifiers as individual salted bcrypt hashes (cost factor 10), preceded by a SHA-256 pre-hash. Passwords are not kept as plain text, but hashing does not encrypt the SQLite database. Librix does not encrypt the database, book notes, PDF/EPUB files or exported JSON. Current exports omit the password and hash but are not password-protected. Protect your device and any files saved outside the app. These safeguards describe builds containing the current update; older app builds may differ.
The Librix website
This notice primarily describes the mobile app. Viewing the public website does not submit your Librix library or local profile to the app developer. The site stores a theme preference in your browser when you change it. The hosting platform may process technical request information needed to deliver and protect the website; its practices are separate from the mobile app.
Changes and contact
This notice may be updated when the app or its data practices change. The “Last updated” date above identifies the latest revision. For a privacy question, use the Librix repository issue page linked below; repository issues are public, so do not post passwords, book files or other sensitive information there.