Privacy Policy

Burrow is designed as a private reading companion. Your library and reading records stay on your device. Some features use the remote services described below.

Effective date: 20 October 2026

Information stored on your device

Your books, reading history, sessions, goals, notes, quotes, shelf organisation and preferences are stored locally on your device. Burrow does not require a Burrow account and does not upload this library to a Burrow-operated server or sync it to a Burrow cloud account. Your local reading records are distinct from the book queries, optional shelf-recognition requests and purchase information described below. iOS backups and sharing or exporting information are under your control.

Catalogue searches and covers

When you search for a book, author or ISBN, Burrow sends the query to Open Library, operated by the Internet Archive, to obtain catalogue records and covers. Recognition can also produce ISBN or text queries. Requests for editions and covers identify the requested book record or image. These services receive the query or requested URL and ordinary network information, including your IP address. Internet Archive describes retaining access logs including requested pages, IP addresses and access times; it does not give a specific retention period for Burrow's API queries. See the Open Library API documentation and Internet Archive privacy policy. Burrow's local recent-search list is separate from the service's request handling.

Purchases and subscriptions

Apple processes payments. Burrow uses RevenueCat to retrieve products, verify and restore purchases, determine premium access and provide purchase/subscription analytics. RevenueCat receives a persistent, randomly generated Burrow customer identifier and purchase or entitlement information. This is not a name, email address or Burrow sign-in, but it allows purchase records to be associated with the same customer identifier. Burrow does not receive your full payment-card details. See RevenueCat's privacy policy and Apple's privacy policy.

Single-book recognition

Single-book barcode, cover and spine text recognition uses Apple Vision on your device. The image is not uploaded by that recognition path. Extracted ISBN or text may be sent to Open Library for catalogue matching, as described above.

Optional shelf-photo recognition

After taking or choosing a shelf photo, you can inspect it before deciding whether to send it. Choosing Send and find books authorises Burrow to transmit copies or tiles of that photo over HTTPS through its Cloudflare recognition service to fal.ai, whose OpenRouter vision endpoint is configured to use a Google Gemini model. Visible book-spine text is extracted to suggest books. Extracted text, observed ISBNs and candidate catalogue metadata are sent through the same Burrow service to TypeSafe/Jev to check likely matches. TypeSafe does not receive the shelf image from Burrow's verifier. Book queries and covers use Open Library. No private reading notes, sessions or complete saved library are sent as part of these requests.

Retake or Close before Send sends no shelf photo for remote recognition. You can instead search or enter books manually, or use single-book recognition. Each new shelf-photo send is a separate choice; there is no remembered blanket permission. Closing after transmission can stop work still in progress, but cannot recall data that has already reached a provider.

Remote processing and retention

Burrow's proxy implementation does not write shelf-image bodies or extracted recognition content into its own persistent application storage. This does not mean remote providers do not retain data. fal documents 90 days of request input/output history by default, including submitted image payloads and returned recognition text. An account override can change that default; Burrow does not promise zero retention or an earlier deletion deadline. fal's CDN files and model-deployment logs have separate controls, and a request-history setting alone does not establish end-to-end zero retention. See fal retention documentation.

OpenRouter's API documentation says prompts and responses are not stored by default, while optional input/output logging or use settings can enable storage. It retains request metadata for reporting and ranking. The model-serving provider also has its own handling rules: OpenRouter lists different retention for Google AI Studio and Google Vertex. Burrow does not promise a particular Google serving route, regional processing location or an all-provider deletion deadline. See OpenRouter API data handling and provider policies.

TypeSafe's published API customer terms permit processing customer data to provide and bill for the service, derive telemetry, prevent fraud/abuse and meet legal obligations; its data-processing terms restrict personal-data processing to documented instructions. TypeSafe states it will not train models on input without consent. Its standard terms do not promise a fixed short retention period or default zero retention. See TypeSafe customer terms, data-processing addendum and privacy policy. Burrow does not opt you into model training through its recognition request.

Separate optional on-device saving

After recognition you can separately choose to keep the original photo or unresolved crops/evidence on this device. Both choices are off by default. With both off, Burrow saves no local match-attempt or captured-spine records. These controls do not configure remote-provider retention. Where you have saved capture data, use the provided deletion controls to remove the local original or crop/evidence. This does not delete books you already confirmed, or recall copies previously processed remotely.

Service security and abuse prevention

Burrow uses Apple DeviceCheck and an app-generated recognition installation token to protect the recognition service. The token is stored in the device Keychain. The backend stores a deterministic hash of the token and a creation timestamp, and keeps recognition/verification request counts, reservation identifiers and call counters associated with that installation and a day. These pseudonymous records enforce authentication and anti-abuse/budget limits; they are not a real-name Burrow account or an advertising identifier. They have no automatic expiry in the current application implementation: day-based counting does not mean records are deleted after one day. Uninstalling Burrow does not request deletion of these backend records, and Keychain identifiers may survive an uninstall.

Apple, Cloudflare and remote processors also receive network and technical information necessary to deliver and secure requests, such as network addresses, attestation data and request timing. Burrow does not promise these providers keep no operational logs. See Cloudflare's privacy policy.

Advertising, tracking and sale

Burrow does not contain third-party advertising, does not implement cross-app advertising tracking and does not sell your personal information. Sending a request to a named service is not permission for Burrow to upload your local library or private notes for advertising. Provider API data handling is described above; website cookie notices are not a description of Burrow's native API requests.

Retention, deletion and choices

You control local reading data through Burrow and iOS. Deleting local data or the app does not erase provider request history, backend installation/usage records, Keychain identifiers or purchase records; device backups may retain local data under your control. Apple and RevenueCat retain purchase records according to their policies and applicable obligations.

For a privacy or deletion request, contact support@readowl.app. Explain the feature and approximate request date/time so we can assess which records can be located and seek deletion from relevant providers where available. Do not email passwords, installation tokens or payment-card details. Burrow has no in-app automatic remote-deletion control and cannot guarantee it can match every provider record to you, delete records immediately or remove records that must be retained for legal/security purposes. You can decline future shelf-photo sends without deleting your local library. Provider processing may occur outside your country.

Children

Burrow is not specifically directed to children. If you are not permitted to make purchases yourself, use the app only with a parent or guardian. Do not submit children's personal information or unrelated personal documents in shelf photos.

Changes

We may update this policy when Burrow's features or service providers change. The current version will remain available at this URL with its effective date. Material changes to the shelf-photo transmission scope must be reflected in the in-app send explanation before the next transmission.

Contact

Questions or privacy requests: support@readowl.app.