Privacy Policy

1. Information we do not collect

The app creates no account. It never asks for your name, e-mail address, phone number or date of birth, and there is no sign-in step.

We operate no server that receives data from the app. The app contains no advertising, tracking or analytics SDK, so no advertising identifier and no usage statistics are gathered.

As a result, we cannot know which files you read or when you use the app.

• No account and no sign-in
• No server operated by us
• Zero advertising, tracking or analytics SDKs
• No feature uses location data

2. Information processed only on your device

The comic, webtoon and novel files in your library, your folder structure, reading positions, bookmarks, reading statistics and streaks, and app settings are stored on your device and processed there.

Speech-bubble translation runs on the device through Apple's Translation, Vision and CoreML frameworks. Page images and the text recognised in them are never sent to us or to any third party.

The local AI translation benchmark also runs entirely on the device. Unless you post a result to the leaderboard, no measurement leaves your device.

3. iCloud Drive sync

So that you can continue reading on another device, only your reading positions, favourites, bookmarks in novels (TXT, MD and EPUB) and folder structure (folder names, the books in each folder, and which folders are hidden) are synced as JSON sidecar files. Each reading-position entry also carries an identifier created at random when the app is installed and, for novels, a passage of up to 40 characters from the text at that position, used to find the position again. By default, both files are kept in this app's space inside your own iCloud: the reading position and bookmark file in the “Penguin Viewer” folder of iCloud Drive, and the folder structure file in a location that the Files app does not show. If you choose your own sync folder in Settings, both files are kept in the folder you chose.

Comic and novel files themselves are never uploaded. The sidecar files belong to your Apple Account and we have no access to them.

Turning iCloud sync off in the app's settings stops the sync immediately. Sidecar files already in iCloud are removed when you delete this app's data in iCloud storage management on your device. If you chose your own sync folder, delete the sidecar files from that folder.

4. Servers you connect yourself

When you connect an SMB (NAS), WebDAV or OPDS server, the app contacts that address to read its listing and files. Which server is contacted, and when, is entirely your decision.

Server passwords are stored in the device keychain, and server addresses and user names in the app's settings on the device; they are never transmitted to us.

Privacy and security on a server you connect are the responsibility of whoever operates it, which is usually you.

5. Benchmark leaderboard

Posting to the leaderboard is optional. Only when you enter a nickname and post a result is that result sent to the Apple CloudKit Public Database (container iCloud.com.penguinviewer.app).

A nickname must be 1 to 12 characters after trimming spaces and must pass a profanity and hate-speech filter. There is one record per device model on the same Apple Account, and posting a new measurement replaces your previous record with the most recent one, whatever the score.

The leaderboard list is visible to everyone who uses the app. It shows the top 500 records measured with the same translation pipeline version as the viewer's device. The upload contains no name, no e-mail address and no information about the books you read. Posting requires the device to be signed in to iCloud, and so that each device model on one account holds a single record, the record name combines an account identifier issued by CloudKit with the device's hardware model identifier (for example, iPhone17,1). The account identifier is an opaque string valid only inside this app's container; it is neither your e-mail address nor your real name. A record saved under the earlier one-record-per-account name is deleted the next time that account posts.

You can hide another user's record on your own device, and you can report a record for an inappropriate nickname or a suspected fake result. A record reported by three or more different users is hidden from the list. A report stores the target record name, the reason given and, so that repeated reports from one person are counted once, an identifier for the reporting account issued by CloudKit.

The app has no button that deletes a record you posted. If you want yours removed, write to krausehaileydanielle@gmail.com with the nickname you used and we will delete that record after verification.

Leaderboard records and reports are kept for us in CloudKit by Apple Inc. (USA; contact: apple.com/legal/privacy), so they are transferred abroad. The information transferred is the items listed below and the record name (the account identifier and the hardware model identifier), plus the report record if you report one. It is sent over the network when you post or report, used only to run the leaderboard, and kept for the periods in section 9. If you do not want this transfer, do not post to the leaderboard or report records; your record is then not shown on the leaderboard, and the rest of the app works as usual. A record you have already posted can be deleted on request as described above.

The items sent when you post to the leaderboard are:

• Nickname
• PVScore
• Total time (ms)
• Per-stage times — detection, OCR, translation, inpainting (ms)
• Peak memory use (MB)
• Device model
• Chip name
• Device memory size (GB)
• OS version
• App version
• Translation pipeline version
• Translation mode — Low latency or Quality first (only on iOS, iPadOS and macOS 26.4 or later)
• Time of measurement

6. MyAnimeList link

Linking MyAnimeList is optional and is off until you set it up.

The link is established on MyAnimeList's own OAuth 2.0 authorisation page. We never see or store your MyAnimeList password; only the issued access and refresh tokens are kept in the device keychain.

Once linked, the app reads your account name, searches series by the book's title or the search text you enter, and reads or updates the reading status and the number of chapters and volumes read for the series you have linked. The files in your library are never sent.

Information sent to MyAnimeList is handled under MyAnimeList's own privacy policy. Disconnecting the link in Settings deletes the token stored on your device.

7. Device permissions

The app asks for each permission below only at the moment the corresponding feature is used. If you decline, the app still runs and only that feature is unavailable.

• Face ID / Touch ID — unlocks the app lock and opens hidden folders. For a hidden folder, the device passcode or Mac login password is used when biometrics are unavailable. The app receives only whether authentication succeeded; biometric data never leaves the device's secure enclave.
• Photo library (read) — accessed only to import an album or photos you select as a comic. Photos are not uploaded.
• Photo library (add) — used when you save the benchmark result card as an image.
• Local network — used to connect to a NAS or server on the same network.

8. Payment

The Pro Lifetime purchase is handled by Apple through the App Store and StoreKit. We do not receive and cannot see card numbers or any other payment details.

The app only checks the purchase recorded on your device to decide whether the library limit is removed. Cancellations and refunds are handled by Apple.

9. Retention

Retention depends on where the information is kept:

• On-device data — kept only on your device until you delete the item in the app or delete the app's data from the device.
• iCloud sidecar files — kept in your iCloud until you delete this app's data from iCloud, or, if you chose your own sync folder, until you delete the files from that folder.
• Leaderboard record — stays in the public database until a newer measurement posted from the same device model on the same Apple Account replaces it or it is removed on request.
• Report records — kept for report counting until the target record is deleted.
• MyAnimeList access token — deleted from the device when you disconnect the link.

10. Third parties

We do not sell your information and never share it for advertising. Apart from inquiry e-mails (section 14), information reaches a party other than us in only three cases:

• Apple — iCloud Drive sync, the CloudKit Public Database used by the leaderboard, and App Store payment.
• MyAnimeList — search text and reading progress, only if you have linked your account.
• NAS, WebDAV or OPDS servers you connect yourself.

11. Your rights and security

You can turn iCloud sync off, remove a connected server, disconnect MyAnimeList, and request deletion of your leaderboard record at any time.

Server passwords and the MyAnimeList tokens are stored in the device keychain. Traffic to CloudKit, the App Store and MyAnimeList uses encrypted connections.

Write to krausehaileydanielle@gmail.com to exercise these rights or to ask a question. We act on requests without undue delay once they are verified.

12. Children

The app is not directed at children under 14, or under the age set by the law of your country, such as 13 in the United States. Apart from leaderboard posts (section 5) and inquiry e-mails (section 14), we collect no personal information from children.

If a guardian tells us that a child posted a nickname to the leaderboard, we will delete that record on request by e-mail.

13. Changes to this policy

When this policy changes we publish the new text and its effective date on this page.

14. Business information and contact

Privacy questions, leaderboard removal requests and any other request are received at the e-mail address below, which is our only contact channel.

• What we receive: your e-mail address and what you write or attach, plus the app version, OS version and purchase-status diagnostic code that the app pre-fills in the message when you write from the app's contact button.
• Purpose: used only to answer you and to find and fix problems; never shared with third parties or used for advertising or marketing.
• Retention and deletion: e-mails are kept in the e-mail service we use (Gmail) and copied into our internal inquiry-handling list so we can prepare a reply. We delete the e-mail and the list entry one year after your inquiry is resolved, and without delay if you ask.
• Processors and transfer abroad: inquiry e-mails are stored on servers of Google LLC (USA, Gmail), and we may use Anthropic PBC (USA, Claude) as an AI tool that helps draft replies, so the content of your inquiry is processed on its servers while we prepare a reply. The information transferred is the information listed above; it is sent over the network when you send the e-mail and while we prepare the reply, and it is kept for the period above. Contacts: policies.google.com/privacy · anthropic.com/legal/privacy. If you do not want this transfer, do not send an inquiry e-mail; we then cannot reply to you by e-mail.