Privacy Policy

1. Information we process

Account information. When you sign in with Apple or Google, we receive the account identifier and the profile details that the provider makes available, such as your name, email address, profile picture and language. We keep account and session records to recognise you and protect access. Tobien does not receive your Apple or Google password.

Books and learning activity. We process files you choose to import, their extracted text, images and book details, your library, reading position, reading history, vocabulary, learning preferences, review answers and progress. This makes it possible to resume reading and prepare practice based on what you have read.

Conversations and requests. We process questions you send to the AI mentor, relevant passage context, conversation history and generated responses. We also process information you send when contacting us for support or exercising your privacy rights.

Technical and usage information. Operating the service involves connection and request information, which can include IP addresses, timestamps and error information. We record AI usage, including account identifiers, the provider and model, request purpose, token counts and costs, to operate usage limits and investigate problems.

2. Why we use information

We use account, book and learning data to provide the features you request: signing in, importing and reading books, explaining language, maintaining your vocabulary and conversations, and preparing and scheduling practice. Where the GDPR applies, the legal basis is performing our agreement with you.

We use necessary operational records to secure accounts, prevent misuse, diagnose failures, manage service capacity and answer support requests. These uses rely on our legitimate interests in maintaining a reliable and secure service, balanced against your rights.

Where we ask for consent for optional processing, you may withdraw it for the future. Device permissions can be changed in iOS settings. We may also process information where necessary to comply with a legal obligation or respond to a lawful request.

3. AI explanations and conversations

Language features send relevant text to external AI services. This can include words and sentences from a book, the surrounding context, your question and conversation history, and language or learning settings. Some explanations are prepared in the background as a book is imported or read, rather than only after a question is sent.

Tobien supports processing through OpenAI, Anthropic and OpenRouter, depending on the model configured for a feature. OpenRouter may route requests to the provider running the selected model. These providers process the submitted content to return the requested explanation or exercise. Contact us if you need the provider details that apply to a particular request.

Generated explanations and translations may be cached to avoid generating the same analysis repeatedly. Conversations and study results are saved to support history and continued learning. Avoid including sensitive personal information or confidential documents that you do not want processed in this way.

4. Voice input and device permissions

Voice input is optional and uses the device speech recognition service after permission is granted. Depending on your device, language and settings, speech recognition may involve Apple services. It is not guaranteed to run entirely on your device.

Recognised speech appears as text in the message field. The message is sent to Tobien and the AI service when you choose to send it. You can use typed questions instead and revoke microphone or speech recognition access in iOS settings.

5. Who receives information

Information is handled by the infrastructure services needed to host and operate Tobien, by the sign in provider you choose, and by the AI services described above. The operator may access relevant records to support users, resolve failures, administer accounts and investigate misuse.

Imported books belong to your personal library and are not published to a public catalog by the import feature. Processing by hosting and AI services is still necessary for the features described in this policy.

We may disclose information when legally required, to protect people or the security of the service, or in connection with a lawful transfer of the service. Any such disclosure must have an applicable legal basis. The current app does not include advertising or third party marketing analytics SDKs.

6. Device storage and the website

The app stores authentication information in device secure storage. Preferences and local copies of library, vocabulary, conversation and review data are also stored on the device. Downloaded review packs and answers waiting to synchronise enable offline practice. Signing out clears account specific local caches, but does not by itself delete your server account.

The website uses browser session storage for authenticated administration features. The public pages load fonts from Google Fonts, which causes your browser to send connection information, including its IP address, to Google when retrieving the fonts.

Links to book catalogs, sign in services and other external websites lead to services with their own privacy notices. Their processing outside Tobien is governed by those notices.

7. Retention and deletion

Account, library and learning information is retained to provide your account and its history. Retention is assessed by whether the information is still needed for the service, to resolve a support request or dispute, or to meet an applicable legal obligation. Different categories, including temporary analysis caches and operational records, can have different retention periods.

You can remove an imported book or delete a conversation where the app offers those controls. Removing a book from your shelf is not the same as deleting the imported content. Removing the app from your device also does not delete information held on the server.

To request deletion of your account or other personal data, email vd@tobien.app. We may need to verify that the request concerns your account. Deletion can require separate processing of account records, content, caches and backups. Information that must be retained for a lawful reason is limited to that purpose; we do not promise that every copy disappears immediately.

8. International processing and security

Tobien is operated from Spain, but service providers may process information in other countries, including countries outside the European Economic Area. Contact vd@tobien.app for information about the destinations and transfer arrangements relevant to your data, including applicable safeguards.

We use access controls and authenticated services to protect account data. No online service or device storage is completely free of risk. Keep your device and sign in account secure, and contact us if you suspect unauthorised access to Tobien.

9. Your privacy rights

Depending on the law that applies and the circumstances, you can request access to your personal data, correction, erasure, restriction of processing or a portable copy. You can object to processing based on legitimate interests and withdraw consent where processing relies on it, without affecting processing that was lawful before withdrawal.

Send requests to vd@tobien.app. Under the GDPR, we normally respond within one month. If a lawful extension is needed, we will explain the reason and timing. You may complain to the Spanish Data Protection Agency, AEPD, or your local supervisory authority.

Tobien uses learning activity to adapt exercises and suggest suitable reading. These educational suggestions are not decisions about legal rights, employment, credit or access to essential services.

10. Children and changes to this policy

Tobien is not designed specifically for children. Where parental authorisation is required by law, it must be obtained before personal data is provided. If you believe a child has provided information without the required authorisation, contact us so we can investigate and address it.

We may update this policy as the service changes. The date at the top identifies the latest version. If a change materially affects how we process personal data, we will provide notice and obtain consent where the law requires it.