Privacy policy
Last updated: 1 November 2026
Capítula is your reading journal. What you write in it is yours and it is private: we don't read it, we don't sell it, and we don't use it to train models or for advertising. Here is, with no small print, what data we process and why.
1. Who is responsible
The data controller is Capítula. For anything privacy-related, write to privacy@capitula.app. We answer within one month at the latest.
To use the app you need an account (with your email, Apple or Google). Your library and journal are saved on your phone first and synced to your account so you don't lose them.
2. What data we process and why
| Data | What for | Legal basis | How long |
|---|---|---|---|
| Account: email, your Apple or Google identifier if you sign in with them, username (@), display name, language, avatar and the date you accepted the terms. | Creating your account, letting you sign in without a password and syncing your data. | Performance of a contract (Art. 6(1)(b) GDPR). | For as long as you have the account. |
| Date of birth. | Checking the minimum age and protecting minors (private profile, no adult content). | Legal obligation (Art. 6(1)(c) GDPR and Art. 7 of Spain's LOPDGDD). | For as long as you have the account. |
| Journal and library, when synced: entries, notes, reactions, progress, shelf and any photos you choose to upload. | Keeping them in the cloud and on all your devices. | Performance of a contract (Art. 6(1)(b) GDPR). | For as long as you have the account. The journal is stored encrypted at rest. |
| Sessions and sign-in codes: session tokens and magic links, stored only as cryptographic hashes. | Keeping you signed in and signing in by email. | Performance of a contract (Art. 6(1)(b) GDPR). | Codes expire after 15 minutes and are deleted the next day; sessions after 90 days unused. |
| Usage analytics (Amplitude, EU servers): which screens and features are used, with a random identifier per installation and, if you have an account, your account's internal identifier (pseudonymous: never your email, name or @username). Never the text you write. | Learning what works and what to improve. | Legitimate interest (Art. 6(1)(f) GDPR). You can switch it off in Settings. | Up to 12 months. |
| Crash reports (Sentry): what failed, in which version and on what kind of device. Server errors also carry your account's internal identifier (pseudonymous); never your email, your IP or what you write. | Finding and fixing bugs. | Legitimate interest (Art. 6(1)(f) GDPR). | Up to 90 days. |
| Clicks on buy links ("Get it"): store, book (our reference or its ISBN and, when there is no ISBN, the title and author used to search the store), the store's country, whether the link carried an affiliate code, the news item you came from if you came from one, your account if you were signed in, and a keyed hash of the browser (never the browser string itself). We do not store your IP address. | Counting affiliate clicks and learning which stores you find useful. | Legitimate interest (Art. 6(1)(f) GDPR). | Up to 3 years as a count. If you delete your account, they are no longer linked to you. |
| News and releases (only if you turn it on): the Expo push token of each phone where you have it on, with its system (iOS or Android), app version, language, time zone and when we last saw it; the date you gave your consent; and, for each news item, when we sent it, whether it arrived, and whether you opened it, viewed it, hid it, added the book to Want to read or tapped to buy it. | Telling you about books that are coming out or can be preordered, by notification and in your library. A news item may be aimed only at readers of a given language, at readers with books by that author or from that series in their library, or at readers who don't have that book yet. The time zone keeps us from writing to you between 23:00 and 9:00, and we never send more than 3 a day. The statistics tell us which news items interest you. | Consent (Art. 6(1)(a) GDPR): the News and releases switch. You can withdraw it at any time in Settings or in your phone's notification settings. | The token is deleted when you sign out on that phone, when you turn news off, when you delete your account, and automatically after 6 months without the app opening. The delivery history is deleted with your account. |
| Covers you propose: the cover photo you propose for a book, the book or edition, and the proposal's status (pending, approved or rejected). | Improving the shared catalog. Our team reviews every proposal before anyone else sees it. If we approve it, we strip the image's metadata (such as location), copy it into the catalog and every reader of that book sees it, without saying who proposed it. You can see its status in the app. | Consent (Art. 6(1)(a) GDPR): it is only sent if you tap "Propose". | The proposal is deleted with your account. A cover we have already approved is part of the catalog and stays there even if you delete your account, with nothing linking it to you; if you want us to remove it, write to us. |
| Support messages: whatever you email us (at hola@capitula.app or privacy@capitula.app). | Helping you. | Legitimate interest (Art. 6(1)(f) GDPR). | Until resolved, and one year after. |
| Server logs (IP address, time and path of each request). | Security and abuse prevention (for example, limiting sign-in attempts). | Legitimate interest (Art. 6(1)(f) GDPR). | 30 days at most. |
We do not collect your location, contacts, health or financial data. The camera is only used to read a book's barcode (that image never leaves your phone) or, if you choose, to take a photo of its cover.
3. What we never do
- We don't sell or rent your data to anyone.
- There is no third-party advertising and no cross-app tracking (we don't use the advertising identifier). Book news only reaches you if you turn it on.
- Your private journal is never used for recommendations, content analytics or to train artificial intelligence models.
- Links to stores carry nothing about you: the store only learns that you came from Capítula.
4. Who we share it with
Only with providers that help us run the service, acting as processors under contract and only on our instructions:
- Railway, which hosts in the EU the server and the database (in the Netherlands) and the photos you upload: it stores all the data in the table above that lives on our servers.
- Cloudflare, for capitula.app's DNS and to forward to us the email you send to its addresses (such as hola@capitula.app or privacy@capitula.app): it sees your email address and your message.
- Resend, to send sign-in emails: it receives your email address and the sign-in link or code.
- Amplitude (EU region), for usage analytics: it receives the events and the pseudonymous identifiers described above.
- Sentry (data stored in the EU, in Germany), for crash reports: it receives the error, the app version, the kind of device and, for server errors, your account's internal identifier.
- Expo (EAS push service), to send news if you turn it on: it receives your phone's token and the notification's text, and delivers it through Apple (APNs) or Google (FCM). Expo also serves the app's updates.
If you sign in with Apple or Google, they verify your identity under their own policies. If you tap a buy link, the store (Amazon, Casa del Libro, Fnac, Bookshop.org…) processes your data as an independent controller once you reach its site; if you buy, we may earn a commission, at no extra cost to you.
Where a provider processes data outside the European Economic Area, it does so with appropriate safeguards: the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.
We would only disclose data to an authority where the law requires us to.
5. Minimum age and minors
You must be at least 14 years old to create an account (the age of digital consent in Spain). If you enter a younger age, the account is deleted there and then.
Accounts of under-18s are always private: they have no public profile and never see content marked for adults. If you believe a child under 14 has given us their data, write to us and we will delete it.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given us:
- Much of it directly in the app: editing your profile, exporting your data as a file and deleting your account.
- For everything else, write to privacy@capitula.app from your account's email address.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority where you live — though we would love to hear from you first.
7. Deleting your account and your data
In the app: Profile→Settings→Account→Delete account. If you don't have the app at hand, you can do it from this page by confirming your email.
Deletion is immediate and permanent: your account, your synced journal, your library, your photos, your sessions and your sign-ins, your push tokens, your news history and your cover proposals are removed from our database, and if you signed in with Apple we revoke the app's access to your Apple ID. What remains, with nothing linking it to you, are the clicks on buy links (as an anonymous count) and the covers we have already approved for the catalog. Backups roll over within 30 days. Whatever is stored only on your phone stays on your phone.
8. Security
Every connection is encrypted (HTTPS). The journal is stored encrypted at rest, sessions and sign-in codes only as cryptographic hashes, and access to our systems is restricted to those who need it. No system is infallible: if a breach ever affects you, we will tell you and notify the authority as the law requires.
9. Changes to this policy
If we change anything important, we will tell you in the app before it applies. The date at the top shows the latest version.