Privacy Policy

1. PDF files, file paths, the library, and bookmarks are not automatically uploaded to TMO Books. The app does not provide its own cross-device library sync.
2. Before the first remote translation, the app names what will be sent and the recipients. Canceling or going back does not grant consent.
3. After consent, extracted text and the target language for each requested page are sent through the TMO Books server to Google Gemini. Email and account ID are not deliberately added to the Gemini request, but the source text itself may identify a person.
4. You can withdraw translation consent in settings. Withdrawal blocks future sends but cannot recall a completed request or automatically delete data already handled by a provider.

TMO Books uses Amazon Web Services for the API, database, operational logs, and email OTP delivery; Google Gemini for consented translation; Apple for App Store purchases; Google AdMob for eligible iOS library advertising; and Google Firebase for separately consented analytics. Depending on the provider, data may be processed outside your country over encrypted transport under that provider's contract and policy.

When a provider handles personal information for TMO Books, the operator requires confidentiality, purpose limitation, appropriate security safeguards, and a level of protection equivalent to this policy through the applicable contract and operational controls. The operator remains responsible for managing those providers within applicable law.

1. The iOS app may show a non-personalized AdMob ad in the library when ad-removal access is inactive. Where required, an eligible ad request occurs only after Google's privacy flow permits it. Non-personalized ads can still involve IP-derived approximate location, ad interactions, app/device identifiers, and diagnostic information.
2. Firebase Analytics starts off and initializes only after a separate opt-in. The app does not set an account user ID. Custom events exclude book title, path, original or translated text, search query, email, OTP, session token, and receipt.
3. Advertising consent does not enable Firebase Analytics, and analytics consent does not grant advertising consent. Withdrawing analytics stops future collection and resets local analytics data, but does not automatically erase data already sent.

• An email OTP is valid for 10 minutes. Rate-limit records expire after 1 hour, and related aggregate counters expire after 2 days.
• A session normally expires 30 days after issue and can be invalidated sooner by sign-out, account deletion, or a security action.
• Pending translation records are physically deleted when account deletion is processed. Newly created failed rows expire after 1 hour, and a successful encrypted cache has a TTL of up to 90 days. TTL deletion is asynchronous, so physical removal is not guaranteed immediately at expiry.
• CloudWatch operational logs are configured for 30-day retention. The service is designed not to deliberately place source text or session tokens in those logs.
• Purchase, entitlement, and account-binding ledgers remain for as long as needed for restoration, payment integrity, refunds, disputes, and prevention of duplicate paid grants. After deletion, the minimal ledger retains a random former-account ID, deleted status, store transaction and original purchase binding identifiers, and purchase, subscription, grant, usage-balance, and period information. Email, source or translated text, and the cache keys used to locate or decrypt source or translated text are removed from this ledger.

Account deletion removes the active email HMAC index and invalidates every session. Email and the cache keys used to locate or decrypt source or translated text are removed from the former account, making old successful ciphertext unreadable by the live system. The retained minimal ledger contains the random former-account ID, deleted status, store transaction and original-purchase bindings, and the purchase, subscription, grant, usage-balance, and period details needed for legal or payment disputes and purchase restoration. A separate email-HMAC deletion marker contains no account ID and only the trial-used flag, deletion time, and expiry; it is configured to expire after 30 days and then be deleted asynchronously. If the same email registers again after that, trial eligibility may be evaluated anew under the product, store-verification, and anti-abuse rules then in effect; a new trial is not guaranteed. Local PDFs remain on the device until you remove them. Point-in-time backups and some older failed rows may temporarily contain earlier information; backup rotation and asynchronous TTL deletion mean immediate removal of every copy cannot be guaranteed, and deletion state must be reapplied after a restore. Deleting a TMO Books account does not cancel an App Store subscription, which must be canceled separately in Apple subscription management.

You may request access, correction, deletion, or restriction through the account screen or [email protected]. Identity verification and lawful exceptions may apply. TMO Books uses encrypted transport, AES-256-GCM for translation caches, hashes or HMACs for secrets and lookup keys, and access controls. Material policy changes will be announced in the app or on this page before they take effect where required.