This is a translation provided for convenience. The Spanish version is the original and prevails in case of any discrepancy: read it in Spanish.
At Kevra we take your privacy seriously. This Policy explains which personal data we process, for what purposes and on what legal basis, who we share it with and what rights you have, in accordance with the General Data Protection Regulation (GDPR) and other applicable law.
1. Data controller
The data controller is the owner identified in the Legal Notice. You can contact us about privacy at privacidad@joinkevra.com.
2. What data we process
- Account data: name, username, email address and password (always stored hashed, never in plain text).
- Your library and reading: the books you upload, their metadata, your reading progress, bookmarks, notes and settings. On the Pro plan, your files are stored encrypted in our cloud to sync them across your devices.
- Social activity: reviews, comments, clubs, lists and connections (following/friends) that you choose to create.
- Technical data: device type, operating system, session and push notification identifiers, and the logs needed for operation and security.
- Feedback and support: the messages you send us (including the «Send feedback» form).
- Usage statistics: which features of the app you use and for how long (for example, «scroll reading: 20 minutes today» or «dictionary: 3 times») and which reading settings you have on. They are only daily counts: they do not include the content of your books, nor what you search for or highlight. You can turn them off in Settings → «Help improve Kevra»; when off, they are not collected.
We do not collect special categories of data or carry out profiling with legal effects. Your files and your private reading activity are not sold or used for advertising.
3. Purposes and legal basis
- Providing the Service (account, library, synchronisation, social features, read-aloud). Basis: performance of the contract (the Terms).
- Managing subscriptions and payments through the app stores. Basis: performance of the contract.
- Security, prevention of fraud and abuse, and technical operation. Basis: legitimate interest and compliance with legal obligations.
- Push notifications about your activity. Basis: consent (you can turn them off on your device).
- Handling your feedback and support. Basis: legitimate interest.
- Improving the app by knowing which features are used (usage statistics). Basis: legitimate interest; you can object by turning them off in Settings.
- Compliance with legal obligations (for example, handling content removal notices). Basis: legal obligation.
4. Processors and third parties that serve us
To operate Kevra we rely on providers acting as data processors, with the appropriate contractual safeguards:
- Backend hosting (server managed through Laravel Forge).
- File storage (Cloudflare R2) for your cloud library and for transfers/conversions.
- Subscription management (RevenueCat) and the Apple App Store and Google Play for billing.
- Push notifications (Apple and Google services).
- Book metadata (for example, Google Books and Open Library) when you look up information about a work.
- Remote libraries that you choose to connect (Dropbox, Google Drive, Box, Microsoft OneDrive) through OAuth, only to access the files you authorise.
- Send to Kindle: when you ask for it, the book goes through our server and our email provider (Resend) to your Amazon @kindle.com address. We do not keep it: it is deleted once sent.
- Readwise, if you connect it: your highlights, with their book, note and tags, are sent to your Readwise account using the token you give us (stored encrypted). You can disconnect it at any time.
- Artificial intelligence features (OpenRouter, which routes each request to models from providers such as Moonshot AI (Kimi) or Google (Gemini)): when you use the reading companion, summaries or quizzes, the necessary book text is sent, together with your question if there is one. Your name, email and account details are not sent. These features are optional: if you don't use them, nothing is sent.
- Email (Resend): to send you service emails (for example, password resets) and to receive the books you send to your Kevra address.
Some of these providers may process data outside the European Economic Area; in that case, transfers are covered by appropriate safeguards (such as the European Commission's Standard Contractual Clauses).
5. Retention
We keep your data while your account is active. If you delete your account, we delete or anonymise your personal data and your files within a reasonable period, except for what we must keep by legal obligation or for the defence of claims.
6. Your rights
You may exercise at any time your rights of:
- Access, rectification and erasure of your data.
- Restriction of and objection to processing.
- Portability of the data you have provided to us.
- Withdrawal of consent where processing is based on it.
To exercise them, write to privacidad@joinkevra.com. You can also delete your account from Settings. If you believe we have not handled your request properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es) or the supervisory authority of your country.
7. Security
We apply reasonable technical and organisational measures to protect your data: encryption in transit (HTTPS), hashed passwords, access control and encrypted storage of your files. No system is infallible, so we also recommend using a strong password and keeping copies of your books.
8. Minors
Kevra is not intended for minors below the legal age to consent to data processing in their country (16 in Spain, unless consent is given by whoever holds parental responsibility). If we detect an account belonging to a minor without appropriate consent, we will delete it.
9. Changes to this Policy
We may update this Policy. We will publish the current version on this page with its date and, if the change is significant, we will let you know through the App or by email.
10. Contact
For any privacy question, write to privacidad@joinkevra.com.