Ambio · Reader

Privacy Policy

Last updated · September 29, 2026

This policy explains what personal data the Ambio Reader app and this website process, why, who else handles it, and what your rights are. I have tried to write it plainly. If anything is unclear, email me at support@ambio.cloud.

1. Who is responsible

The controller of your personal data is Jakub Świerlikowski IT Services, a sole proprietorship registered in Poland — Witkacego 2, 05-400 Otwock, Poland, VAT PL5322109840. Ambio Reader is made and run by one person, so "I" in this policy means me, Jakub. Contact: support@ambio.cloud.

2. The short version

  • I collect what the app needs to work: your account, your subscription status, and the text of the books you choose to analyze.
  • No ads, no advertising or analytics SDKs, no tracking across apps or websites, no location, no contacts, no microphone, no camera.
  • I never sell your data.
  • The backend and the AI models that analyze your books run in the European Union. The subscription service is in the United States — see section 6.

3. What I collect and why

Your account

Your email address, a password (stored only as a secure hash), and an account ID. If you sign in with Apple or Google, I receive your email address and, if you share it, your name — nothing else from those accounts (no contacts, no friends lists, no profile data beyond that). If you use Apple's "Hide My Email", I only see the relay address. The app's language is also stored with your account, so that account emails (sign-up confirmation, password reset) reach you in that language.
Why: to create and secure your account and let you sign in on your devices. Legal basis: performance of our contract (GDPR Art. 6(1)(b)).

Books you analyze

Your books stay on your device. When you choose to analyze a book, its text is sent to my servers and to the AI provider listed in section 5, which reads it scene by scene to decide which sounds fit. The result — scene boundaries, short scene descriptions, matched sounds, and short excerpts that mark where each scene starts — is stored. The book's title, author and publisher description are also used to pick a genre and music style, and to look up cover and details in public book catalogues.
Why: this is the feature you are paying for. Legal basis: contract (Art. 6(1)(b)).

Shared analysis cache. The analysis is stored against a fingerprint (a hash) of the book's text, not against your name, so that the same book is not analyzed twice for different readers. My database also records which analyzed books belong to your account and when — that link is deleted with your account; the cached analysis itself is kept, because it is no longer connected to you.

If you never analyze a book, its text never leaves your device.

Your subscription

Subscriptions are sold by Apple (App Store) or Google (Google Play). I never see your card or payment details. I receive, through RevenueCat, your subscription status, plan, renewal and expiry dates, and a transaction identifier — linked to your account ID.
Why: to unlock the subscription, apply the monthly page allowance, and prevent abuse. Legal basis: contract (Art. 6(1)(b)); keeping records required by tax and accounting law (Art. 6(1)(c)).

Crash reports and diagnostics

When the app crashes or hits an error, a report is sent with technical details: device model, operating system and app version, the error and where in the code it happened. Reports are not linked to your name or email.
Why: to find and fix bugs. Legal basis: my legitimate interest in a working, secure app (Art. 6(1)(f)).

Issue reports and emails

If you use Report an issue in the app, I receive your message plus your account ID, device model, operating system, app version, the book's title and your position in it. If you email me, I receive your email address and whatever you write.
Why: to answer you and fix the problem. Legal basis: contract and legitimate interest (Art. 6(1)(b) and (f)).

On your device

Your library, reading positions, bookmarks, downloaded sounds and settings are stored on your device. Uninstalling the app removes them.

This website

The website sets no cookies and runs no analytics. Like any website, the hosting provider (Cloudflare) processes your IP address to deliver pages and protect against attacks.

4. What I don't do

  • No advertising, no ad networks, no cross-app tracking (so the app never asks for tracking permission).
  • No selling or renting of personal data, and no sharing for targeted advertising.
  • No access to your location, contacts, photos, microphone or camera.
  • No automated decisions with legal or similarly significant effects on you.

5. Who processes data for me

I use the following service providers. Unless the list says otherwise, a provider processes data only on my instructions, under a data processing agreement (it is my processor).

  • Supabase — database, sign-in and file storage. Servers in the EU.
  • Google Cloud (EU) — runs the book-analysis worker in Warsaw, Poland, which handles the book text you choose to analyze. Its Vertex AI service (EU region) turns short scene descriptions into numerical form for sound matching.
  • Infercom (Germany) — the AI model that analyzes book text scene by scene, and picks a genre and music style from the book's title, author and publisher description. It receives the book text you choose to analyze.
  • Google Books and Open Library — public book catalogues that the app queries with a book's title, author or ISBN. They are not my processors and receive no account data; like any website, they see your device's IP address and handle it under their own privacy policies.
  • RevenueCat (USA) — manages subscription status. Receives your account ID and purchase information from Apple or Google.
  • Apple and Google — app stores and payments, and sign-in if you choose it. For these they are not my processors: each acts as an independent controller under its own privacy policy.
  • Sentry — crash reports. Stored in the EU (Germany).
  • Cloudflare — hosts this website and forwards email sent to support@ambio.cloud.
  • An email delivery provider sends account emails (sign-up confirmation, password reset).

AI providers change as models improve. When I switch the provider that receives book text, I will update this list before doing so.

6. Transfers outside the EU

RevenueCat is in the United States, and Apple and Google may process data there under their own policies. Transfers to US providers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask me for more detail on the safeguard used for a given provider.

7. How long I keep data

  • Account data — until you delete your account.
  • Link between you and your analyzed books — until you delete your account.
  • Shared analysis cache — kept, but not linked to you (see section 3).
  • Crash reports — up to 90 days.
  • Issue reports — until you delete your account.
  • Emails with me — as long as needed to help you, then up to 2 years.
  • Records required by tax and accounting law — for the period that law requires.
  • Backups — deleted data leaves rolling backups within 30 days.

8. Your rights

Under the GDPR you have the right to access your data and get a copy of it, to have it corrected or deleted, to restrict its processing, to object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw it at any time. To use any of these rights, email support@ambio.cloud from your account's email address; I will answer within one month.

You can delete your account yourself in the app (Settings → Delete Account) — see Account & data deletion.

You also have the right to complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also complain in the EU country where you live or work.

If you live in the United States: I do not sell personal data or share it for targeted advertising, and I do not use it for profiling. You can ask to know, access, correct or delete your data by emailing me, and I will not treat you differently for doing so.

9. Security

Data is encrypted in transit (HTTPS) and access to it is restricted per account. No system is perfectly secure, but I take reasonable technical and organizational measures to protect your data, and I will inform you and the authority if a breach puts you at risk.

10. Age

Ambio Reader is for adults (18+). I do not knowingly collect data from children. If you believe a child has created an account, email me and I will delete it.

11. Changes to this policy

When this policy changes, the date at the top changes. For significant changes, the app will ask you to review the updated policy the next time you open it.