Kodi ReaderController and contact
Kodi Reader is operated under the Kodi Reader brand by an individual sole trader based in Germany. The operator is responsible for the account, Ask AI, and credit data described here. Privacy questions and rights requests may be sent to olly@kodi-reader.app.
Reading data on your Mac
Your imported books, saved webpages, annotations, drawings, reading position, and saved conversations are stored locally on your Mac. You can use the reader without a Kodi Reader account.
Optional sync uses either your private Apple iCloud storage or a hidden Kodi app-data folder in your Google Drive account. The selected provider's data uses your iCloud or Google storage allowance. Notes-only sync includes annotations, drawings, bookmarks, reading position, and book metadata. Books-and-notes sync also includes imported EPUBs, PDFs, and saved webpages. Ask AI conversations and passage references sync only when you enable Ask AI history sync. Sign-in credentials, credit balances, and unsent drafts are not included. Sync choices apply separately to each Mac. Only one cloud provider syncs on a Mac at a time; switching requires a confirmed copy and leaves the previous cloud copy in place. Google Drive retains immutable historical revisions and chunks so an offline device can recover concurrent edits; deleting Kodi's Google app-data folder clears that history.
Account and authentication data
When you create an account or sign in, Supabase processes your account identifier, email address, verification status, session information, and authentication events. Purelymail delivers email verification codes. If enabled and selected, Google or Apple processes its sign-in flow and provides the identifiers needed to sign you in; Apple may provide a private relay email. Google Drive sync requests separate permission limited to the app-data folder. Session credentials and the Google Drive refresh token are stored in macOS Keychain.
Ask AI data
When you use Ask AI, your question, selected passages, relevant conversation history, and limited book context are sent through our server to OpenAI to generate the answer. Kodi Reader's credit ledger stores request identifiers, status, token-usage counts, and credit movements, but does not store your question, answer, book passage, or login token.
We do not intentionally write emails, questions, book passages, login codes, or access tokens to ordinary server request logs. Service providers may process operational and security metadata according to their own policies.
Credits and payments
Supabase stores your credit balance, welcome-credit status, reservations, settlements, purchase entitlement, request identifiers, and token-usage counts. Paddle processes checkout, payment, receipts, tax, refunds, and disputes as merchant of record. We receive Paddle customer and transaction identifiers, purchase details, status, amount, currency, and adjustment information so we can deliver or reverse credits. Kodi Reader does not receive or store complete card details.
Website data
The public website is hosted by Vercel, which may process IP addresses, request headers, timestamps, and security or delivery logs. Kodi Reader does not use advertising trackers or sell personal data. The marketing and legal pages do not set Kodi Reader analytics cookies. Paddle's checkout script is loaded only on the checkout page when checkout is enabled and may process data required to provide payment services.
Why we process data
Where the GDPR applies, processing is based on:
- performance of a contract, to authenticate you, answer questions, manage credits, deliver purchases, and provide support;
- legitimate interests, to secure the service, prevent fraud and duplicate grants, diagnose failures, enforce limits, and maintain reliable records;
- your consent, where a feature or provider specifically asks for it and consent is the applicable basis;
- legal obligations, including tax, accounting, consumer-protection, and lawful-request requirements.
Service providers and international processing
We use Supabase for authentication and database services, OpenAI for AI responses, Purelymail for email delivery, Paddle for payments and tax handling, Vercel for website hosting, and Fly.io for backend hosting. Optional Apple iCloud, Google Drive, Sign in with Apple, or Google sign-in is used only when you enable or choose it. These providers may process data in other countries using the safeguards described in their own privacy terms.
Retention
Your authentication account and spendable credit balance are retained while your account is active. On deletion, sign-in access and spendable credits are removed or disabled. Minimal payment, entitlement, fraud-prevention, and accounting records may be retained for applicable statutory periods and to reconcile refunds, disputes, or payments completed after deletion. Local reading data remains on your Mac until you remove it; iCloud and Google Drive copies remain under their respective accounts until removed there.
Account deletion and your rights
You can delete your account from the account menu. This does not delete reading data stored locally on your Mac and does not automatically request a payment refund.
Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data, and to withdraw consent where processing relies on consent. You may also complain to your competent data-protection authority. Contact olly@kodi-reader.app to exercise these rights.
Changes
We may update this policy when services or legal requirements change. The updated date above identifies the current version. Material changes will be communicated through the app, website, or account email where appropriate.