Privacy policy

1. Operator and contact

LeafTrove is developed and operated by HSIHSUN HO (HoMade Works). Contact for privacy, data rights and support: brad.ho.2026@gmail.com.

2. Data we process

What we process depends on the features you use. Account, pairing and Wi-Fi cloud sync data are processed after you choose to sign in with Apple. Buying and restoring subscriptions do not require LeafTrove sign-in; see section 2.4. See section 2.1 for My Library on your device, your writing and file-transfer services.

• Account and identifiers: your Apple user identifier, sign-in state, session and refresh credentials. Credentials are stored in the device Keychain.
• User content: book identifiers, titles, authors, highlights, notes you wrote on the eReader, and the source modification time.
• Product usage data: favorites, archived and review-excluded notes, the source of Today's pick, sync cursors, pairing state, batches and fixed error codes; and the result the eReader reports after each Wi-Fi sync: sync component version, start time and duration, whether it completed, the number of notes added, updated, deleted and skipped, and fixed codes. It contains no book titles or note text.
• Purchase data: the subscription transaction identifier, product, entitlement state and expiry that Apple provides. LeafTrove does not receive full payment card details.
• Device and connection data: device identifier, operating system information, IP address, request time, and notification, widget and reminder settings.

LeafTrove does not ask for your Kobo password. Sync logs are not designed to keep the text of your notes.

2.1 The library on your device, what you write in LeafTrove, and iCloud

LeafTrove keeps notes from direct cable reading, the export web page, assistant export files and Wi-Fi sync in one “My Library”, stored in the app's space on your device. Direct reading and the export web page only read the eReader's titles, authors, text highlights, notes and cover cache; they do not change the eReader, and the web page does all its work inside your browser without uploading. The computer assistant first makes a private database backup, checks integrity on that local copy, and then takes titles, authors, text highlights and notes to produce the export file; the export does not include the Kobo account table. Exported data uses a source hash from which the original serial number cannot be read directly; it includes model and firmware, and excludes account credentials and the full text of books. A .leaftrove package also contains the covers that are available; a text-only JSON file has no covers. The assistant reads the eReader's cover cache locally, or reads the relevant files inside EPUB/KEPUB books to obtain covers, and does not export full books. The original backup on your computer may contain private data: protect it and do not send anyone the complete backup.

When you set up Wi-Fi wireless updates on an iPad or USB-C iPhone, LeafTrove first backs up the eReader's system data, including its reading database, to the app's space on your device (it is not uploaded), then writes the menu component, the LeafTrove sync program and a pairing grant to the eReader. To create the grant, the app sends the eReader's model, firmware and an eReader identifier from which the serial number cannot be recovered, together with your LeafTrove account, to LeafTrove servers. The grant can be used only once and stops working if it is not used in time.

“My thoughts” that you write in LeafTrove are stored in an encrypted vault on this device, with the key in the device Keychain. The vault is not included in device backups, and drafts stay on this device only. Tags, My collections, recent searches, import result records and the location of the eReader you last read are also stored in the app's space on the device; recent searches stay on this device only. Thoughts, tags and collections exist only in LeafTrove: they are never written back to the eReader and are not uploaded to LeafTrove servers.

Imported content and preferences stay in the app's space on the device and are not uploaded to LeafTrove servers automatically. When a subscriber turns on iCloud sync, the library, favorites, covers, finished thoughts, tags and collections are stored in your own private iCloud container to sync between your iPhone and iPad. They are protected by your Apple account and iCloud, and LeafTrove's servers cannot read them. Turning iCloud sync off does not delete notes on any device.

“Thoughts backup” creates an unencrypted file containing your thoughts, drafts, the source of each note and retained versions, without sign-in credentials. You decide where to keep it; please store it safely. You may send export and backup files through Files or a sharing service of your choice, which is subject to that service's own policy. When you turn on widgets or reminders, iOS stores the excerpts and routes needed to show them. In-app feedback is covered in section 2.3. LeafTrove does not collect your notes or send diagnostics automatically.

2.2 Computer assistant compatibility reports (optional)

After you review and agree, the Mac or Windows assistant can share the results of device identification, USB export, installation steps and eReader checks. A report contains the model code, firmware, assistant version, computer platform, operation times, fixed outcome categories and a report identifier. It does not contain books, notes, accounts, the original serial number or free-form error logs. The eReader identifier used to tell repeated reports apart is derived from a random key kept on that computer, so the same eReader may count as a different source on another computer. This is pseudonymous data and is not guaranteed to be fully anonymous.

Declining does not affect export or setup, and nothing is re-sent in the background. Reports are received over HTTPS. IP addresses are used for temporary request throttling and are not written to the compatibility report table. Reports are kept for 90 days and then removed by scheduled cleanup; disaster-recovery history follows the retention terms below. Reports are used for compatibility statistics, do not grant installation eligibility automatically, and are not merged into a cloud account library.

2.3 In-app feedback and anonymous step counts

Feedback: when you choose to send feedback in the app, we receive your message, the category you picked, the eReader model and firmware if you fill them in, and the LeafTrove version, iOS version and device type (iPhone or iPad). Feedback carries no account, sign-in credential, device identifier, serial number, book title or note; please do not include personal data you do not want to share. Contact details are optional, stored only if you type them, used to reply to you, and cleared automatically after 180 days. Feedback messages are deleted after 400 days.

Anonymous step counts: “Help improve LeafTrove” is on by default and can be turned off in Settings at any time. When it is on, the app sends only step names from a fixed list (for example “import completed”), fixed outcome categories, the platform and the LeafTrove version, at most once per step per installation. The server keeps daily totals only, with no account, device or advertising identifier, book title or note, and cannot link them to a person. Daily totals are deleted after 400 days; the random batch number used to avoid double counting is deleted after 3 days.

Neither of these uses your sign-in state or cookies. Cloudflare temporarily uses the IP address for rate limiting while handling the connection; LeafTrove does not write IP addresses into feedback or count data.

2.4 Subscription purchases and optional cloud linking

Buying, restoring and using on-device subscription features do not require a LeafTrove account. The App Store handles payment; LeafTrove uses Apple-verified transactions to check the product, validity, refunds and revocation. Signing in and linking an account are needed only if you choose LeafTrove’s personal Wi-Fi cloud service.

Before a purchase while signed out, LeafTrove servers generate a random purchase-proof identifier and linking secret. The server stores only the identifier, a hash of the secret and the creation time. This does not create a user account or require a name or email address. The full secret is kept in the system Keychain; if you have enabled iCloud Keychain, Apple may sync these proofs between your devices. They are not included in your library, thoughts backups, exports or diagnostic records.

Only when you later choose to link Wi-Fi cloud access does the app send your LeafTrove account, purchase proof and Apple-signed transaction to the server for verification. Restoring a purchase does not automatically transfer a subscription already linked to another account. Missing linking proof does not affect on-device subscription access confirmed by Apple.

Minimal purchase-proof records not yet linked to an account have no fixed automatic expiry: issuing a proof alone does not tell the server whether a purchase was cancelled or paid for without a later cloud link. These identifiers and hashes contain no name, email address or reading content and are retained for a later voluntary link and to prevent conflicting ownership; the full secret and transaction text are not stored. Linked records follow account deletion. To exercise your data rights, contact us as described in section 6. Apple’s own payment and transaction records follow Apple’s policies.

3. Purposes

Data is used to create and restore your account, pair a Kobo, sync the books and notes you authorize, update content across devices, provide search, review, favorites, thoughts, tags and collections, and export, show the most recent sync result, maintain subscription entitlements, deliver the reminders you turn on, process account deletion, and keep the service secure and troubleshoot faults.

4. Third-party services and data transfers

• Apple: Sign in with Apple, App Store subscriptions, notifications and system services; iCloud when a subscriber turns on sync.
• Cloudflare: Workers and D1 for cloud accounts, pairing, sync and subscription verification; Pages for website hosting. Direct cable reading, the export web page and importing an assistant export file do not use LeafTrove servers to store notes.
• Kobo image service: when a cover identifier is available, the app requests the image directly from cdn.kobo.com, without sending note text, favorite status or Apple credentials.

These services may process ordinary network data outside your region. LeafTrove does not give your notes to advertising services and does not track you across apps or websites.

5. Retention and security

The library is stored in the app's private space, My thoughts in the encrypted vault, widget excerpts in device space shared by the app and its widgets, and sign-in credentials in the Keychain. Cloud books, notes, preferences, sync batches and change content are not deleted automatically because of inactivity or subscription expiry; they can be removed by deleting the account or by explicitly deleting an archived source, and may be deleted earlier where the law requires. Only the most recent sync result is kept for each eReader, and it is removed with the account. Unlinking a Kobo only archives its source, which still counts toward cloud storage; the 30-day protection period is not a countdown to automatic deletion. In “Data & Storage” you can explicitly and permanently delete an archived source's queryable books, notes, preferences and related change content; the minimal technical records that are required follow their own retention periods.

Records of pairing flows that have expired, been revoked or been confirmed are cleaned up in batches 30 days after the pairing expiry, which does not revoke device sync authorizations that are still valid. After account deletion completes, a receipt with no reading content (request identifier, receipt hash, status and time) is cleaned up after 30 days; the hashed barrier that prevents an old sign-in from recreating data lasts about 24 hours. The account identifier and encrypted Apple authorization needed during processing are kept until revocation completes. Cloudflare D1 disaster-recovery history may remain for 7 or 30 days depending on the plan and cannot be removed immediately by a deletion in the app. Export files, thoughts backup files, original computer backups and system backups that you keep yourself must be managed where you keep them.

LeafTrove uses HTTPS, the device Keychain, system data protection and permission isolation. No network service can guarantee absolute security; if we find an incident that may affect you, we will respond and notify you as applicable law requires.

6. Your choices and rights

You can turn off reminders and widgets, turn off iCloud sync, export to Markdown or JSON, delete thoughts, remove tags and collections, and clear recent searches. After signing in with Apple you can also sign out, unlink a Kobo, delete archived sources and delete your account. Signing out clears that account's cloud cache and credentials on this device; synced cloud content and Kobo links are kept. Deleting the cloud account handles that account's cloud content and authorizations; other signed-in devices clear that account's data after their next verified connection, and offline devices are not wiped remotely at once. Neither action deletes “My Library” on this device, the original content on the Kobo or files you have exported, and neither cancels an Apple subscription.

Removing the app deletes the library and the thoughts vault on this device. If iCloud sync is off and you have not saved a thoughts backup, your thoughts cannot be recovered. See the account and local data page before clearing device data or reinstalling.

To access, correct, delete, restrict or receive a copy of your data, write to the address above. We will verify your identity reasonably first and reply as applicable law requires. You may also lodge a complaint with the data protection or consumer authority where you live.

7. Children, changes and scope

LeafTrove is not directed at children and does not knowingly collect data from anyone below the age of digital consent where they live. When the policy changes materially, we will update the effective date and give appropriate notice in the app or on the website. Where mandatory law in your region gives you more rights, those rights are not limited by this policy. This policy exists in Chinese and English; if they differ, the Chinese version prevails.

When you submit troubleshooting information through the website, the handling of your contact details, device information and message is described in the website forms and contact-data policy (in Traditional Chinese).