Privacy Policy

Last updated 6 October 2026 · applies to Letora builds with optional accounts and letora.app

By default, Letora processes your audiobooks, transcripts, translations and explanations on your device. You can listen and save words without a Letora account. If you choose to sign in, Letora uses your account to help you recover and sync Saved Words between devices. Sync starts when you sign in, and you can turn it off. The app has no advertising or analytics SDKs. Online content, website visits, support requests and TestFlight testing are explained below.

What stays on your device

• Audio and transcripts. Imported and downloaded books are stored in Letora's local library. Transcription, translation and word explanations use Apple's on-device frameworks. These features do not send the text or audio of your book to a Letora server or an external AI service, unless you enable an online Gemini option described below.
• Saved content and preferences. Words, Clips, earlier notes, shelves, listening progress and settings are stored locally. Earlier voice recordings and their transcripts stay on your device unless you choose to share them. If you sign in and keep Saved Words sync on, a copy of those words and their context goes to Letora's account service as described below.
• Accounts and sync. Audio, transcripts, books, Clips, shelves, listening progress and app settings stay on this device. Saved Words stay here too unless you sign in with sync on (it starts at sign-in and can be turned off). Signing out or deleting your Letora account does not erase the words and audio already on this device. A device backup that you enable through Apple or your computer is separate from Letora.
• Sharing. When you export or share a quote, audio or another item, the content goes to the destination you choose. That service's privacy practices then apply.

Optional podcast personalization

Discover → Interests → Personalize For you is off by default. When you turn it on, Letora uses episodes you loved or saved, shows you follow, and actual podcast listening inside Letora to help order eligible For you suggestions. The listening preference record stays on your device; Letora does not upload it or use activity from other apps. Your selected languages, interests, duration and hidden shows still apply. Search and Browse do not use this preference record.

Turning personalization off stops using these signals and stops learning from listening. Reset learned preferences clears the learned listening record. It keeps Loved it, saved episodes, followed shows, your chosen interests, audio, words and Clips. Those explicit choices remain usable if you turn personalization on again. Device backups are separate from Letora. This choice is separate from optional usage sharing below.

When Letora goes online

Optional account and Saved Words sync

You can sign in with an email code, Apple or Google. Letora stores an internal account ID, your verified email address and the sign-in methods you link. Apple may give us a private relay email address. Google sign-in asks for your basic identity and email; it does not give Letora access to your Gmail, contacts or Google Drive. We use this information to identify your Letora account, let you sign in again and help protect it. An identical email address does not automatically join two Letora accounts.

When you sign in, Letora starts keeping your Saved Words in sync: it sends your saved terms, meanings and translated explanations, source languages, context and source details to our separate account service. Source details include the title and saved word's audio position. For a word saved from podcast notes, context can include a surrounding note excerpt that is thousands of characters long. Other library content, including audio files, complete books, complete transcripts, Clips and listening progress, is not part of Saved Words sync. Later changes are sent automatically while Letora is open and connected; you can keep saving words offline. You can turn off Sync saved words in Settings → Account at any time; your words then stay only on that device. The service stores the synced content so your other signed-in devices can receive it. The connection uses HTTPS and server access is restricted, but the content is not end-to-end encrypted: the service operator can read it.

Letora stores email sign-in codes for up to 10 minutes, sessions for up to 30 days, and limited security and rate-limit records. Apple and Google process their own sign-in steps under their policies. Letora keeps encrypted provider credentials when needed to disconnect your Letora sign-in from those services after you delete your account. We do not use your account or Saved Words for advertising, and the optional app usage counts described below do not include your account ID.

You can sign out without deleting your account or the synced copy. In Settings → Account, Delete account removes the live Letora account, its synced words and active sessions after a recent sign-in. Letora reports whether Apple or Google disconnection completed, is pending or could not be confirmed; you can also review connected apps in those providers' settings. Local copies already on your devices remain until you remove them there. Encrypted account database backups may retain an older copy for up to 30 days under the current hourly and daily retention schedule. Deleting the app alone does not delete your Letora account. Contact us below if you need help with account data or cannot reach the in-app deletion control.

Optional app usage sharing

Settings → Privacy → Help improve Letora is off by default and separate from Online explanations. Letora asks once, during setup or on your next open after an update, with two equal choices; closing the question without answering leaves sharing off. If you turn it on, Letora sends counts of days you opened the app, sessions with 30 seconds of audio content played, successful explanations and new saves to our self-hosted Umami service at analytics.bursuc.com. It also records whether you open the app seven days after your first shared day. These events help us see whether the beta is useful; they are not used for advertising.

Each event contains its type, your local calendar day, iOS app build, whether the device was marked for Letora team testing, and a new random event ID used to avoid duplicate counts. Test-device counts stay out of audience totals. It does not contain an app installation ID, account, book or podcast title, passage, selected or saved word, Clip text, search, audio or precise listening position. The service receives your network address and app user agent as part of the connection and can derive a coarse location. Letora queues unsent counts on your iPhone while offline and tries again when the app is active. Turning sharing off deletes that unsent queue and stops new counts; counts already received remain in Umami until we manually delete them. Choosing not to share does not affect listening, explanations or saving.

Optional online explanations

The current TestFlight beta includes Settings → Word help → Online explanations. It remains off until you choose online help in Settings or accept the offer on your first real lookup. When enabled and available, the selected words or passage, nearby text for context, and chosen languages go to Letora's service at api.letora.app, then to Google's Gemini API. Audio, complete books, your library catalog, saved words and Clips are not uploaded by this feature.

Letora's dedicated server in Helsinki temporarily stores the request and answer in an encrypted recovery cache. Answers expire after 24 hours, so a failed connection can recover an answer without requesting it from Gemini again. This is separate from any answer you choose to save locally. We do not write passage text or access tokens to application or web access logs. Google processes the submitted text under its Gemini API terms; Google may retain data for abuse monitoring under its API data-retention policy. Letora's cache expiry and delete control do not delete Google's separate records.

Apple App Attest verifies the installation before online access is granted. Letora stores a pseudonymous installation identifier, verification key and receipt, and short-lived hashed session credentials. Minimal request identifiers, token-based usage amounts and revocation records remain for replay prevention and beta spending controls; these records contain no passage text. Temporary keyed rate-limit identifiers expire after ten minutes. The feature has no advertising identifier or analytics SDK.

Turning the toggle off stops future online lookups without undoing a request already sent. Delete online data removes Letora's temporary request/answer content and revokes the installation's access, while preserving local books and saved items. If offline deletion cannot be confirmed, the app keeps a retry control visible. Encrypted infrastructure backups may temporarily retain older records; the restore procedure discards recovered text and revokes recovered sessions before service resumes.

Private Gemini test installations

The separately provisioned personal test build can use Gemini for explanations and passage translations. When Settings → Word help → Use Gemini is on, your selected text, nearby text for context and chosen languages go through your private Letora service to Google's Gemini API. Audio files, complete books, saved notes and your library catalog are not uploaded by this feature. The service temporarily holds request/response text in memory for duplicate handling and language retries; it writes request identifiers and usage amounts to its spending ledger, not passage text. Google's processing is subject to its Gemini API terms.

The private connection uses Tailscale and a revocable credential in the iPhone Keychain. The Gemini API key stays on the server. Turning Use Gemini off returns future lookups to Apple's on-device route; it does not undo a request already sent. Regular TestFlight builds do not activate this personal test connection.

Podcasts and Audiobookshelf

Podcast and Audiobookshelf features connect directly to the selected service when you use them. Those services can receive your IP address and information about the content requested.

• Podcast search sends your search words to Apple's public podcast directory at itunes.apple.com. Apple's privacy policy applies.
• Podcast artwork is loaded from Apple's image servers. Episode lists come from the publisher's RSS feed; downloaded audio comes from the publisher or its hosting provider. Podcast connections use HTTPS. A feed available only over plain HTTP fails with a visible message.
• Audiobookshelf uses the server address and login you enter to browse covers and catalogs and download books. Your login is sent to that server, and access tokens are kept in the iPhone's Keychain. The server operator can see requests made to their server. Letora does not upload your personal notes or voice recordings there. Disconnecting removes the saved Audiobookshelf credentials from Letora's Keychain storage.
• Language models may need to be downloaded through Apple's systems before on-device transcription, translation or explanations are available.

TestFlight beta testing

Apple automatically collects crash logs and beta usage information and shares them with us. Email invitations may also make your name and email address available to us. If you send TestFlight feedback, Apple shares the comments, screenshots and associated diagnostic information you submit. We use this information to investigate problems and improve Letora.

This is separate from the app's local processing of your library. See Apple's TestFlight privacy information for the information Apple collects, its retention practices and your options. We do not publish your private beta feedback or use it for advertising.

Support and website visits

If you email us, we receive your email address, message and any attachments you choose to send. We use them to answer your request and resolve the issue, retaining correspondence only as long as needed for those purposes or applicable legal obligations. Please avoid including private passages or account credentials in screenshots or attachments.

The Letora landing page uses our self-hosted Umami analytics at analytics.bursuc.com to count page visits, language choices and taps on the TestFlight link. Links we share through Umami also count openings and may carry campaign labels. Umami receives the page address, referring site, browser and device information, and campaign labels when present. We do not send your books, saved content, email address or app installation identifier to Umami, and we do not use this data for advertising or to identify you across other sites. The help and privacy pages have no analytics script. We honor your browser's Do Not Track setting on the landing page. Website hosting providers still process connection information, such as IP address and browser details, to deliver and protect the pages. Your email provider and our email service process support messages under their own privacy practices.

The website stores your manually selected display language in your browser. You can change it with the language menu or remove it by clearing this site’s browser data.

Permissions

• Speech recognition supports on-device audio transcription.
• Microphone is used only when you explicitly start a voice recording in an available note editor. Opening or listening to a book does not record your microphone.
• Add to Photos is used only when you choose to save a quote card to your photo library.

Managing your information

You can remove saved content and downloaded audio in the app. Deleting the app removes its local library; device backups and copies you exported can remain. Disconnect Audiobookshelf before uninstalling if you also want to remove its saved login tokens. Letora cannot delete content or records held by a podcast host, your Audiobookshelf server, Apple or a service you shared with.

You can correct or remove an individual word from the current synced collection in the app and the change syncs automatically. Earlier versions of that word, including its context, remain in the account service's sync history until you delete the whole account. You can delete the account, its live synced collection and that history from Settings → Account after signing in again. If provider disconnection remains pending, the app keeps a status you can check. Older encrypted account backups may remain for up to 30 days after account deletion; local device backups and provider records follow their own policies.

For access, correction or deletion requests about support correspondence or beta information we hold, contact us below. Apple's handling of TestFlight data is described in the linked TestFlight privacy information. Letora does not sell your personal information or use it for advertising.

Changes

We update this policy when the app's data handling changes. Online text processing is optional and explained before you choose to use it.

Contact

Up To Me LLC · kris@krisbursuc.com