In short

We ask for no name, email, phone number or login.
Everything you add is written to your device and to your own iCloud, unless you turn sync off.
There are no ads, no trackers and no behavioural profiles.
What else leaves the device is always something you asked for: a search, a scanned barcode, the subscription check, something you chose to share.

What the app stores

Books, authors, shelves, collections, series, readings, sessions, notes, quotes, loans, goals, challenges, and your appearance and language preferences. Also the files you attach: covers, session photos, note photos and audio, drawings and your profile photo.

All of it lives in a database and in folders inside the app’s private area on the device. No other app can read those files, and neither can we.

What leaves the device

1. iCloud sync

Sync is on by default, and you can turn it off on the first launch or later in Settings › iCloud. While it is on, your library is kept in the private database of your own iCloud account, through Apple’s CloudKit, so your iPhone and iPad hold the same books. Every field is encrypted on the device before it is sent, so the rows can be read only on your devices, and with Advanced Data Protection not even by Apple.

We have no access to that database. Turning sync off stops it on that device, and if the iPhone signs in to a different iCloud account, sync stops by itself rather than mixing two people’s libraries.

2. What you choose to share

When you share something (a book, a loan handed over by QR code, your wishlist, your shelf, a reading club, a challenge, a household collection, a bingo card, a time capsule for someone), the app puts it in a space of its own in your iCloud and gives you a link. Only people with that link, or people you invite, can open it, and some shares let them write back: a friend promising a present on your wishlist, a club member sharing a note.

Every share is listed in Settings › iCloud, where you can see who has access and stop it. Stopping something you started deletes it for everyone. Leaving something you joined only takes you out.

3. The subscription check

If you subscribe to Dousha Plus, the app asks the App Store, through Apple’s StoreKit, whether the subscription is active. Nothing about your books goes with that question. The payment itself is handled by Apple, and we neither receive nor store card details.

4. The book search, when you ask for it

When you search for a book by name, scan its barcode or look for a cover, the app asks public book catalogues: Open Library (whose covers come from the Internet Archive), BrasilAPI for a Brazilian ISBN, the Apple Books search, and Google Books when the app is built with it. What leaves is the words you typed or the ISBN, the two letters of your App Store country for Apple, and a line naming the app.

Nothing from your library travels with that question. Not the books you already have, not a count of them, not a device or install identifier. A search is something you typed. Your shelf is something that is yours, and the line between the two is the whole argument. The app does not keep what you searched for either.

5. A web page you share to Dousha

When you share a web page to Dousha from another app, the system’s link preview fetches that page’s title and picture, so the book can be added with them. That request goes to the page you shared and carries nothing from your library.

What never leaves

Your books, notes and readings, except through the sync with your own iCloud, which you can turn off, and the things you share.
The photos and recordings you make inside the app, except as part of that same sync.
Any device, advertising or usage-analytics identifier.

Camera, microphone and photos

The camera photographs a cover, reads the barcode on the back cover or a QR code, and attaches a photo to a session, a note or a book. Text recognition, barcode decoding and cover matching all happen on the device, with Apple’s Vision framework. No image is sent anywhere to be analysed: when you scan, what leaves is only the ISBN the camera decoded.

The microphone is used only when you record a voice memo for a note, and its transcript is made on the device: a language with no on-device model gets no transcript rather than a server’s. Photo library access is there so you can pick an image, and the app reads only the image you selected.

The rest of the iPhone

Contacts and calendar. The contact picker and the new-event sheet are run by the system, outside the app. The app receives only the contact you picked and never reads your calendar.
Spotlight, Siri and Shortcuts. The search index and what Siri answers are kept on the device. You can take the library out of the system search in Settings.
Apple Intelligence. Suggestions use the model that runs on the device, never Apple’s cloud. Its last reading of your notes is kept in the app’s cache on the device and never goes into a backup.
SharePlay. Opening a reading club in a FaceTime call sends only which club it is, to the people already on the call.
Face ID. If you lock the app, the system does the checking. The app only learns whether it succeeded.

Notifications

Loan due dates, time capsules, club meetings, the streak reminder and your reading-hour nudge are scheduled on the device. With iCloud sync on, Apple sends the app a silent signal when something changed on your other device. It carries no content and passes through no server of ours. Each kind of notification has its own switch in Settings.

Children

The app is not directed at children and collects data from nobody, which holds equally at any age.

Deleting your data

Since we store nothing, there is nothing to ask us to delete. Inside the app, “Erase everything” under Settings › Data removes the whole library from the device and turns sync off. Uninstalling also erases everything it wrote on the device.

What is in your iCloud is deleted from the iPhone’s own Settings: your name › iCloud › Manage Account Storage › Dousha. Deleting it there is the app’s signal that you cleared it, and it will not upload the library again until you turn sync back on.

Taking your data with you

Settings › Data exports the entire library as a file you keep wherever you like, covers, photos and audio included. That option is free forever and depends on no subscription, today or later.

Changes to this policy

If anything else starts leaving the device, this page changes at the same moment the app does, not afterwards. The date at the top says when that last happened.

Contact

Questions about privacy: [email protected].