Privacy Policy

Last updated: 05/10/2026

This is a translation provided for convenience. The Spanish version is the original and prevails in case of any discrepancy: read it in Spanish.

At Kevra we take your privacy seriously. This Policy explains which personal data we process, for what purposes and on what legal basis, who we share it with and what rights you have, in accordance with the General Data Protection Regulation (GDPR) and other applicable law.

1. Data controller

The data controller is the owner identified in the Legal Notice. You can contact us about privacy at privacidad@joinkevra.com.

2. What data we process

• Account data: name, username, email address and password (always stored hashed, never in plain text).
• Your library and reading: the books you upload, their metadata, your reading progress, bookmarks, notes and settings. On the Pro plan, your files are stored encrypted in our cloud to sync them across your devices.
• Social activity: reviews, comments, clubs, lists and connections (following/friends) that you choose to create.
• Technical data: device type, operating system, session and push notification identifiers, and the logs needed for operation and security.
• Feedback and support: the messages you send us (including the «Send feedback» form).

We do not collect special categories of data or carry out profiling with legal effects. Your files and your private reading activity are not sold or used for advertising.

3. Purposes and legal basis

• Providing the Service (account, library, synchronisation, social features, read-aloud). Basis: performance of the contract (the Terms).
• Managing subscriptions and payments through the app stores. Basis: performance of the contract.
• Security, prevention of fraud and abuse, and technical operation. Basis: legitimate interest and compliance with legal obligations.
• Push notifications about your activity. Basis: consent (you can turn them off on your device).
• Handling your feedback and support. Basis: legitimate interest.
• Compliance with legal obligations (for example, handling content removal notices). Basis: legal obligation.

4. Processors and third parties that serve us

To operate Kevra we rely on providers acting as data processors, with the appropriate contractual safeguards:

• Backend hosting (server managed through Laravel Forge).
• File storage (Cloudflare R2) for your cloud library and for transfers/conversions.
• Subscription management (RevenueCat) and the Apple App Store and Google Play for billing.
• Push notifications (Apple and Google services).
• Book metadata (for example, Google Books and Open Library) when you look up information about a work.
• Remote libraries that you choose to connect (Dropbox, Google Drive, Box) through OAuth, only to access the files you authorise.

Some of these providers may process data outside the European Economic Area; in that case, transfers are covered by appropriate safeguards (such as the European Commission's Standard Contractual Clauses).

5. Retention

We keep your data while your account is active. If you delete your account, we delete or anonymise your personal data and your files within a reasonable period, except for what we must keep by legal obligation or for the defence of claims.

6. Your rights

You may exercise at any time your rights of:

• Access, rectification and erasure of your data.
• Restriction of and objection to processing.
• Portability of the data you have provided to us.
• Withdrawal of consent where processing is based on it.

To exercise them, write to privacidad@joinkevra.com. You can also delete your account from Settings. If you believe we have not handled your request properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es) or the supervisory authority of your country.

7. Security

We apply reasonable technical and organisational measures to protect your data: encryption in transit (HTTPS), hashed passwords, access control and encrypted storage of your files. No system is infallible, so we also recommend using a strong password and keeping copies of your books.

8. Minors

Kevra is not intended for minors below the legal age to consent to data processing in their country (16 in Spain, unless consent is given by whoever holds parental responsibility). If we detect an account belonging to a minor without appropriate consent, we will delete it.

9. Changes to this Policy

We may update this Policy. We will publish the current version on this page with its date and, if the change is significant, we will let you know through the App or by email.

10. Contact

For any privacy question, write to privacidad@joinkevra.com.