Libretto
Privacy Policy
Libretto is a reading app for students. This page says exactly what leaves your iPad, what never does, and how to have your account erased.
Effective 20 September 2026 · Libretto for iPad, com.ElnaggarStudio.libretto.app
Who we are
Libretto is published by Elnaggar Studio. For any question about this policy, or to ask what we hold about you, write to support@librettoonline.com.
What we collect
| Data | Why |
|---|---|
| Name, email address, and phone number if you give one | To create and sign you into your account. If you sign in with Apple and choose to hide your email, we receive Apple's relay address and nothing more. |
| A device identifier generated by the app | A book licence is issued to one device. The identifier is how the server knows which iPad a licence belongs to, and how you can be signed out of a lost one. |
| Purchases and credit balance | To grant the books and credits you paid for, and to restore them on a new device. |
| Crash reports, performance data and diagnostics | To find and fix faults. Collected through Firebase Crashlytics and Performance Monitoring, and not linked to your identity. |
| Which screens and features you use | To see which parts of the app students actually use. Collected through Firebase Analytics. |
| Reading time per book | Shown back to you as your own reading statistics, and reported to the institution that granted you a book where one did. |
What never leaves your iPad
Your highlights, notes, handwritten annotations and page progress are stored on the device and are not uploaded. Study help — summaries, explanations, questions about a page — runs on the device; the text of your books is not sent to us or to any AI provider for it.
Decrypted book content exists only in memory while you read. It is never written to disk, never copied to the pasteboard, and never sent anywhere.
We do not track you
Libretto shows no advertising, contains no advertising SDK, and does not track you across apps or websites. We do not sell or rent personal data. The app's privacy manifest declares NSPrivacyTracking as false and lists no tracking domains.
Protected books
Books are encrypted, and a copy is licensed to your account and device. Pages you read carry a watermark showing your account, which is there to discourage redistributing a book that a publisher licensed to you alone. The app detects screen recording and mirroring and hides the page while either is running.
Who else sees your data
- Apple — processes in-app purchases of credits and, if you use it, Sign in with Apple. We never receive your payment card.
- Google — Sign in with Google if you choose it, and Firebase for crash reports, analytics and push notifications.
- Cloudflare — stores the encrypted book files and serves this site.
- Your institution — if a school or publisher granted you a book, they can see that grant and your reading time on it. They cannot see your notes.
Nobody else. We do not share personal data with advertisers or data brokers.
How long we keep it
Account data is kept while the account exists. Crash and analytics data is kept for up to 14 months. Purchase records are kept as long as tax and accounting law requires.
Deleting your account
In the app: Profile → Delete account. It deletes your account, your entitlements and your credit balance, signs every device out, and — if you signed in with Apple — revokes that sign-in. It cannot be undone, and unspent credits are not refunded.
If you cannot reach the app, write to support@librettoonline.com from the address on the account and we will delete it within 30 days.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to support@librettoonline.com. We answer within 30 days.
Children
Libretto is built for students and is not directed at children under 13. Where a school or institution creates accounts for pupils, that institution is responsible for obtaining parental consent. If you believe a child has an account without it, write to us and we will remove it.
Changes
If this policy changes in a way that affects what we collect, we will change the effective date above and tell you in the app before the change takes effect.