Privacy Policy

Effective September 26, 2026

Litra is a reading app for iPhone. It opens books and documents you already have, and it has an in-book assistant called Orb that answers questions about what you are reading. This policy explains, in plain terms, what data that involves, where it goes, and how to erase it.

1. Who we are

"Litra", "we" and "us" mean the independent developer of the Litra iOS app and the operator of trylitra.app, an individual based in the Republic of South Africa. That person is the data controller for the purposes of the GDPR and the UK GDPR. You can reach us at hello@trylitra.app. For anything to do with your data, that address is the fastest route to a human — there is no separate privacy team, and the developer answers it.

This policy covers the Litra iOS app and this website. It does not cover Apple's App Store, or any website you reach by following a link out of the app.

2. No account, no login

Litra has no sign-up screen. We never ask for and never receive your name, email address, phone number, password, date of birth, or a social login.

Instead, the first time you launch the app it generates an anonymous identifier for you:

• a random identifier stored in your device's Keychain, and
• where iCloud is available, an identifier derived from your iCloud user record, so the same Litra account follows you to your other Apple devices.

That identifier is a random-looking string. It is not derived from your name or email, and we cannot use it to learn who you are. It is what our server, our purchase provider and our analytics use to recognise a returning reader — nothing more. Because it lives in the Keychain and iCloud, it survives reinstalling the app; that is deliberate, so your subscription and credits come back without a login.

3. What stays on your device and in your iCloud

The content of your reading life does not go to our servers. This stays on your device, and syncs — if you have iCloud enabled — through your own private iCloud database, which is storage under your Apple ID that we cannot read:

• the books and documents you import (EPUB, PDF, FB2, TXT), and their covers;
• your highlights, notes and bookmarks;
• your chats with Orb;
• your reading positions, reading history and reader settings.

Two features run entirely on the device and send nothing anywhere:

• Read-aloud. The speech voices are bundled inside the app. Nothing is uploaded to speak a page.
• Page scanning, first pass. A page you photograph is recognised on the device by Apple's Vision framework. Cloud recognition (section 5) is a separate, deliberate action for pages Vision cannot handle — dense tables, mathematics, multi-column layouts.

4. What our server stores

Litra's API runs on Cloudflare Workers. Its database holds the small amount of state that cannot honestly live on a device — money, mostly:

• Your anonymous identifier — to recognise the account across your devices and reinstalls.
• Orb credit balance, credit lots and a ledger of grants and spends — credits are the unit Orb answers are metered in, and a device cannot be trusted with its own balance.
• Subscription status, mirrored from Apple via Adapty — to know whether you are on a trial, subscribed, or lapsed.
• A device attestation key registration — Apple's App Attest, so the API answers our app and not a script pretending to be it.
• Per-request usage records — which endpoint, which model, token counts, cost, duration and timestamp, for billing and abuse limits.
• A push notification token — the address Apple issues to this install of the app, with whether you have allowed notifications, your language and the app build. iOS issues the token whether or not you allow notifications, and we record it either way; nothing is ever shown to you unless you allowed notifications (section 8).
• Standard request logs (IP address, user agent), short-lived — security and rate limiting.

Usage records never contain your content. We store how many tokens a request cost, not what was in it. The text of your books, your questions and Orb's answers are not written to our database or to our analytics — that is a rule enforced in our own codebase, not a preference.

The launch waitlist on this website (closed)

Before Litra was on the App Store, trylitra.app had a form where you could leave an email address to be told when it was. The form was taken down when Litra went on sale, and the list no longer accepts addresses. If you used it, we stored that address, the time you joined, the country Cloudflare reported for your connection, where the visit came from (a campaign tag or the referring site's name), and a salted one-way hash of your IP address, which existed only to rate-limit the form — the IP address itself was never stored. This sits in its own database on Cloudflare, apart from everything the app uses, and is not connected to any Litra account: the app has no way to know an address was ever on the list.

The address is used for one thing — writing to you about Litra's launch — and the legal basis is your consent in submitting it. It is not sent to our analytics, not shared and not sold. To be removed sooner, write to the address in section 16 from that mailbox and the row is deleted; the list as a whole is deleted once the launch email has gone out.

5. What goes to AI providers, and why

This is the part that matters most, so it is spelled out fully.

Orb cannot answer a question about your book without reading the relevant part of your book. Litra's API is a proxy in front of OpenRouter, which routes each request to the model that serves it. Four things travel that path:

Questions to Orb

When you ask Orb something, the app sends your question, the passages of the open document that Orb searched for and selected on your device, and the page you are currently on. Orb reads excerpts, not the whole book. Your conversation so far travels with the request, because that is what makes a follow-up question work.

Adding a book

When you add a book, Litra builds an index of it so Orb can find things later. To do that, the text of the book is sent, in chunks, to a Google Gemini model through OpenRouter. This is the one case where the whole text of a document passes through an AI provider. It happens once per book, in the background, and it is not charged to your credits.

Dictation

When you dictate instead of typing, the app records a short audio clip, sends it through our API to OpenRouter's transcription model, and inserts the returned text. The clip is not stored by us — it is forwarded, transcribed and dropped.

Cloud page recognition

If on-device recognition of a scanned page is not good enough and you choose to improve it, the page images are sent to a Google Gemini vision model through OpenRouter and returned as text.

The rules that apply to all four

• Single purpose. The data is sent to produce the answer, index, transcript or transcription you asked for, and for nothing else.
• No training on your content. We do not train any model on your books, your questions or Orb's answers, and we do not provide them to anyone to train theirs.
• No sale, no advertising. We do not sell your data and we do not share it with advertisers or data brokers. There are no ads in Litra.
• A pseudonymous identifier travels with a chat request so that a provider-side safety block affects one reader rather than our whole account. It is the same anonymous identifier from section 2 — it carries no name or email.
• The provider's own policy applies in transit. Once a request reaches OpenRouter and the model host, their handling of it is governed by their terms: OpenRouter's privacy policy. Model hosts reachable through OpenRouter include Z.AI, Baseten, Cloudflare, OpenAI, Google, Mistral, DeepSeek and Groq; dictation audio is transcribed by a speech model hosted by Together. Which host serves a given request depends on the model Litra is using and on OpenRouter's routing, and we may change the model or its host.
• What you send is up to you. If a document contains something you would not want a third party to process, do not ask Orb about it — and add it with indexing in mind (section 5, "Adding a book").

6. Service providers

We use a small number of companies to run Litra. Each receives only what its job requires, and each is bound by its own agreement with us.

• Apple — app distribution, payments, iCloud sync and push delivery. It receives your purchases and your iCloud data, under Apple's own privacy policy. Apple handles the payment; we never see your card.
• Cloudflare — API hosting, database and this website. It receives everything in section 4.
• OpenRouter — AI routing for Orb, indexing, dictation and cloud OCR. It receives everything in section 5.
• Adapty — purchase and subscription management. It receives your anonymous identifier, and transaction and subscription state received from Apple.
• PostHog — product analytics. It receives your anonymous identifier and app events: screens opened, features used, model and token counts, latencies, errors. Never the text of a book, question or answer. On this website (trylitra.app) it measures which pages are visited, where visitors arrive from and which links are clicked. It runs there in cookieless mode: it sets no cookies and stores nothing on your device, and visits are counted with a rotating identifier derived on PostHog's servers that cannot identify you or follow you to other sites. The approximate country comes from Cloudflare; your IP address is not kept with those events. PostHog processes this data in the European Union.
• Sentry — crash and error reporting. It receives stack traces, device model, OS version and app version.

We may also disclose data if the law requires it, or to investigate fraud or abuse of the service. If Litra is ever acquired, this policy travels with the data and you will be told before anything changes.

7. Device permissions

• Microphone — only while you hold the dictation control. Used to record the clip described in section 5. Not used for anything else, and never listening in the background.
• Camera — only when you scan a printed page. Photographs are processed as described in sections 3 and 5.
• Notifications — optional, and asked for explicitly.

Litra does not use your location, your contacts, your photo library, or your health data. It does not track you across other companies' apps and websites, and it contains no advertising or attribution SDKs.

8. Notifications

Litra's notifications are reminders. Today there is one: a reminder two days before a free trial ends, if you turned on "Remind me before the trial ends" on the subscription screen, which the app schedules on the device itself. iOS also gives every install a push token; we store it against your anonymous identifier, together with whether you have allowed notifications, so that reading reminders, once Litra sends them, can reach you while the app is closed. We never show a notification on an install that has not allowed them. Turning notifications off in iOS Settings stops them; deleting your data (section 10) removes the token.

9. Retention

• Account, credits and subscription state: kept while the account exists.
• Usage records (endpoint, model, tokens, cost — no content): kept for accounting and abuse analysis.
• Analytics and crash reports: kept for the retention period of PostHog and Sentry respectively.
• Request logs: short-lived, on Cloudflare's standard retention.
• Waitlist addresses (the list is closed — section 4): until the launch email has been sent, or until you ask to be removed, whichever comes first. The rate-limit counters beside them are deleted after two days.
• Content sent to AI providers: not stored by us at all. Its retention in transit is governed by the provider's policy.

10. Deleting your data

Litra creates your account automatically, so it lets you delete it just as easily. In the app, open your profile and tap Delete My Data. After two confirmations, this:

• deletes the server record of your account — the user row, all credit lots, the credit ledger, your usage records and your subscription mirror;
• deletes the app's iCloud database, which removes the synced copy of your books, highlights, notes and chats from your iCloud;
• deletes the books, the index and the app's data on the device.

It cannot be undone, and credits are not refunded. Two things survive on purpose, and neither is your account: an irreversible hash of the deleted identifier together with the free and subscription credit periods it had already been granted, and the device attestation key registration. Both exist so that deleting and recreating an account cannot be used as an unlimited source of free credits. Neither can be used to identify you or to restore anything.

Deleting your data does not cancel your subscription. Apple bills subscriptions, not us, and only you can cancel one — at apps.apple.com/account/subscriptions or in iOS Settings. The app reminds you of this before it deletes anything. If you prefer, you can also ask us at hello@trylitra.app and we will delete the account for you.

11. Your rights

Depending on where you live — for example under the GDPR in the EU and UK, or the CCPA in California — you may have rights to access, correct, export, restrict or erase the personal data a company holds about you, and to object to certain processing. We honour those rights.

Two practical notes. First, Litra holds no directly identifying data about you, so we usually cannot connect a request to an account without the identifier from the app itself. Second, the erasure right is already a button: Delete My Data (section 10) does more, and faster, than an emailed request. For anything else, write to hello@trylitra.app.

Where the GDPR applies, our legal bases are: performance of a contract for the account, credits, purchases and Orb answers you ask for; legitimate interests for security, abuse prevention, crash reporting, product analytics and keeping the push token that lets a reminder reach the device (section 8); and consent for showing notifications, the microphone and the camera, each of which you can withdraw in iOS Settings.

We do not sell or share personal information as those terms are defined by the CCPA, and we do not use it for cross-context behavioural advertising.

12. International transfers

Our providers operate in the United States and on globally distributed infrastructure, so data covered by this policy is processed outside your country, including in the United States. The developer who operates Litra is based in South Africa and administers these systems from there. Where the GDPR applies, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent mechanism in each provider's data processing agreement.

13. Children

Litra is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has used Litra and you want the data removed, write to hello@trylitra.app.

14. Security

All traffic between the app and our API is encrypted with TLS. The API only answers requests from a genuine copy of Litra on real Apple hardware, verified with Apple's App Attest, and each session is authenticated with a signed token that carries the account identifier — so one reader cannot ask for another reader's data. The device's private attestation key never leaves its Secure Enclave. No system is perfect, and we do not claim otherwise; if you find a security problem, please tell us at hello@trylitra.app before disclosing it publicly.

15. Changes to this policy

If we change this policy we will update the effective date at the top, and for a material change — a new category of data, or a new purpose — we will tell you in the app before it takes effect. The current version always lives at trylitra.app/privacy.

16. Contact

Questions, requests, or anything about this policy: hello@trylitra.app. We answer in English.