Privacy Policy for Ribbon
Last updated: 11 October 2026
Ribbon is an EPUB and PDF reader. This policy covers all three of its apps: the Android app, the Mac app, and the reader at ribbon-reader-sync.web.app/read. It describes exactly what each one collects, what leaves your device, where it goes, and how to get rid of it.
Where they differ, it says so. The short answer is that the Mac and web readers do less: they have no crash reporting, no usage statistics, no translation and no feedback form, so sections 4, 5, 6, 7 and 8 are about the Android app alone.
The short version: your books never leave your device. There is no account, no advertising, no analytics, and nothing is sold or shared with anyone. What syncs is the information needed to keep your place — and only to devices you have paired yourself.
1. There is no account
Ribbon never asks for a name, an email address, or a password, and there is nothing to sign up for.
When the app first needs to sync, it signs in to Google Firebase anonymously. This produces a random identifier with nothing attached to it — no email, no profile, no link to any Google account you may be signed into on the device. It exists only so the server can tell your devices apart from everyone else's.
If you never pair a second device and never send feedback, the app never signs in at all and nothing described in section 3 ever leaves your device. Crash reporting (section 4) and usage statistics (section 5) are the two exceptions, because both run before any of this; both can be turned off, and neither carries anything out of your library. Translation (section 7) is the other way text can leave, and only when you tap Translate.
2. What stays on your device
- Your book files. They are never sent to any server, at any
point, for any reason.
On Android and on the Mac, they are read where they already are: Ribbon remembers where a book is and does not copy it, move it, or change it.
In a browser it cannot work that way. A web page is handed a file's contents and never told where the file is, so the web reader keeps its own copy of each book you add to it. That copy lives in your browser's private storage for this site, on your computer, and is not readable by other sites or by us. Clearing this site's data removes it, and so does the Remove button next to the book.
- Book covers, extracted from your files for the library.
- Your settings — typeface, text size, theme, margins.
- Everything in section 3, which is kept locally first and synced only if you pair.
3. What syncs between your devices
Nothing syncs until you pair a second device with a code. Pairing is a deliberate act; it is not on by default.
Once paired, the following is stored in Google Cloud Firestore so your devices can share it:
| What | Details |
|---|---|
| Reading position | Which book, how far through it, and which device set it |
| Book details | Title, author, when you added it, whether it is a favourite or finished, and identifiers derived from the file |
| Quotes you save | The text of the passage itself, any note you wrote on it, the highlight colour, and the chapter it came from |
| Collections | The names you gave them and which books are in them |
| Your devices | The device name your phone or tablet reports (for example “Pixel 8”), and when it last synced |
| Pairing codes | Short-lived, and deleted once used or expired |
Please read the quotes row carefully. A saved quote includes the words you highlighted and anything you wrote about it. That is more personal than a title and an author, and it is stored on a server so it can reach your other device. If you would rather it did not, do not pair, or do not save quotes.
Ribbon does not sync or store: the contents of your books beyond quotes you chose to save, your location, your contacts, your browsing, your advertising ID, or any other identifier used for tracking.
4. Crash reports
Ribbon uses Firebase Crashlytics to find out when it has crashed.
A crash report contains a stack trace (where in the code it failed), your device model, and your Android version. It contains no book, no title, no reading position, and no quote.
This is on by default and you can turn it off at any time in Settings › Privacy › Send crash reports. Turning it off also discards any report already waiting on the device — nothing that was queued gets sent later.
Crash reporting is disabled entirely in development builds.
5. Usage statistics
Ribbon uses Firebase Analytics to count how often the app is opened and which version is running, so it is possible to tell which problems are worth fixing first.
What it records is the app's own behaviour: that a session started, that the app was updated, that it crashed. Alongside it Google records a randomly generated identifier for this installation, your device model, your Android version, your language, and the country derived from your IP address.
It contains no book, no title, no author, no reading position, no quote, and nothing you have typed. No event sent by Ribbon names anything out of your library. Your IP address is used by Google to derive the country and is not retained with the events.
This is on by default and you can turn it off at any time in Settings › Privacy › Share usage statistics. Turning it off also resets the identifier, so what was collected before cannot be joined to anything collected after.
Nothing is collected before that switch has been read — collection is off in the app's manifest and only turned on once your choice is known.
Usage statistics are disabled entirely in development builds.
6. Feedback you choose to send
If you use Settings › Send feedback, the app sends the message you typed, an email address only if you chose to give one, your app version, your device model, and your Android version. Nothing about what you are reading is included.
Feedback is stored so that it can only be written, never read back, by any copy of the app — including yours. Nobody using the app can read anyone's feedback, including their own.
7. Translating text
When you press and hold text and tap Translate, the text you chose is sent to Google Translate, a service run by Google, and Google's translation page is shown inside Ribbon.
- Nothing is sent unless you tap Translate. Pressing and holding text, choosing a word, sentence or page, and copying it all happen on your device.
- Only the text shown in the translation sheet is sent — a word, a sentence, or up to 1,500 characters of a page. Never the book, its title, or your reading position.
- The page is Google's own website, so Google's privacy policy applies to it, including any cookies Google sets inside that page. See policies.google.com/privacy.
- If you choose a different language inside the translation page, Ribbon remembers that choice on your device for next time. It is not synced.
8. Sending a book to your other device
When you share a book between two paired devices, the file goes directly from one device to the other over your local Wi-Fi network. It does not pass through any server and no copy is kept anywhere else. The two devices prove to each other that they belong to the same pairing before anything is transferred.
9. Where it is stored, and who can read it
Synced data is held in Google Cloud Firestore in the europe-west1 region (Belgium). Google acts as the hosting provider; see the Firebase privacy documentation for how they handle data on our behalf.
Access is enforced by server-side security rules. A device can read and write only the data belonging to a pairing it is a member of. Devices outside your pairing cannot read your data, cannot list it, and cannot join without a valid code that you generated.
Nothing is sold, rented, shared with advertisers, or used to build a profile of you. There are no third-party trackers or SDKs in the app beyond the Google Firebase components named in this policy.
10. How long it is kept
- Reading positions, books, quotes and collections are kept while you have a paired device that uses them.
- Deleted items leave a marker behind for 90 days, so a device that has been offline learns about the deletion when it comes back. After 90 days the marker is removed.
- Pairing codes expire in minutes and are deleted once used.
- Crash reports are retained by Firebase Crashlytics for up to 90 days.
- Usage statistics are retained by Firebase Analytics for up to 2 months, and the aggregate counts built from them are kept indefinitely because they no longer describe any one device.
11. Getting your data removed
- Unpair a device in Devices to cut it off. It immediately loses access to everything in the pairing.
- Turn off crash reports in Settings, which also discards any report not yet sent.
- Turn off usage statistics in Settings, which also resets this installation's identifier.
- Delete everything held on the server by unpairing every device in the pairing. If you would like the stored data for your pairing deleted outright, contact us (section 13) and we will remove it.
- Uninstalling the app removes everything held on that device.
Because there is no account, we cannot look you up by name or email, and we cannot connect stored data to you as a person. To have a specific pairing deleted we will need you to tell us its identifier, which you can find in the app.
12. Children
Ribbon is not directed at children and does not knowingly collect information from children. There is no account to create, no profile, and no advertising.
13. Contact
Questions, or a request to delete stored data:
14. Changes to this policy
If this policy changes in a way that affects what is collected or where it goes, the date at the top will be updated and the change described here. Material changes will be noted in the app's release notes.