Privacy Policy for Ribbon
Last updated: 18 August 2026
Ribbon is an EPUB and PDF reader for Android. This policy describes exactly what the app collects, what leaves your device, where it goes, and how to get rid of it.
The short version: your books never leave your device. There is no account, no advertising, no analytics, and nothing is sold or shared with anyone. What syncs is the information needed to keep your place — and only to devices you have paired yourself.
1. There is no account
Ribbon never asks for a name, an email address, or a password, and there is nothing to sign up for.
When the app first needs to sync, it signs in to Google Firebase anonymously. This produces a random identifier with nothing attached to it — no email, no profile, no link to any Google account you may be signed into on the device. It exists only so the server can tell your devices apart from everyone else's.
If you never pair a second device and never send feedback, the app never signs in at all and nothing described in section 3 ever leaves your device. Crash reporting (section 4) is the one exception, because it runs before any of this.
2. What stays on your device
- Your book files. EPUBs and PDFs are read where they already are. Ribbon does not copy them, move them, or upload them. They are never sent to any server, at any point, for any reason.
- Book covers, extracted from your files for the library.
- Your settings — typeface, text size, theme, margins.
- Everything in section 3, which is kept locally first and synced only if you pair.
3. What syncs between your devices
Nothing syncs until you pair a second device with a code. Pairing is a deliberate act; it is not on by default.
Once paired, the following is stored in Google Cloud Firestore so your devices can share it:
| What | Details |
|---|---|
| Reading position | Which book, how far through it, and which device set it |
| Book details | Title, author, when you added it, whether it is a favourite or finished, and identifiers derived from the file |
| Quotes you save | The text of the passage itself, any note you wrote on it, the highlight colour, and the chapter it came from |
| Collections | The names you gave them and which books are in them |
| Your devices | The device name your phone or tablet reports (for example “Pixel 8”), and when it last synced |
| Pairing codes | Short-lived, and deleted once used or expired |
Please read the quotes row carefully. A saved quote includes the words you highlighted and anything you wrote about it. That is more personal than a title and an author, and it is stored on a server so it can reach your other device. If you would rather it did not, do not pair, or do not save quotes.
Ribbon does not sync or store: the contents of your books beyond quotes you chose to save, your location, your contacts, your browsing, your advertising ID, or any other identifier used for tracking.
4. Crash reports
Ribbon uses Firebase Crashlytics to find out when it has crashed.
A crash report contains a stack trace (where in the code it failed), your device model, and your Android version. It contains no book, no title, no reading position, and no quote.
This is on by default and you can turn it off at any time in Settings › Privacy › Send crash reports. Turning it off also discards any report already waiting on the device — nothing that was queued gets sent later.
Crash reporting is disabled entirely in development builds.
5. Feedback you choose to send
If you use Settings › Send feedback, the app sends the message you typed, an email address only if you chose to give one, your app version, your device model, and your Android version. Nothing about what you are reading is included.
Feedback is stored so that it can only be written, never read back, by any copy of the app — including yours. Nobody using the app can read anyone's feedback, including their own.
6. Sending a book to your other device
When you share a book between two paired devices, the file goes directly from one device to the other over your local Wi-Fi network. It does not pass through any server and no copy is kept anywhere else. The two devices prove to each other that they belong to the same pairing before anything is transferred.
7. Where it is stored, and who can read it
Synced data is held in Google Cloud Firestore in the europe-west1 region (Belgium). Google acts as the hosting provider; see the Firebase privacy documentation for how they handle data on our behalf.
Access is enforced by server-side security rules. A device can read and write only the data belonging to a pairing it is a member of. Devices outside your pairing cannot read your data, cannot list it, and cannot join without a valid code that you generated.
Nothing is sold, rented, shared with advertisers, or used to build a profile of you. There are no third-party trackers or SDKs in the app beyond the Google Firebase components named in this policy.
8. How long it is kept
- Reading positions, books, quotes and collections are kept while you have a paired device that uses them.
- Deleted items leave a marker behind for 90 days, so a device that has been offline learns about the deletion when it comes back. After 90 days the marker is removed.
- Pairing codes expire in minutes and are deleted once used.
- Crash reports are retained by Firebase Crashlytics for up to 90 days.
9. Getting your data removed
- Unpair a device in Devices to cut it off. It immediately loses access to everything in the pairing.
- Turn off crash reports in Settings, which also discards any report not yet sent.
- Delete everything held on the server by unpairing every device in the pairing. If you would like the stored data for your pairing deleted outright, contact us (section 11) and we will remove it.
- Uninstalling the app removes everything held on that device.
Because there is no account, we cannot look you up by name or email, and we cannot connect stored data to you as a person. To have a specific pairing deleted we will need you to tell us its identifier, which you can find in the app.
10. Children
Ribbon is not directed at children and does not knowingly collect information from children. There is no account to create, no profile, and no advertising.
11. Contact
Questions, or a request to delete stored data:
[your contact email]
12. Changes to this policy
If this policy changes in a way that affects what is collected or where it goes, the date at the top will be updated and the change described here. Material changes will be noted in the app's release notes.