Privacy Policy

What stays on your device

All of it, unless a section below says otherwise:

• your audiobook files, and the folders you point the app at
• cover art, chapter lists and tags read from those files
• your position in every book, your bookmarks and your notes
• listening history and statistics
• every app setting

This lives in the app’s own private storage. Uninstalling the app deletes it.

The app reads your audiobook files where they already are. It does not upload them, copy them off the device, or index them anywhere but on the phone itself.

1. Diagnostic reports

When this happens

• You tap Send Feedback in Settings, or
• On Android only, the app notices on its next start that it closed by itself, and asks whether it may send a report.

Automatic crash reports are OFF unless you turn them on. The first time CAP detects that it crashed, it tells you what a report contains and asks. Nothing is sent before you answer, and if you decline, nothing is sent then or later. Your answer covers future crashes and can be changed at any time.

There is no such feature on iOS (nothing there can detect a crash), so the question is never asked and the switch is not shown.

What is sent

A report record, containing:

A diagnostic log: the app’s own record of what it was doing, uploaded to private storage at api.cranesoft.com.

Your feedback text is sent by your own email app, as a draft addressed to feedback@cranesoft.com that you review and send yourself. If you send it, we see your email address, because you sent us an email. The draft also carries a reference to the uploaded log so the two can be matched up.

The installation id

A random value, generated on the device the first time the app runs. It is not an account, is not derived from anything about you or your hardware, and is not shared with anyone. Its only job is to let two reports from the same phone be recognised as coming from the same phone. Uninstalling the app discards it.

Who can see it

Diagnostic logs go to a private, insert-only store: the app can add a log but cannot list, read or alter anything, including its own earlier uploads. Only Cranesoft can read them, and only to investigate a fault.

They are never sold, never shared with advertisers, and never used to build a profile of you.

To upload, the app signs in to our server anonymously: no name, no email, no password. Like any web server, ours records when that sign-in happened, the network (IP) address it came from, and the app's identifying string.

When a report arrives, a notification service (ntfy.sh, which relays through Google's Firebase) tells us so. The notice carries only the kind of report, the phone model, the system version and the app version, for example "New bug report — android 36 / SM-S937U, CAP 1.0.2". It carries nothing you typed, no name or email, and nothing that identifies you or your installation. ntfy.sh keeps a notice for 12 hours.

How long it is kept

We keep diagnostic reports and logs for 90 days. Anything older is deleted. The check runs every day. We also make short-lived backup copies of our server; each is deleted 14 days after it is made. The anonymous sign-in is deleted once it is more than 90 days old and has no report or log left.

Before a report is deleted, it is added to an anonymous daily count. The count records only: the day, the platform (Android or iOS), the system version, the phone model, the app version, the kind of report, the kind of crash if there was one and how many, whether a log was attached, and whether it was sent automatically. It does not record your installation id, any account id, the message you typed, your name or email, or anything from the log. These counts are kept with no end date. They contain no identifier, and we never try to match them to a person; they are how we can still tell, a year from now, which release crashed more.

An email you send us is kept in our mailbox. That includes the copy of a report your email app sends to feedback@cranesoft.com. It stays until you ask us to delete it.

You can ask us to delete your reports, logs and emails at any time by writing to privacy@cranesoft.com. Quote your installation id (Settings ▸ About shows it; tapping it copies it, and Share sends it to another device) and we will delete everything associated with it, including any email you sent us. The anonymous counts stay, because they are not about you. A log we cannot match to your id is still deleted when it reaches 90 days.

2. Hardcover

Only if you connect a Hardcover account, which is entirely optional and off until you do it.

When connected, the app sends your reading progress (a number of seconds, or a page count for a print edition) and marks books as currently reading, to api.hardcover.app, for books you have linked yourself.

This writes to your public Hardcover profile. That is what Hardcover is for, and it is worth being aware of: anyone who can see your profile can see that progress. What Hardcover then does with it is governed by Hardcover’s own privacy policy, not this one.

Your Hardcover access token is held in the device’s own secure storage, the Keychain on iOS or the Keystore on Android, and is never included in a diagnostic report; the scrubbing described above removes it.

Disconnecting Hardcover in Settings deletes the token from your device. It does not delete anything already on your Hardcover profile; you control that at Hardcover.

3. Wi-Fi transfer

The app can run a small web server so you can send audiobooks from a computer on the same network. While that screen is open:

• the server is reachable only on your local network, never from the internet
• a six-digit PIN, shown on the phone, is required
• five wrong PINs lock it until the app is restarted
• it stops when you leave the screen, and after ten minutes of inactivity

Files sent this way go straight into the app’s own storage on your phone. Nothing about this feature sends anything to us or to anyone else.

4. Crane Pro purchases

Crane Pro is bought through Google Play or the App Store. The store takes the payment. We never see your card, your billing address, or the name or email on your store account.

The app asks the store whether your store account owns Crane Pro, and keeps the answer on your phone. The day your free 30 days started is kept on your phone too.

If you send a diagnostic report, its log includes what the store told the app: whether Crane Pro is unlocked, how many free days are left, the result of a purchase or restore (for example bought, cancelled or pending), whether a purchase was refunded, the store’s own error codes, and on iPhone the store’s country. The log never includes a purchase token, a receipt, an order number, or any payment detail.

Permissions, and why

The app asks for as little as it can. As of this version it requests:

It does not ask for the microphone, the camera, your photos, your location, your contacts, or your physical activity.

Children

CAP is not directed at children and we do not knowingly collect information from anyone under 13. If you believe a child has sent us a report, write to privacy@cranesoft.com and we will delete it.

Your rights

Depending on where you live, you may have the right to see what we hold about you, to correct it, to have it deleted, or to object to our holding it.

Because the only thing we hold is diagnostic reports, the practical answer to all of these is the same: write to privacy@cranesoft.com with the installation id from Settings ▸ About, and we will tell you what we have and delete it on request.

Changes

If this policy changes in a way that affects what leaves your device, we will say so in the app’s release notes rather than quietly updating this page.

Contact

Cranesoft LLC, privacy@cranesoft.com

If you need a postal address for a formal request, ask at that address and we will provide one.