Privacy Policy

LexiByte is a multilingual reading assistant designed for children and their families, available in 15 languages. We are committed to protecting your personal data and to collecting as little of it as possible. This policy explains what information we collect, how we use it, where it is stored, and how you can delete it.

We collect the following data:

• Google Account: your name, email address, and profile picture — only if you choose to sign in with Google.
• Account record: when you sign in, we keep a minimal record of your account — your Google account identifier, email, name, and the time you were last active — in our database (hosted by Supabase in the European Union), so we can manage registered users and understand activity. For users in the EU/EEA, this record stays within the EU.
• How you use LexiByte: when a new account is first set up, we ask once whether you will use LexiByte for yourself, for your family, or at a school. We store only that single choice (self, family or school) on your account record — no free text. We use it to create your starting member profiles and for aggregate product statistics. It is never used for advertising, and you can ask us to delete it.
• Family profiles: when you set up a family account you may add family members (for example, your children). For each member you provide a display name, an age or age range, a role (parent or child), and a preferred / mother-tongue language. You choose this information yourself; we do not require a child's full legal identity.
• Reading & learning data (per family member): book reading progress, word lookup history, saved sentences and favorites, reading sessions and effective reading time, reading-comprehension quiz results and scores, reading streaks, and reading tasks or plans a parent sets for a child.
• LexiBot chat history: messages you exchange with the in-app AI reading assistant are saved so your conversation persists between sessions.
• PDF files: books you upload are stored in one of two places, depending on your account. If you have connected Google Drive, they are stored in a folder named LexiByte on your Google Drive, and we only access this folder to display your books within the app. If you have not connected Google Drive, the books you upload (and their cover images) are stored in LexiByte's private file storage (Vercel Blob), within the limits of your plan. These files are private: they are never public, and they can only be downloaded through short-lived links issued to your own signed-in account. File names in our storage do not contain your email address or the book title. If you connect Google Drive later, the books you uploaded to our storage are copied into the LexiByte folder in your Drive; only after every book has been copied and checked do we switch your library to Drive and delete our copies. Public-domain books from the LexiByte catalog are shared copies and are not stored per user.
• Text prepared from your books: when you add a book (and, for books already on your shelf, when you agree to prepare them or open them), your device extracts its text and splits it into chapters so the book can be read in the e-ink edition (lexibyte.app/eink); for scanned books, the text recognised on your device is kept too. This text is stored with your reading data (in our database, encrypted — see section 3), is never shared with other accounts, and is deleted when you delete the book.
• E-ink reader passes: when a parent taps Read on e-ink reader, we create a 6-digit code (stored only as a keyed hash, valid for 10 minutes, usable once). Entering it on an e-ink reader opens that one book without signing in; the pass travels in the page address and nothing is stored on the device, so closing the page ends it — but reopening that same address from the browser's history still opens the book (until the book is deleted or set to parents-only). We store the pass (which account, which book, when it was given and last used) — no information about the device. Deleting the book revokes its passes. To limit guessing, failed code attempts are counted per network address for 30 minutes, stored only as a keyed hash of the address.
• Beta waitlist: your email address and optional name, if you join the beta list. This is stored in a Google Sheet managed by LexiByte.

We do not collect browsing data, advertising cookies, location data, or payment information.

Your reading & learning data and your LexiBot chat history are kept locally in your browser (localStorage) and synced to our database (Supabase, hosted in the EU), so your progress follows you to another device. This covers reading progress, quiz results, the wrong-answer notebook, saved sentences, looked-up words, reading streaks, LexiBot chat history, text prepared from your books, and your family settings (family members, parent PIN, reading tasks, book settings). For family accounts, each child's data sits under the parent account holder's account. Connecting Google Drive later does not move this data: Drive is only ever used for book files (see section 2). You can delete the reading data at any time (see section 9).

Encryption. The contents of these records are encrypted in our database with a key that is kept separately from the database, so they cannot be read from a copy of the database alone. Our server decrypts them only when it needs them to provide the features described in this policy — for example, to show you your progress, or to send a parent notification email you turned on.

We also keep a minimal account record (account identifier, email, name, last-active time) in our database, the beta waitlist (Google Sheet), and the transient text sent to our AI provider while a request is being processed (see section 5).

Your data is used solely to:

• Save and restore your reading progress across devices;
• Display your word lookup history, saved sentences, dashboards, and reading streaks;
• Generate reading-comprehension questions and record quiz results;
• Let parents set and track reading tasks and plans for their children;
• Power the AI assistant (definitions, translations, explanations, and chat) by sending it the relevant text;
• Contact beta waitlist users about LexiByte testing.

LexiByte uses the OpenAI API to power word definitions and translations, reading-comprehension quiz generation, short explanations, and the LexiBot reading-assistant chat. For these features, only the text needed for the feature — a selected word or sentence, the current page or chapter text, or your chat message — is sent to OpenAI to produce a response. We do not send your account identity or a child's profile to OpenAI. OpenAI processes this data under its own Privacy Policy and does not use data submitted through its API to train its models. We do not retain the page or chapter text on our servers after the response is delivered. Because OpenAI processes data on servers located in the United States, using these features involves an international transfer of the submitted text.

Connecting Google Drive is optional and separate from signing in. If you connect it, LexiByte requests access to your Google Drive solely to read and write files in the LexiByte folder it creates (the drive.filescope — per-file access only). We do not access any other files in your Drive. So that you are not asked to grant this permission again every time you sign in, we keep the long-lived authorization Google issues to us (a "refresh token") in our database. It is encrypted with a key that is not stored in the database, and it can only reach the files LexiByte created in your Drive. When you open a book stored in your Drive, your browser downloads it directly from Google, so the book's contents do not pass through our servers. To make that possible, our server first checks that the book is yours and then gives your browser the same Google access token we use to access your Drive— it only reaches the files LexiByte created, and it is valid for about an hour at most. Your browser uses it only for that download; it is not available to the page's scripts the rest of the time, and it is not written to your browser storage or to our logs. We still keep this access token in your sign-in cookie, which is encrypted and cannot be read by the page's scripts, so that our server can reach your Drive on your behalf. If the direct download fails (for example, on a restrictive network), our server fetches the book from your Drive and passes it straight to your browser without keeping a copy. You can revoke this access at any time from your Google Account settings; once Google tells us the authorization has been revoked, we delete our stored copy.

LexiByte is built to be set up and supervised by a parent or guardian.

• A parent creates the account — with their own Google account or their own email address — and adds family members (children) as profiles under it. Signing up with an email address requires confirming that you are a parent or guardian aged 18 or over; once the sign-in code proves the email address is yours, we record when that confirmation was given. The parent is the account holder and controls all data.
• A child's reading and learning data is stored under the parent's account in our database (see section 3) — not in a separate child-owned account.
• Parent-only functions — managing members, setting reading tasks, marking books as 18+, manually approving quiz results, deleting records — are protected behind a parent PIN.
• We do not knowingly collect personal data directly from a child, and we ask that profile information be provided by the supervising parent. We recommend using a first name or nickname rather than a full legal name.
• If you believe a child has provided personal data without parental consent, contact us and we will delete it.
• Google Sign-In enforces its own minimum age requirements.

If you use LexiByte as a guest (without signing in), all your data remains in your browser's localStorage on your device only; clearing your browser cache or site data will permanently delete it. Once you sign in — with Google or with an email code — your data is also synced as described in section 3.

We keep your data only for as long as you choose to. How you delete it depends on where it lives (see sections 2 and 3):

• In your browser — clear your browser's site data.
• Books in your Google Drive — delete the book from your shelf, or delete the LexiByte folder in your Drive. This removes book files only; your reading data in our database is deleted as described below.
• Books in our private file storage — delete the book from your shelf; its file and cover are deleted from our storage at the same time.
• In our database — delete your reading data from inside the app (parent settings), or email us and we will delete it. We will confirm when it is done. Deleting reading data in the app removes progress, results, saved sentences and looked-up words — from our database and from the device you delete it on; your other signed-in devices clear their copy the next time they open LexiByte, so it cannot be synced back. Your family settings (family members, parent PIN, reading tasks, book settings) and the books on your shelf are kept so the account stays usable.

Parent notification emails (optional, off by default).These are sent only if a parent turns on “Email me when the day is done” for a child's daily reading plan (Manage members → Reading plan). On a day the child completes that plan, we send one email to the email address of the signed-in account. To deliver it, our email delivery providers (named below) receive: that email address, the child's display name as entered in your family profiles, the book titles and chapter numbers completed that day (including which ones made up for, or read ahead of, another day of the week), this week's progress so far (for example “3 of 7 done”), and the language the email is written in. No scores, quiz answers or looked-up words are included. We send at most one such email per child, per plan, per day. In our database we keep only a delivery log — account, member and plan identifiers, the date, and whether it was sent — so the same email is never sent twice; for every account it is automatically deleted after 60 days. The log does not contain names or book titles. You can delete it yourself at any time in Manage members → “Parent email send log” (the parent PIN is required) — entries from the last 3 days are kept until they are no longer needed to prevent a duplicate email, and are deleted automatically within 3 days; it is also deleted when you delete your reading data stored in our database, and together with your account if you ask us to delete your account. To stop these emails, turn the option off in Manage members → Reading plan.

We do not sell or share your personal data. The only third parties that process data on our behalf are Google (sign-in and, if you connect it, storage of your book files in your Google Drive), Vercel (which hosts the app and, for accounts that have not connected Google Drive, stores the book files you upload — see section 2), OpenAI (the AI features described in section 5), Supabase (which hosts the account record described in section 2, the encrypted Google Drive authorization described in section 6, and the encrypted reading data described in section 3), and our email delivery providers — Resend, with Brevo (an EU provider) as a backup when Resend cannot deliver (they deliver the sign-in code email, so they receive your email address and the one-time code, and — only if a parent turns them on — the parent notification emails described above), each under their own privacy policies.

You may at any time:

• Access and review the data stored in your browser and in your LexiByte Drive folder, and ask us for a copy of the data held in our database;
• Correct your family profiles directly in the app;
• Delete your local data by clearing your browser's localStorage;
• Delete the reading data held in our database from inside the app, or delete the books in your LexiByte Drive folder (see section 9);
• Delete any book you uploaded to our private file storage by removing it from your shelf;
• Revoke LexiByte's access to your Google account;
• Withdraw your consent at any time by ceasing to use the app and deleting your data.

If you are located in the EU/EEA or the UK, you also have the right to data portability and to lodge a complaint with your local data protection authority.

We may update this policy from time to time. In case of material changes, we will update the date at the top of this page.

For any questions about this policy, or to make a data request, contact us at: contact@lexibyte.app