1. Who we are
Srrk is a reading companion app that lets you scan or enter a book ISBN, receive pre-reading context, and save your library, bookmarks, and notes. The app is operated by KAI-0419 under the app name Srrk.
For privacy requests, email visionary.0419@gmail.com. Include only the information needed to identify and respond to your request.
2. Data we collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email address, password authentication records, social sign-in identifiers, display name, avatar URL, app language. | To create accounts, authenticate users, keep sessions active, and show account information. |
| Reading data | Scanned or manually entered ISBNs, books added to your library, bookmarks, saved curation items, notes, timestamps. | To provide the library, bookmark, note, and curation features you choose to use. |
| Generated and cached content | Book metadata, cover URLs, AI-generated curation cards, related-book matches, model and prompt metadata. | To prepare and improve book curation, avoid duplicate generation, and make the service faster. |
| Device and technical data | Authentication session tokens stored on your device, request logs, function timing, rate-limit counters, error logs, IP address processed by hosting providers. | To operate, secure, debug, and prevent abuse of the service. |
| Camera access | Camera permission is used to scan ISBN barcodes. | Camera frames are used for barcode recognition. Srrk does not store camera images or upload camera frames for normal ISBN scanning. The recognized ISBN is sent to the service when you continue. |
| Advertising identifiers (when monetization is active) | Apple App Tracking Transparency (ATT) status, Identifier for Advertisers (IDFA) on iOS when granted, Google Advertising ID (AAID) on Android, ad request and impression metadata, mediation network identifiers (Google AdMob, Pangle). | To request, render, frequency-cap, and measure advertisements when the app is operating in monetization mode. We always ask for system-level consent (UMP / ATT) before using identifiers for personalized advertising. You can withdraw consent at any time from Settings → Ad consent. |
| Purchase identifiers (when in-app purchase is active) | App Store / Google Play purchase receipts, RevenueCat-issued customer ID linked to your Srrk account ID, entitlement status (e.g. plus or legacy ad_free), subscription period, purchase timestamp. |
To validate Srrk Plus subscriptions and legacy ad-free purchases, restore purchases on new devices, apply entitlements, and enforce server-side usage limits. Payment instruments and card numbers are handled by Apple, Google, RevenueCat, and, for future web billing, Stripe — Srrk never receives them. |
Monetization status. The app binary distributed via App Store and Google Play includes Google Mobile Ads SDK and RevenueCat for in-app purchase. These SDKs are activated only after the operator enables monetization for the build, after which:
- iOS users will see an App Tracking Transparency prompt before any advertising identifier is used.
- EEA / UK / Switzerland users will see a Google User Messaging Platform (UMP) consent form.
- Until consent is granted, Srrk requests non-personalized advertising only.
Srrk does not ask for precise location, contacts, health data, or microphone access. We do not use Srrk data for cross-app tracking outside of advertising consent flows described above.
3. How we use data
- Provide account sign-in, account deletion, and session sync.
- Look up book information from ISBNs and display covers, titles, authors, descriptions, and related metadata.
- Generate pre-reading curation with AI and cache generated results.
- Save and sync your library, bookmarks, and notes across sessions.
- Apply rate limits, troubleshoot failures, protect the service, and maintain security.
- Respect your chosen app language and localize content where supported.
- When monetization is active: request and render advertisements, apply per-session and per-day frequency caps, deliver server-side reward verification for opt-in rewarded video, and measure ad performance for billing and policy compliance with Google AdMob and any active mediation partners.
- When subscription purchase is active: validate Srrk Plus and legacy ad-free purchases via Apple, Google, and RevenueCat, store the resulting entitlement linked to your Srrk account ID, and honor the entitlement across devices.
We do not sell personal data in the sense of state privacy laws (CCPA / CPRA). When advertising is active, we may share advertising identifiers and ad-request signals with Google AdMob and active mediation partners (Pangle DSP) for the purpose of selecting and measuring ads. You can withdraw advertising consent at any time, and you can disable advertising while Plus is active.
4. Legal bases for users in the EEA, United Kingdom, or Switzerland
Where GDPR or similar law applies, we rely on the following legal bases:
- Contract: to provide app features you request, including authentication, library sync, curation, bookmarks, and notes.
- Legitimate interests: to secure the service, prevent abuse, debug errors, maintain caches, and improve reliability.
- Consent: where your device platform asks for permission, such as camera access or social sign-in.
- Legal obligations: where retention or disclosure is required by applicable law.
5. Sharing and service providers
We share data only as needed to operate Srrk:
- Supabase: authentication, database, storage, edge functions, account deletion, and security logs.
- Apple and Google: sign-in providers when you choose those methods.
- Google Gemini API: generation of curation content and book Q&A responses from book metadata, ISBN-related context, questions, and text you submit. Your saved private notes are not intentionally sent for curation generation.
- Book metadata sources: Kakao/Daum Book Search, the National Library of Korea, Open Library, and Internet Archive may receive ISBN or search-query data to retrieve book metadata and covers.
- GitHub Pages: hosts this privacy policy page and may process standard web request logs.
- Google AdMob (when monetization is active): receives ad-request signals, advertising identifiers (subject to ATT / UMP consent), device locale, and impression/click events to select and measure ads. Acts as the mediation orchestrator.
- Pangle (ByteDance) DSP (when monetization is active and Pangle adapter is enabled): receives mediation ad-request signals from Google AdMob to participate in the ad auction. Pangle’s consent is forwarded via the AdMob mediation adapter according to your ATT / UMP choice.
- Firebase Remote Config / Crashlytics / Performance / Analytics: feature-flag delivery, crash diagnostics, ad SDK integration health, and aggregated usage metrics. Used to operate kill switches and circuit breakers for ads and to detect regressions.
- RevenueCat (when purchase is active): receives a Srrk-issued user identifier and validated App Store / Google Play receipts to determine and synchronize Plus and legacy ad-free entitlements. RevenueCat does not receive payment instruments.
- Apple App Store and Google Play (when in-app purchase is active): process the actual payment and receipt as the platform of record.
Service providers may process data in countries other than your country of residence (notably the United States). We use these providers to provide and protect the service.
For App Tracking Transparency (iOS) and EEA/UK/CH UMP (Android & iOS), we will request consent before any third-party advertising partner receives identifiers used for personalized advertising. You can withdraw consent at any time from Settings → Ad consent, and you can disable advertising while Plus is active.
6. Retention and deletion
- Account data and user-specific reading data are kept while your account is active.
- You can delete individual notes, bookmarks, and books from the app where those controls are available.
- You can delete your account in the app settings. Account deletion removes your account and user-specific rows associated with your account, including library entries, bookmarks, notes, and other account-linked data.
- Global book metadata, cover cache, and non-user-specific curation cache may remain because they are not tied to a single user account and are used to provide book lookup and curation to all users.
- Technical logs and security records are kept only as long as reasonably needed for operations, security, debugging, or legal compliance.
7. Security
Srrk uses Supabase authentication, row-level access controls, HTTPS/TLS, platform permission prompts, and server-side service controls. Authentication tokens are stored on your device to keep you signed in. No method of transmission or storage is perfectly secure, but we use reasonable safeguards for the type and amount of data processed.
8. Your choices and rights
- Camera permission can be denied or revoked in your device settings. You can enter ISBNs manually instead.
- You can change the app language in Srrk settings.
- You can sign out or delete your account in Srrk settings.
- Depending on your location, you may request access, correction, deletion, restriction, portability, objection, or withdrawal of consent.
- If you are in the EEA, United Kingdom, Switzerland, Korea, or another region with a privacy regulator, you may have the right to lodge a complaint with that authority.
9. Children
Srrk is not intended for children under the age required by applicable law to consent to online services. We do not knowingly collect data from children. If you believe a child provided personal data, contact us so we can review and delete it where appropriate.
10. AI-generated content
Srrk uses AI to generate reading context from book metadata. The output may be inaccurate or incomplete and should be treated as reference material. AI curation is not used to make decisions that produce legal or similarly significant effects about users.
11. Changes to this policy
We may update this policy when Srrk changes or when legal, operational, or platform requirements change. The effective date at the top of the page shows the latest version.