Privacy policy for the app “Baseline Reader”

Last updated: 11 November 2026

In short

• Baseline Reader reads PDF and EPUB files. Your library, reading position, bookmarks and highlights stay on your device.
• I, the developer, do not run a server that receives your documents or reading data. There is no user account with me, no advertising, no analytics of my own and no crash reports of my own in the app. Google’s ML Kit for text recognition may send technical diagnostic data to Google (see “Other parties”).
• Your documents and reading data leave your device only if you switch on or trigger one of these features: backup and sync with your Google Drive, AI chat via OpenRouter (also with web search), read-aloud with a cloud voice or with an online voice of your device, reporting an AI answer, sharing, “Send to” and exporting.
• There are three exceptions without any action by you: at every start and every time you return to the app, the app asks my server gasperl.at for the time (item 5). The Google Play version asks Google Play about your purchases. And, depending on your device settings, Android may back up app data to your Google account (see “Other parties”).

Controller

Michael Gasperl, Franz Gruber Str. 10/1, 5020 Salzburg, Austria
Email: michael@gasperl.at

What stays on your device

The app stores on your device: the documents of your library (copies of the files you open), cover images, reading position, bookmarks, highlights, search text and text-recognition (OCR) results, custom fonts, settings, AI chat history, and the keys you enter for AI chat and read-aloud. The keys are kept in Android’s encrypted, device-bound storage and are excluded from Android’s device backup. The text of your documents is not sent to a server during text recognition (see “Other parties”).

Deleting: when you remove a document in the app, it moves, with its reading position, bookmarks and highlights, to a trash on your device for 30 days. After that, or once you choose “Delete permanently” there or empty the trash, it is removed from the device for good. The app counts the 30 days by the time of my server (item 5), not by the device clock; without a connection the period does not run out and the app deletes nothing by itself. The trash is excluded from Android’s device backup. Uninstalling the app removes its data from the device. Files you exported or passed on to other apps (see item 6) stay where they are, and an Android backup in your Google account may bring data back after a reinstall. Data in your Google Drive (see below) is likewise not affected; you delete it there yourself.

Features where data leaves your device

All of the following are optional. Reading works fully offline without them.

1. Backup and sync with Google Drive

When you connect Google Drive, you sign in with your Google account and allow the app to access files that the app itself creates in your Drive (scope drive.file). The app cannot see your other Drive files.

The app creates a folder “Baseline Reader” in your Drive and uploads what you select for backup: documents, reading position, bookmarks, highlights, settings, custom fonts, text-recognition results and, if you choose, cached data. With sync switched on, the folder also contains management files used to reconcile devices, and one small file per device with the number of characters sent to the Google read-aloud voice per month (see item 4). Earlier sync states stay in this folder for 30 days; files that only such expired states referred to are moved to Google Drive’s trash afterwards. Uploaded files that were never assigned to a state (for example after an interrupted backup) are not cleaned up by the app on its own; they stay until you delete them in Drive. In Drive the app permanently deletes only its own management files and, when you explicitly ask for it, files from backups.

The data goes directly from your device to Google. I do not receive it. Google’s privacy notice applies to Drive (https://policies.google.com/privacy). The sign-in remembers the email address and ID of your Google account on the device so that the app can reconnect silently on the next start. You can disconnect in the app and delete the folder in Drive yourself.

Not backed up and not synced: your OpenRouter key, your Google key for read-aloud, the AI chat history, your choice of model and voice, and the Premium trial and purchase record.

2. AI chat via OpenRouter (optional, with your own key)

The AI chat runs only if you enter your own OpenRouter key and confirm before first use what is sent. With each answer the app sends to OpenRouter (OpenRouter, Inc., USA), and from there to the provider of the selected language model: your question, the text of the document or of the selected part, the conversation so far, and the model name; for image questions, the selected image section of the page. Depending on your choice, the part is the whole document, the current chapter, the text up to your reading position, or your highlights. For the whole document, the entire text may be sent, for long documents as much as the selected model can take; the app caps this at about 600,000 tokens.

The app requests that nothing is stored or used for training; whether and for how long OpenRouter and the model provider process data anyway is governed by their own terms (https://openrouter.ai/privacy). This data does not go to me. When you open the AI chat, the AI settings and the model selection, the app also fetches the model list from OpenRouter (without your key). It queries your balance only when you save or change your key.

Web search (optional, off by default). If you switch on web search or tap “Look up online”, the app additionally has the web searched. For this, your question together with the title and author of the document is used for the search. Depending on the model, the search is run by the model provider itself or by a search service used by OpenRouter. Web search is active only for questions about the whole document, not for “Read so far” and “Current chapter”.

You can remove the key in the settings at any time. After that, no questions, no balance queries and no read-aloud with Gemini go to OpenRouter any more. The model list (without key), the requests to gasperl.at, reports (if you trigger them) and all other features in this policy continue independently of it.

3. Reporting an AI answer

When you tap “Report” under an AI answer, the dialog tells you before sending what will be sent: the text of the reported answer (at most 6000 characters), the reason you chose, your optional comment (at most 1000 characters), the model name, the app version and the language. The answer text may reproduce content from your document. Not sent: your question, the book text and your key.

The report goes to my server gasperl.at and is stored there in a file that is not publicly accessible so that I can review the AI feature. I keep a report for at most six months and delete it afterwards. The stored line contains time, reason, answer text, comment, model, app version and language, but no IP address and no identifier of you. As with any request, the server records technical data (IP address, time), see https://gasperl.at/datenschutz/. On request I delete a report earlier (see “Your rights”).

4. Read-aloud with a cloud voice or network voice (optional)

By default your device’s system voice reads aloud. If you switch on a cloud voice and confirm what is sent, the text to be read is sent section by section to the selected service:

• Google Cloud Text-to-Speech (Chirp 3 HD) with your own Google key (Google LLC / Google Cloud EMEA Limited, see https://cloud.google.com/terms/data-processing-terms). To check the key the app queries the voice list. To stay within the free monthly allowance the app counts the characters sent. If you use Drive sync, it stores this count (month and number of characters) under an identifier calculated from your key; the key cannot be recovered from the identifier.
• Gemini via OpenRouter with your OpenRouter key. The app requires providers that do not retain data.
• System voice with network. The system voice is Android’s speech output. Some of its voices work over the internet. If the speech output uses such a voice, the spoken text is sent section by section to the provider of that voice (for example Google), under its terms and not through me. If you explicitly choose a network voice in the app, it uses it only while a connection exists and otherwise falls back to a voice on the device. Which voices your device offers and whether they need the network is determined by Android; you choose a voice that needs no network in your device’s settings.

With the two cloud services, your document as a whole is not sent, and in no case does the text go to me.

5. Requests to gasperl.at

• Time (all versions). At every start and every time you return to the app, the app sends a short request (HEAD, no content) to https://gasperl.at/baseline-reader/version.json and reads the server’s time from it. It needs this for the 30 days of the trash because the device clock may be set wrongly. Only the usual request is sent, with a fixed browser identifier and your device’s time in the address; the app version and a device identifier are not included. The server records IP address and time (see https://gasperl.at/datenschutz/).
• Model recommendations. When you open the AI chat, the AI settings and the model selection, the app downloads a small recommendation list from https://gasperl.at/baseline-reader/ki-modelle.json. Here too it sends only the usual request.
• Updates (direct version only). The version installed through Google Play updates only through Google Play. Only the direct version from gasperl.at additionally queries https://gasperl.at/baseline-reader/version.json for new versions once per app start and on request, and downloads a new app file from there.

The server gasperl.at is operated by Alwyzon Internet Services GmbH in Austria and delivered through the network of Cloudflare, Inc.; details are on https://gasperl.at/datenschutz/.

6. Sharing, “Send to” and exports

These features start only when you tap. With sharing you hand a file to an app of your choice through Android’s chooser: the document as the original, a searchable PDF copy, an exported EPUB, your highlights as a text file, or an image of a page section. With “Send to” you hand the selected text to another app. From the handover on, the data protection and storage of the receiving app apply; this app does not learn what happens there. When you save, the app puts an image as JPEG into the folder Pictures/Baseline Reader of your gallery, and it saves PDF files or archives at a location you choose in Android’s file picker. These files then lie outside the app; the app does not delete them when you uninstall it.

Other parties that may receive data

• Google Play and Android. The Play version is installed through Google Play; Google processes its own data under its terms. The direct version from gasperl.at reaches your device without Google Play. Depending on your device settings, Android backs up app data (settings, library, reading position) to your Google account (Android backup). Excluded are the keys, the AI chat history, the trash and the app’s sync state. On Android 12 and later the same applies to transfer to a new device.
• Text recognition. The app uses Google’s ML Kit and runs recognition on the device; the pages and the recognised text are not sent to a server. According to Google, ML Kit may send technical diagnostic and usage data (device and app information, performance figures, an installation identifier) to Google, but no content of your documents (https://developers.google.com/ml-kit/android-data-disclosure). This is not analysis by me; I do not receive this data.
• Premium, trial and purchases (Google Play version only). Premium is available as an annual subscription and as a one-time purchase. Payment, subscription management and refunds are handled by Google Play alone; I do not receive card or bank details. At start, the app asks Google Play, through your device’s Play billing, about your purchases and the prices, and each time you return to the app only about the purchases. As a record, the app stores encrypted on your device which product you have, when Google Play last confirmed it, and whether an annual subscription also runs. It does not store an order number, and it does not send the record anywhere. The 14-day trial is counted on your device only: the start time and the last time seen are kept in a small local file that Google’s Android backup of your device may include; it does not enter your Drive backup. Google Play provides me, as the seller, with order data; the app sends me nothing for this. The direct version from gasperl.at has neither purchase nor trial and contains no Play billing.
• Links. When you tap a link (for example a source in an AI answer, a help text, the management of your subscription or this policy), it opens in your browser or in Google Play. For links in AI answers the app asks first. After that, the terms of the opened page apply.

Legal bases

• Backup and sync with Google Drive, sharing, “Send to” and exports: Art. 6(1)(b) GDPR (performing the feature you requested).
• AI chat with web search, read-aloud with a cloud voice, reporting an AI answer: Art. 6(1)(a) GDPR (consent). You give it by the confirmation before first use or by sending the report. The cloud service you confirmed processes the text under its own terms.
• Purchases and trial (Google Play version): Art. 6(1)(b) GDPR (performing your purchase and the unlocking).
• Time request and technical logs of the server gasperl.at: Art. 6(1)(f) GDPR (legitimate interest in a reliable trash period and in the security and stable operation of the server).
• Storing reported AI answers on my server: Art. 6(1)(a) GDPR (your consent by sending).

You can withdraw a consent at any time, for example by removing the key or no longer using the feature. Withdrawal works for the future; the lawfulness of processing up to then is not affected.

Transfers to third countries

Some recipients are located in the USA or may process data there. The basis of the transfer for the providers I name:

• Google LLC (Drive, Google Cloud Text-to-Speech, Google Play, ML Kit) and Cloudflare, Inc. (delivery of gasperl.at): both are listed in the EU-US Data Privacy Framework according to https://www.dataprivacyframework.gov (retrieved 11 November 2026). The basis is the European Commission’s adequacy decision of 10 July 2023.
• OpenRouter, Inc.: according to its privacy policy (https://openrouter.ai/privacy, as of 31 August 2026), OpenRouter bases transfers from the EEA on adequacy decisions of the European Commission and on standard contractual clauses. I could not find an entry in the Data Privacy Framework.
• Model providers behind OpenRouter and providers of network voices: these providers set the basis in their own terms, for OpenRouter under its data processing agreement with the respective provider.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time with effect for the future. Write to michael@gasperl.at. You may also lodge a complaint with the supervisory authority (Austrian Data Protection Authority, https://www.dsb.gv.at). Towards Google, OpenRouter and the model providers you exercise these rights with them.

Deletion: you can have submitted reports deleted by email to michael@gasperl.at; please give the time and text of the report. What is on your device or in your Google Drive you delete yourself. The technical logs of gasperl.at are deleted after a short time (https://gasperl.at/datenschutz/). At OpenRouter and the model providers their own periods apply; according to its own statement OpenRouter stores metadata of each request (such as the number of tokens and latency) even with prompt logging switched off, but no content (https://openrouter.ai/docs/guides/privacy/data-collection).

Children

The app is intended for adults.

Changes

If the app changes so that other data is sent, I will update this policy and state the date at the top.