Privacy Policy

Last updated: 20 September 2026

Illumin is an EPUB reader with optional AI reading aids. It is published by Clinton Onaiwu ("we", "us"), based in Nigeria. This policy explains what the app collects, who else sees it, how long we keep it, and how you get rid of it.

Two things are worth saying up front, because they shape everything below:

• Illumin has no analytics, no crash reporting, no advertising and no tracking of any kind. There is no advertising identifier, no third-party SDK watching what you do, and no profiling. We do not sell or share your personal information, and we never have.
• Your books stay on your device. Illumin does not upload EPUB files. The full text of your books is extracted and indexed locally so search and the AI features can work, and that index never leaves the phone.

If you want the short version: we hold your email address, what you have added to your library and where you are up to in it, your highlights and notes, and a one-way scrambled fingerprint of your handset that stops the free AI allowance being claimed twice. Passages you ask about are sent to Anthropic to answer, and are not stored afterwards.

1. Reading without an account

You can use Illumin as a guest. A guest session still creates an anonymous record on our server so that your library can sync if you later sign up, but it holds no email address, no name, and nothing that identifies you as a person.

Guests cannot use the AI reading aids. Those cost real money per use, so they require an account — this is also what makes the free allowance countable.

2. What we collect

2.1 Your account

There is no password — signing in by email sends you a six-digit code instead. If you sign in with Google, Google gives us a signed token containing your email address and name; we do not receive your Google password, contacts, or anything else in your Google account.

We do not collect your date of birth, gender, phone number, address, photograph or contacts, and there is no profile picture.

2.2 Your library and reading, synced to your account

So that your reading follows you between devices, the following is stored on our server and tied to your account:

• Books: title, author, the cover image, how many pages the book has, where you are up to in it, your progress, when you added it and when you last read it, whether you have marked it as reading or finished, where it came from (imported, scanned or downloaded), and the illustration look you chose for it.
• Highlights: the passage you highlighted, its position in the book, the colour you gave it, and any note you wrote on it.
• Bookmarks: the position, the chapter name, the opening words of the page, and how far through the book it is.
• Illustrations you kept: the generated image, the description it was drawn from, the style and mood, and where in the book it belongs.
• Your preferences: theme, typeface, font size, line spacing, justification, tap zones, read-aloud speed and pitch, spoiler protection, and your default illustration look.

We do not upload your EPUB files. Only the details above are synced — never the book itself.

2.3 What stays on your device and is never sent anywhere

• The EPUB files themselves.
• The full text of your books, extracted into a local search index.
• A fingerprint of each imported file (its name and size), used to notice duplicates.
• Screen brightness and warmth, your chosen read-aloud voice, and the sleep timer.
• Which folders you pointed the device scan at.
• Cached page positions for each book.

The device scan reads the folder you choose in order to find EPUB files in it. It looks at file names, sizes and the title and author inside each book. None of that is transmitted anywhere. If you then import a book you found, the book details in section 2.2 sync like any other book.

2.4 The AI reading aids

These are off until you turn them on. The first time you use Explain or Illustrate, the app tells you exactly what will be sent and asks you to agree. We record that you agreed and when. You can withdraw it at any time in Settings, which switches the features off again.

When you ask for an explanation, we send to our server, and our server sends on to Anthropic (the makers of Claude):

• the passage you selected,
• up to roughly 30,000 characters of text from earlier in the same book, so the answer makes sense in context — only text from *before* where you are reading, which is how spoiler protection works,
• and your question, if you typed one.

We do not send the book's title or author, your name, your email address, your account identifier or your device identifier. Anthropic has no way to know whose passage it is or which book it came from.

When you ask for an illustration, the same context is sent to Anthropic, which writes a short visual description of the scene. That description alone — no book text — is then sent to fal.ai, which draws the picture. The image model never sees any of the book's prose.

Neither provider uses this content to train their models.

What we keep afterwards. Our server records, against your account:

• the answer Claude produced, or for an illustration the scene description and the image instruction (so that a repeated request returns the same result instead of charging your allowance twice),
• the model used, how many tokens it cost and the price,
• how much context was sent — the size only, never the content,
• and the time.

The passage, the surrounding book text and your question are not stored. They are used to answer and then discarded.

If you report a generated result, we store which result you reported and the reason you gave.

2.5 Your device identifier

The AI features are metered, and the free allowance is one per handset rather than one per account — otherwise anyone could sign up again for a second helping. To do that we need to recognise your device.

The app reads the identifier the operating system provides for this purpose (the *identifier for vendor* on iOS, the *Android ID* on Android). Both are specific to Illumin on your phone; neither can be used to track you across other apps or websites, and neither is an advertising identifier. If the system does not provide one, the app generates a random value and keeps it locally instead.

That value is sent to our server over an encrypted connection, where it is immediately run through a one-way keyed hash and only the hash is stored. The original identifier is never written to our database. The hash cannot be reversed, and it identifies a handset, not a person.

2.6 Illumin Plus

Subscriptions are handled by Google Play and managed through RevenueCat. We give RevenueCat your account identifier — nothing else, and never for a guest. RevenueCat tells us whether your subscription is active, which product you bought, when it expires and whether it will renew, and we store that.

Payment details never reach us. Your card, billing address and purchase history are handled entirely by Google Play under Google's own privacy policy.

2.7 Technical requests the app makes

• Standard Ebooks (standardebooks.org) — when you install one of the three free classics offered during onboarding, your device downloads it directly from Standard Ebooks, which sees your IP address and which title you asked for.
• A dictionary service (api.dictionaryapi.dev) — Illumin ships with a built-in offline dictionary and uses it first. Only when a word is not in it does the app look that single word up online. No identifier is sent with it.
• Expo (u.expo.dev) — the app checks for updates on launch, which tells Expo's servers the app version and platform.
• Supabase — our hosting provider, and therefore the recipient of everything in sections 2.1, 2.2, 2.4, 2.5 and 2.6.

Read-aloud uses the speech engine built into your phone. No audio and no text leaves the device for it.

3. What the app asks your phone for

Illumin requests very little, and nothing it does not use:

• Adding to your photo library — only when you save a highlight card or an illustration. The app asks for add-only access and cannot read your existing photos.
• File access — to open the EPUB you pick and to scan a folder you choose.
• Background audio — so read-aloud keeps going when the screen is off.

Illumin does not request access to your camera, microphone, location, motion sensors, contacts, calendar or notifications.

4. Why we are allowed to do this (legal bases)

If you are in the UK or the European Economic Area, our lawful bases under the UK GDPR and GDPR are:

Withdrawing consent stops future AI use; it does not undo requests already made.

5. How long we keep it

• Your account, library, highlights, bookmarks, illustrations and preferences: until you delete your account, or ask us to.
• AI records: the answers and scene descriptions are erased when you delete your account. The token counts, cost and timestamps remain, no longer linked to you, because they are the record of what our providers charged us.
• The device hash: kept after account deletion. This is deliberate and it is the one thing that survives — if it were erased, the free allowance could be reset simply by deleting an account and making a new one. It identifies a handset, contains nothing about you, and cannot be turned back into your device identifier.
• Reports you file on AI results: deleted with your account.
• Generated images: in private storage until you delete them or your account. Links to them expire after seven days and are re-issued only to you.

6. Deleting your account

In the app: open the You tab and choose Delete account. You will be asked to confirm. When you confirm, we immediately and permanently delete your account, your library records, your highlights and notes, your bookmarks, your kept illustrations, your preferences and your subscription record, along with every generated image we hold for you. The app also erases its copy on that device: the books you downloaded, the local index and all your settings. Nothing is recoverable afterwards and there is no grace period.

Without the app: email privacy@illuminreader.com from the address on your account. We will verify that it is yours and delete it within 30 days. You can also use the form at https://illuminreader.com/delete-account.html.

What survives is only the device hash described in section 5, and de-identified billing records with no link to you.

Deleting your account does not cancel an Illumin Plus subscription. Subscriptions are held by Google Play, and only you can cancel one — do that in the Play Store under Subscriptions *before* deleting your account, or you will keep being billed for a service you can no longer reach.

7. Your rights

Wherever you live, you can ask us to:

• give you a copy of what we hold about you,
• correct anything wrong,
• delete your account and data,
• export your data — email privacy@illuminreader.com and we will send it in a machine-readable format within 30 days,
• restrict or object to how we use it, and
• withdraw your consent to the AI features, which you can also do yourself in Settings.

Email privacy@illuminreader.com. We will not charge you, and we will not treat you differently for asking.

If you are in the EEA or UK, you may also complain to your national data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk).

If you are in California, the CCPA as amended by the CPRA gives you the rights to know, delete, correct and opt out of sale or sharing. We do not sell or share personal information and we do not use it for cross-context behavioural advertising, so there is nothing to opt out of. We do not offer financial incentives for your data. In the last twelve months we disclosed to service providers only what section 2 describes, and only to run the app.

Illumin is run from Nigeria, so the Nigeria Data Protection Act 2023 governs how your data is handled wherever in the world you happen to live. It gives you the rights listed above — access, rectification, erasure, restriction, objection and portability — and the right to complain to the Nigeria Data Protection Commission.

8. Where your data goes

Our providers — Supabase, Anthropic, fal.ai and RevenueCat — process data on servers in the United States and, depending on the service, the European Union. Where data leaves the UK or EEA, those transfers are covered by the standard contractual clauses approved for the purpose, or the provider's own equivalent safeguards.

Illumin is run from Nigeria and none of those providers are Nigerian, so your data leaves Nigeria in the ordinary course of the app working at all. Under the Nigeria Data Protection Act those transfers rest on two of the bases it allows: they are necessary to provide the service you asked for, and each provider is bound by contractual terms requiring protection comparable to the Act's.

9. Security

Everything travels over encrypted connections (HTTPS/TLS). Your data is separated by account at the database level, so one account cannot read another's. Generated images sit in private storage reachable only through short-lived links issued to you. Our AI provider keys exist only on the server — the app has never held one. The device identifier is hashed with a secret key held only on the server.

No system is perfect, and we will not pretend otherwise. If a breach affects you we will tell you and the relevant regulator as the law requires.

10. Children

Illumin is not intended for children under 13, or under 16 where local law sets that age for consent, and we do not knowingly collect their data. If you believe a child has created an account, email privacy@illuminreader.com and we will delete it.

11. Changes

If we change this policy we will update the date at the top, and for anything that materially affects you we will tell you in the app before it takes effect. If a change widens what the AI features send, we will ask for your consent again rather than assume it.

12. Contact

Clinton Onaiwu Nigeria privacy@illuminreader.com