Recto Privacy Policy

Last updated: 7 November 2026

This policy describes how the current Android version of Recto handles information. The data controller for Recto is Pedro Lacerda, an individual developer using Nollin as the public Google Play developer name. For privacy questions or requests, contact getrecto.support@gmail.com.

Information stored on your device

Recto stores the documents you import and your library, reading positions, bookmarks, highlights, notes, goals, and reading history in app-private storage on your device. Recto does not upload your document library or its contents to its servers.

Recto does not make automatic library backups. You can request a complete backup or an annotations/progress export and choose where to save it. A complete backup contains the documents and library data needed to restore your library. If you save or share a file through another app or cloud-storage provider, that provider's own privacy terms apply. Keep exported and backup files somewhere you control.

Analytics and crash reports

Usage analytics and crash reporting are optional and off by default. During onboarding, you can separately choose whether to enable each one. You can also change either choice later in Recto's Settings. Reading and library features work when both are off.

Recto relies on your separate consent as its legal basis for usage analytics and crash-reporting data under Article 6(1)(a) of the GDPR. Where applicable, Recto also obtains your prior consent for storing or accessing information on your device under Article 5 of Portugal's Law 41/2004, as amended. You can withdraw either consent at any time in Settings. Withdrawing consent stops new collection for that purpose. Analytics events already queued on your device before withdrawal may still be transmitted if delivery is retried; data already received by a provider remains subject to its retention and deletion processes.

When usage analytics is enabled, Recto sends allowlisted product events to PostHog Cloud EU to understand feature use and improve the app. Events describe onboarding, import results and duration, reaching the first readable passage, reader sessions, annotation actions, and export results. Event metadata includes app version/build, Android version, device class, a random session identifier, and a random pseudonymous installation identifier. The PostHog SDK may also attach app/package and SDK versions, device model and manufacturer, screen dimensions and density, OS, locale, timezone, and network details such as carrier when available.

PostHog receives the request IP address and may use it to infer approximate location, including city or region, postal code, and coordinates. Recto's PostHog project is configured to discard the client IP after location enrichment; derived approximate-location fields may remain with the event.

When crash reporting is enabled, Firebase Crashlytics processes Android crash diagnostics to help identify and fix failures. Reports can include stack traces, app and device information, SDK-generated identifiers, and technical error details. Recto's handled import, reader, and storage failure reports contain an allowlisted failure category and operation code, not the original exception message or document details. Automatic crash reports can include exception context and details supplied by the Android platform or libraries; those details can vary with the failure.

Recto's product-event properties do not include document contents, titles, filenames, paths or URIs, searches, selected passages, highlight contents, or note text. This describes the inspected product events and does not guarantee that every possible automatic crash exception is free of user-supplied context. Recto does not use these analytics or crash-reporting data for advertising or marketing.

If you turn off usage analytics, Recto stops capturing new product events. An event already queued before you changed the setting may be sent later if delivery is retried. Turning off crash reporting stops new crash-report collection and deletes unsent crash reports where the SDK supports that operation.

Providers, security, and retention

Recto uses PostHog and Firebase as service providers to process the analytics and crash diagnostics described above. The Recto PostHog project retains events for a 12-month window; events older than that window are removed during the next monthly cleanup. Firebase Crashlytics retains crash reports for 90 days before removal begins. Firebase may process crash data globally, so the combined telemetry service is not limited to the EU. See PostHog's privacy information and Firebase's privacy and security information.

When you open the privacy information in Recto's Settings, the app may request the current policy/support file from Cloudflare Pages. Cloudflare receives ordinary connection data, such as the request IP address and time, to deliver and secure that file. The request does not include telemetry identifiers, your library, or document contents. See Cloudflare's privacy policy.

Recto sends telemetry to its providers over HTTPS. Recto does not maintain a user account or a cloud copy of your library. There is no in-app account-deletion function because the current Android MVP has no account system.

Your choices and privacy requests

You can manage the two telemetry settings separately in Recto's Settings. You can also remove documents and library information from Recto on your device. Backups and exports you saved elsewhere must be deleted from those chosen destinations.

For questions or to make a privacy request, email getrecto.support@gmail.com. Analytics identifiers are pseudonymous, so we may need enough information to determine whether records can be associated with your request. Provider retention and deletion may take time; we will handle requests under the privacy laws that apply.

If you are in the European Economic Area, you may have rights under data-protection law, including rights to access, correct, erase, restrict, or object to certain processing, and to complain to your supervisory authority. In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD).

Changes to this policy

If Recto's data practices change, this policy will be updated to describe the new practices. The date at the top shows when this text was last revised.