Érudit Privacy Policy
This policy describes the data Érudit processes, why, and your rights.
Controller
Nour AYACHI, publisher of Érudit, reachable at contact@eruditapp.com.
Data processed
- Account: your email address and a technical identifier. If you sign in with Apple: the identifier and address Apple provides (possibly a private relay address) and, if you choose to share it, your name.
- Profile: username, display name, bio, photo, pronouns and cities if you fill them in, language, favourite genres and authors.
- Activity: the books you add, reading statuses, ratings, reviews, lists, favourites, private reading notes, reading goals, follows, likes and replies, and an internal activity log (book pages opened) used for the "Popular" and "You may also like" rows.
- Notifications: your notification choices and, if you allow notifications, a technical token used to deliver them to your phone. The quote of the day and the reading reminder are scheduled on your phone itself.
- Library import: the file you pick is read on your phone; only the books recognised, with your statuses, ratings, dates, reviews and shelves, are saved to your account.
- Crash reports: when the app crashes, a technical report (the error, the screen, the phone's model, its iOS version and the app's) is sent to us, without your account, your email address or anything you wrote.
- Technical: no location data, no advertising identifier, no advertising tracker, no advertising.
Purposes and legal bases
Providing the service (contract); showing your profile and content to others according to your visibility (contract); sending the notifications you chose (consent, which you can withdraw at any time); keeping the app working and moderating reported content (legitimate interest); answering your requests (legitimate interest).
Visibility
A public profile is visible to every user of the app; a private profile only to the followers you accept. Your reviews follow your profile's visibility. Your private reading notes are visible to you alone.
Hosting and processors
– Supabase: database, authentication and photo storage, in the European Union.
– Resend: sign-in emails (your email address and your sign-in code).
– Apple: Sign in with Apple, delivery of notifications to iPhones, and the contact@eruditapp.com mailbox (iCloud Mail).
– Expo: notification relay; it receives your phone's token and the notification's text.
– Sentry: receives the crash reports described above.
– Cloudflare: delivery of the covers and of the eruditapp.com site; it sees your phone's IP address for the request only, never linked to your account.
To build the catalog, the app queries Open Library, Wikipedia, Wikidata, Google Books and DeepL (translation): those requests are about books and authors, never about you — no account data is sent to them. Some of these providers are located outside the European Union, notably in the United States; transfers rely on the safeguards provided by the GDPR (standard contractual clauses or adequacy decision).
Retention
Your data is kept as long as your account exists. Deleting the account, from Settings, erases your profile, content, photos and notification tokens without delay, and revokes Érudit's access to your Apple ID if you used it; the anonymised activity log serves aggregate statistics. Signing out removes your phone from the notifications' recipients.
Your rights
Access, rectification, erasure, restriction, portability and objection, under the GDPR. Most can be exercised in the app (edit profile, change notifications, delete account); for the rest, write to contact@eruditapp.com. You may lodge a complaint with your data protection authority (in France, the CNIL: www.cnil.fr).
Minors
The app is not intended for children under 13.
Changes
This policy may be updated; the date of the last update is shown at the bottom of the page.