Tsuzuru

Privacy Policy

Last updated: 2026-09-19

1. What is never sent

The app does not send any of the following to the developer or to third parties.

• Photos, text, and arrangement of books you have not published
• The contents of your photo library
• Personally identifying information such as your name, email address, phone number, or postal address
• Precise location obtained through device location services such as GPS (the approximate region Firebase and advertising derive from an IP address is described in sections 5 and 6)
• Contacts

The app does not ask you to create an account. There is no sign-in. If you share an exported video or book through another app, that destination's policy applies to what you share there.

2. What is sent when you publish a book

Only when you choose to publish a specific book, the following is sent to and stored on the developer's server (hosted on Cloudflare).

• The cover image and a book file — the book file contains re-rendered photo images (JPEG), text, page order, the book title and the paper theme you chose
• The book title and page count — used to display the publication page and manage publishing
• A random per-installation identifier — links published books to the installation for managing and unpublishing books, verifying purchased features and preventing abuse
• The IP address you published from — used to prevent bulk publishing and abuse, and stored in the active book's management data and publishing-limit records
• The result of verifying that the request came from a genuine copy of the app (Apple App Attest / Google Play Integrity)

The original photo files are never sent. Images are re-rendered by the app, so Exif data such as the original capture time and location is not carried over. Written text is included as text in the book file.

When you unpublish, the cover, book file and title are deleted from the server. When the publication period ends (90 days without the purchase, 365 days with it), access stops and scheduled cleanup deletes these files and records. The association between a public ID and its installation identifier is kept for 400 days after publication to allow reuse of the URL. Per-IP publishing-limit records are kept for 400 days after their last update. Identifiers needed to block abusive publishers are kept while the restriction is necessary.

When you publish using purchased features, the app sends the product ID and store-issued proof of purchase with the installation identifier to our server for verification. The verification result is associated with that identifier for 90 days and refreshed on another verification. The developer does not receive payment details such as credit card numbers.

3. What is stored on your device

Your books, the themes you chose, and publication state are stored in a database on your device. The random per-installation identifier is stored in the Keychain on iOS and in the app's settings storage on Android.

4. Device features

• Camera and photo library — used only to put photos into a book. Only the photos you pick are read; the library is not scanned.
• Motion sensor — used only for the light that moves across the paper. Nothing is sent off the device.
• Adding to the photo library — used only when saving an exported video.

5. Usage and crash reporting

The app uses Firebase Analytics and Firebase Crashlytics to improve features and investigate problems. iOS 1.0.0 and the upcoming 1.1.0 send analytics and diagnostic information after launch and have no in-app setting to disable it. This analytics and diagnostics collection is separate from ATT and does not stop when tracking is declined. Firebase advertising-identifier collection and advertising uses remain disabled; this advertising update does not add an advertising link between Firebase and AdMob.

In the upcoming Android 1.0.0 release, usage analytics and crash reporting will each be off by default. Regardless of region or purchase status, you will be able to read an explanation and turn each option on or off independently from the menu. No additional choice screen will appear automatically at launch. Leaving either or both options off does not limit book features, and use of an earlier version is not treated as consent.

The information involved is listed below. On Android, analytics information is sent to Google (Firebase) only while analytics is on, and crash reports are sent only under the conditions described below.

• Which features are used and how often — screens opened, books published, videos exported, limits reached
• Analytics and crash-reporting identifiers — identifiers generated for the app are used to count usage and diagnose problems. The publishing installation identifier is not set as a Firebase user ID
• Approximate region — such as country or region derived from an IP address, without using device location services
• Crash and diagnostic information — where an error occurred, stack traces, preceding actions, device model, OS and app versions, performance and SDK operational information
• Android purchase events — product ID, product name, price and currency may be processed by Analytics purchase measurement. Payment card information is not included

We do not include your photos, words or book titles in analytics events. We record that a book was published and its page count, not what was in it. We do not set a name or account identifier as a Firebase user ID.

In this Android release, Analytics advertising-ID collection and advertising uses will always be disabled. Turning analytics off stops subsequent measurement and resets on-device analytics data. Actions taken while it is off are not sent later when it is turned on.

Android crash reports will not be uploaded automatically. Pending reports are sent at the next launch only after checking that crash reporting is on now and was on throughout the previous app session. The SDK may record diagnostic information on the device, but pending reports covering any period without consent are discarded. Turning reporting off does not immediately delete information already sent to Google.

The Android analytics and crash-reporting choices are separate from the advertising consent process in section 6. Advertising consent is not treated as consent to analytics or crash reporting. Turning analytics and crash reporting off does not also turn off advertising or communication needed for publishing and purchases.

For Firebase's handling of this information, see Privacy and Security in Firebase.

6. Advertising and tracking

The released iOS 1.0.0 has no ads. It does not include the AdMob SDK, obtain the iOS advertising identifier (IDFA), or request App Tracking Transparency (ATT) permission. In that version, app data is not linked with data from other companies' apps or websites for advertising. Published books' web pages also have no ads.

The upcoming iOS 1.1.0 and Android 1.0.0 releases are planned to display a Google AdMob banner at the bottom of the bookshelf for users who have not purchased Premium. Ads will not appear while editing, reading or exporting video, or for users who have purchased Premium.

iOS 1.1.0 will check ATT after launch and show the system permission request if the choice is undetermined and the OS allows it. This check is independent of purchase status, so an undetermined choice may also be requested for Premium users. Only if you allow tracking can IDFA be used and personalized ads based on data from other companies' apps or websites be requested. Otherwise, ad requests are non-personalized. Declining does not restrict book features. You can change the choice in iOS Settings → Privacy & Security → Tracking.

Android always requests non-personalized ads, as does iOS with ATT denied or restricted. Ads remain stopped if the iOS choice is still undetermined or cannot be checked. Non-personalized advertising still involves data collection and sharing. Google collects and shares the following for ad delivery, frequency capping, measurement, analytics and fraud prevention.

• IP address and the approximate location inferred from it
• App and ad interactions — such as app launches, ad impressions and taps
• Diagnostic information — such as loading times and information about app and advertising SDK operation and performance
• Device and app identifiers — such as iOS IDFA with ATT permission, an available Android advertising ID and App Set ID

In both ad-supported releases, Google's User Messaging Platform (UMP) will update consent information before ads are requested and show a form when required. Ads will load only when they can be requested after checking any consent required in regions such as the EEA, UK and Switzerland. ATT permission does not replace these regional choices. When a privacy-options entry point is required, you will be able to change your choices from the app menu. If consent checking fails, you can continue creating and reading books.

You can delete or reset the advertising ID in Android settings. This does not stop all data collection, including use of the App Set ID or the app identifiers in section 5. For Google's handling of this information, see the Google Privacy Policy and explanation of non-personalized ads.

7. Pages of published books

When a published book is viewed, the server records only an aggregate view count for that book. No information identifying the reader, no per-reader history, and no cookie-based tracking. There is no way for readers to leave comments, ratings, or any other feedback.

8. Third parties

Published book files, covers, titles and the management data described in section 2 are stored on servers operated by Cloudflare, Inc. for hosting and publication management.

The app communicates with Apple's and Google's attestation services to verify that it is genuine. That communication contains none of your photos, words, or book contents.

Apple or Google processes purchases. We use store-issued proof to verify purchased features; Android verification also contacts Google's purchase-verification service.

Usage, diagnostic and other information described in section 5 is sent to Google (Firebase). We do not include your photos or written text in Firebase analytics events. In the ad-supported releases, Google AdMob handles the advertising information described in section 6. We do not send book photos, text or titles as advertising data.

9. Children's privacy

The app is not directed primarily at children. Unless you publish, the developer does not collect photos or entered text. Analytics, diagnostics and advertising involve the information described in sections 5 and 6.

10. Changes to this policy

If this policy changes, this page is updated and the date above is revised. If the information collected is expanded, this page is updated before that feature ships.

11. Contact and deletion requests

You can unpublish a book from inside the app. For data deletion requests or questions about this policy, including analytics and advertising data, contact [email protected]. Section 2 explains how long publication-management records are kept and why. For information handled by Google, we will direct you to the relevant service's data controls and deletion methods.