Privacy Policy for MReader

Last updated: September 17, 2026

MReader ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and what choices you have when you use the MReader application ("App").

1. Overview

MReader is a code reader designed for e-ink devices. The App runs entirely on your device — your source code and files are never transmitted to our servers. We collect only the minimum data necessary to provide license verification and improve app stability.

2. Data We Collect

2.1 Data Collected Automatically

Data	Purpose	Transmitted to Server
Device ID	License binding and telemetry deduplication	Yes
Platform (Android/iOS)	Telemetry and compatibility	Yes
App version	Telemetry and update awareness	Yes
Crash information (exception class, message, stack trace, thread name)	Debugging and stability improvement	Yes

Device ID details:

On Android: derived from Settings.Secure.ANDROID_ID and device model prefix (e.g., MR-BOOX-A1B2C3D4). This identifier is per-device, per-app-install, and resets on factory reset. It is not linked to your Google account or personal identity.
On iOS: a randomly generated UUID, stored locally on first launch (e.g., MR-IOS-A1B2C3D4). It is not derived from identifierForVendor or any Apple account identifier.

2.2 Data You Provide

Data	Purpose	Transmitted to Server
Activation code	License activation	Yes (stored as hash only; plaintext never retained)
Google Play purchase token & order ID	In-app purchase verification	Yes (purchase token is also sent to Google Play API for verification)

2.3 Data Stored Locally Only (Never Transmitted)

The following data is stored on your device in encrypted storage (Android EncryptedSharedPreferences / iOS Keychain) and is never sent to our servers:

License token and expiry date (XOR-obfuscated, stored within encrypted storage)
App settings (font size, line height, code font, locale, etc.)
Recent projects list
SFTP server configurations (host, port, username, password, SSH key path)
Pending crash reports (held locally until next launch, then uploaded and deleted)

2.4 Data We Do NOT Collect

We do not collect:

Personal identity information (name, email, phone number)
Location data
Advertising identifiers (GAID, IDFA)
IP addresses (used in memory for rate limiting only, never persisted)
Your source code, files, or file contents
Contacts, calendar, or social graph data
Camera, microphone, or sensor data

3. How We Use Your Data

We use the collected data solely for the following purposes:

License management: Verifying your license, binding it to your device, and enabling full app functionality.
App stability: Analyzing crash reports to identify and fix bugs.
Usage statistics: Counting active users (DAU/WAU/MAU) to understand app adoption — no individual user behavior is tracked.

We do not use your data for advertising, profiling, or sale to third parties.

4. Data Storage and Security

4.1 Server-Side

License data is stored in a PostgreSQL database hosted on our infrastructure.
Activation codes are stored as cryptographic hashes (HMAC-SHA256), never in plaintext.
License tokens are stored as hashes; the raw token is only returned to your device at activation time.
All client-server communication uses HTTPS (TLS 1.2+).
Rate limiting is enforced (30 requests per minute per IP) to prevent abuse.

4.2 Client-Side

Sensitive data (license token, SFTP credentials) is stored in platform-provided encrypted storage:
- Android: EncryptedSharedPreferences (AES256-GCM for values, AES256-SIV for keys)
- iOS: Keychain (kSecAttrAccessibleWhenUnlockedThisDeviceOnly)
License tokens are additionally XOR-obfuscated before storage.
The App requests only the INTERNET permission — no location, storage, camera, or other sensitive permissions.

4.3 TLS Validation

All communication between the App and our servers uses HTTPS with TLS 1.2 or higher. The App relies on the operating system's built-in certificate validation to verify the server's identity.

5. Third-Party Services

5.1 Google Play Billing (Android only)

If you purchase MReader through Google Play, the purchase is processed by Google. Google's own privacy policy applies to the purchase data they collect:

Google Privacy Policy

We receive only the purchase token and order ID necessary to verify your purchase. We do not receive your Google account information or payment details.

5.2 No Other Third-Party Data Collection

MReader does not integrate any analytics SDKs (Firebase, Google Analytics, Mixpanel, etc.), advertising SDKs, or social SDKs. No third party receives data from MReader other than Google Play for in-app purchase processing.

5.3 User-Initiated Connections

The App allows you to connect to:

Git repositories (via JGit) — connections are initiated by you to repositories you specify.
SFTP servers (via JSch) — connections are initiated by you to servers you configure.

These connections are entirely under your control. We do not proxy, log, or have access to these connections.

6. Data Retention

Data Type	Retention Period
License records	Duration of license validity + 1 year
Device activation records	Duration of license validity + 1 year
Heartbeat data	90 days (rolling)
Crash reports	90 days, then automatically deleted
Activation code hashes	Indefinite (for revocation and fraud prevention)

7. Your Rights and Choices

7.1 Device Unbinding

You can unbind your license from your current device at any time through Settings → License → Unbind Device. This removes your device ID from our activation records and frees the license for use on another device.

7.2 Data Deletion

You may request deletion of your personal data by contacting us at the email address below. We will delete your device activation records, heartbeat data, and crash reports within 30 days of a verified request. License records may be retained as required for fraud prevention.

7.3 Opting Out of Telemetry

Crash reporting and heartbeat telemetry can be disabled in the App settings. Note that disabling telemetry does not affect license verification, which requires periodic server communication to remain active.

7.4 Offline Use

The App supports offline use for up to 7 days after the last successful license verification. After 7 days offline, the App will revert to demo mode (limited to viewing the first 100 lines of each file) until re-verification is possible.

8. Children's Privacy

MReader is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

9. International Users

MReader is available worldwide. If you are accessing the App from the European Economic Area (EEA), United Kingdom, or other regions with data protection laws:

Our legal basis for processing your data is: (a) performance of a contract (license activation and verification), (b) legitimate interest (crash reporting and stability improvement), and (c) consent (telemetry, which can be disabled).
You have the right to access, rectify, port, and erase your data, and to object to processing.
We do not transfer your data outside of our hosting region without appropriate safeguards.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Updating the "Last updated" date at the top of this page
Displaying a notice in the App upon next launch

Your continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or your data, please contact:

Email: wusende@gmail.com
Website: https://apiked.com

This privacy policy is effective as of September 17, 2026.