Quillode

Privacy Policy

Quillode is a reading app, not an advertising business. This page explains exactly what leaves your phone, what never does, and how to have anything we hold removed.

Effective 11 August 2026 · Last updated 11 August 2026

1. Who this policy covers

This policy applies to the Quillode Android app (package com.quillode.app) and to the quillode.com website, including the beta and creator signup forms.

Quillode is developed and operated by Jessie Campanero, trading as Quillode, based in Abu Dhabi, United Arab Emirates. For privacy questions we are the data controller, and you can reach us at hello@quillode.com.

2. What the app keeps on your device

Most of what Quillode knows about you never leaves your phone. It is written to the app's private storage, which other apps cannot read, and it is deleted when you uninstall the app. This includes:

• Your library — which books you have downloaded, and the audio, text, and timing files for them.
• Your reading position, bookmarks, highlights, quotes, and any notes you write.
• Your display name and avatar. The You screen is entirely local; editing it makes no network request of any kind.
• Your preferences — theme, text size, mood music choices, playback settings.
• Your access-code status, if you have redeemed one.
• Any files you import yourself. Audio and ebooks you bring into Quillode are read on your device and are never uploaded to us.

We have no ability to read any of this remotely. There is no account it could be attached to, and no server-side copy of it.

Android backup

If you have Android's backup feature switched on, Android may copy some app data to your Google account so it can be restored on a new phone. That backup is performed by Android itself, is encrypted, and is governed by Google's privacy policy rather than this one. You can turn it off in your device settings.

3. What the app sends to us

Your Google account — only if you choose to sign in

Signing in is entirely optional. Quillode's free library, your imported files, your bookmarks and your reading all work without an account, and the app does not ask you to sign in to use them. Signing in exists so that premium access follows you to a new phone rather than being tied to one device.

If you do sign in, Google gives us a signed token and we keep only what it contains:

• Your Google account identifier — a number that identifies you to us and to nobody else. It is not your Google password and cannot be used to access your Google account.
• Your email address, and your display name if Google supplies one.
• Whether you have premium access, and the dates the account was created and last used.

That is the complete list. We ask Google for three basic permissions and no others, so we cannot see your Gmail, contacts, files, calendar, or anything else in your Google account. We never receive your password.

You can delete all of it at any time — see §8. Deletion is immediate and also revokes Quillode's access to your Google account.

A hashed device identifier — only when you redeem an access code

Quillode's alpha and premium access codes are meant for one device each. To enforce that without asking you to create an account, the app takes your device's Android ID, combines it with a fixed Quillode-specific value, and puts it through a one-way SHA-256 hash on your phone. Only that hash is sent to our server, together with the code you typed.

• The raw Android ID never leaves your device. The hash cannot be reversed back into it.
• Our server stores the hash against that code, plus the time it was first and last used and how many times it was redeemed, so a code cannot be shared across devices.
• This only happens if you enter a code. If you never redeem one, this identifier is never generated and never sent.
• Under Google Play's definitions this counts as a device identifier, so we declare it. We use it solely to make access codes work and to prevent code sharing. It is not used for advertising, profiling, or analytics, and it is not shared with anyone.

Ordinary technical information, when the app fetches something

When Quillode downloads a book, cover, chapter audio, mood music pack, or font from our servers, that request necessarily carries the same technical details every internet request carries: your IP address, the time, and which file you asked for. Our infrastructure provider records these briefly as standard server logs, which we use to keep the service running and to spot abuse. We do not build profiles from them, and we do not link them to your on-device library.

What the app does not send

• No name, email address, phone number, or postal address.
• No contacts, calendar, photos, precise location, or SMS.
• No advertising identifier, and no advertising or attribution software of any kind.
• No analytics or crash-reporting service. Nothing reports your screens, taps, or session length to us or to a third party.
• No microphone or screen recording. The recording tools used to make Quillode's own promotional videos are excluded from the version published on Google Play.
• No audio transcription. Quillode's speech-to-text tooling is an internal development tool and is removed from the published app; your imported audio is not sent anywhere.

Bug reports

If you use Report a bug, Quillode does not send anything by itself. It opens your own email app with a message prepared for you, and you decide whether to send it. If you leave the "include app state" option on, that message will also contain the screen you were on, the book title, your app version, and your Android version. You can edit or delete any of it before sending, and the app asks you not to paste in copyrighted book text.

4. What we collect outside the app

The beta and creator signup forms

If you choose to join the waitlist, we store what you type, plus which link brought you to the page:

Signing up sends you a welcome email and notifies us that you joined. We do not add you to any other mailing list, and we do not pass your address to anyone else.

Those last two — the campaign tag and the site you came from — are read only at the moment you submit the form, and only then. If you never sign up, nothing about your visit is stored anywhere. We do not keep them in a cookie or in your browser's storage, and we cannot follow you around the site with them.

The beta feedback form

If you submit feedback at quillode.com/feedback, we store the email address you provide, your device/build details if you include them, your usage answers, your 1–5 ratings, and anything you type into the free-text answers. We also store the page, submission time, country, and any campaign tag or referring site name attached to the link you used, in the same limited way described above.

We use this to fix the beta, understand what testers actually tried, and answer closed-test review questions honestly. The form asks you not to paste copyrighted book text or sensitive personal information. If you tick the follow-up checkbox, we may email you for clarification about that feedback.

Installing from Google Play, and joining the beta test

You need a Google Account to install anything from the Google Play Store, including Quillode. Installing does not tell us who you are — that account is your relationship with Google, governed by Google's privacy policy. We only learn your identity if you separately choose to sign in to Quillode, which is optional and described in §3.

There is one exception, and it applies only while Quillode is in closed testing. If you accept an invitation to test the app, we add the Google Account email address you give us to the tester list in the Google Play Console. That is the mechanism Google uses to make a closed test available to you — without it, Play will not let you install. We use it for nothing else, we do not add it to a mailing list, and we remove it from the tester list when the test ends or whenever you ask.

The download page

If you have an alpha code, entering it on the download page sends only the code itself to our server so it can be checked. No personal information is collected there.

Cookies and web analytics

quillode.com sets no cookies and runs no analytics or tracking scripts. We have no visitor-tracking product installed. The one piece of attribution we do keep — the campaign tag and referring site name recorded with a waitlist signup — is read at the moment you submit that form and is described above; it involves no cookie, no browser storage, and no third party.

The site does load its two typefaces from Google Fonts, which means Google receives your IP address and browser type in order to serve those font files. This is governed by Google's privacy policy. We are working toward serving the fonts ourselves so this dependency goes away.

5. Who else is involved

We keep the list of companies that touch your data as short as we practically can. Today it is:

These are service providers acting on our instructions. We do not sell personal information, and we do not share it with anyone for advertising or marketing purposes. We would only disclose information if we were legally required to, or if it were genuinely necessary to protect the safety or rights of someone.

6. Where your data is stored

Quillode is operated from the United Arab Emirates, and our providers run globally distributed infrastructure. That means information described above may be stored or processed on servers outside your own country, including in the United States and the European Union. Where we transfer personal information internationally, we rely on our providers' standard contractual protections.

7. How long we keep things

• Waitlist, creator signups, and beta feedback — kept until the beta programme and closed-test review are complete, or until you ask us to remove you, whichever comes first.
• Your account, if you signed in — kept until you delete it. There is no silent expiry, and no copy kept after deletion.
• Beta tester list entries — kept in the Google Play Console only for the duration of the closed test, then removed.
• Hashed access-code records — kept for as long as the code is valid, so the one-device rule can be enforced. Removed when the code is retired.
• Server request logs — kept only briefly by our hosting provider for operational and security purposes, then discarded.
• Everything on your device — kept until you delete it in the app or uninstall Quillode.

8. Your choices and your rights

Depending on where you live, you may have rights to access, correct, delete, or export the personal information we hold, to object to or restrict how we use it, and to complain to your data protection authority. We honour these requests wherever you are, not only where the law requires it.

Deleting your data

• Your account: in the app, open You and choose Delete account. Without the app installed, go to quillode.com/delete-account and sign in to confirm it is yours. Either route erases your account record immediately and revokes Quillode's access to your Google account. Neither requires you to contact us or wait.
• Everything the app holds: uninstall Quillode. All local data — library, bookmarks, notes, profile, downloaded audio — is removed with it. You can also delete individual books and bookmarks inside the app at any time.
• Your waitlist signup or beta feedback: email hello@quillode.com or beta@quillode.com and ask to be removed. We will delete your record and confirm.
• Your hashed access-code record: email us with the code and we will clear it.
• Your place on the beta tester list: email us and we will remove you. You can also leave the test at any time from the opt-in link Google gave you.

You do not need an account to make a request, and we will not ask you for more information than is needed to find the record. We aim to respond within 30 days.

9. Children

Quillode is not directed to children. It is intended for a general audience aged 13 and over, and we do not knowingly collect personal information from children under 13 (or under the equivalent age where you live). If you believe a child has provided us with personal information, write to hello@quillode.com and we will delete it.

10. Security

All traffic between the app, the website, and our servers is encrypted in transit using HTTPS. On-device data sits in the app's private storage, which the Android operating system keeps isolated from other apps. The device identifier we receive is a one-way hash rather than the identifier itself, so a copy of our records would not reveal your device ID. Administrative tools are protected by separate credentials. No system is perfectly secure, but we deliberately hold as little as possible, which is the strongest protection available to us.

11. What is not here yet

Quillode is in closed testing. Some features described publicly are not built, and this policy reflects the app as it actually is today, not as it is planned.

Sign-in exists, but nothing is built on top of it yet. Today an account does one thing: it carries your premium access between phones. There is no subscription billing, no following creators, no tipping, no public profile, and nothing you write in the app is uploaded or shared.

When those arrive they will involve information this policy does not yet cover — a subscription status, a payment record held by Google Play, or content you deliberately publish. We will update this policy before any of it starts. Nothing in this paragraph is collected today.

12. Changes to this policy

If we change how Quillode handles your information, we will update this page and move the "last updated" date at the top. For a change that materially affects you, we will give notice in the app or by email before it takes effect. Previous versions are available on request.

13. Contact us