Last updated: 4 September 2026
This policy explains how the Heapforge Reader app for Android and iOS handles your data.
The Heapforge Journal app is covered by a separate privacy policy, and the heapforge.com website by another.
In short
Heapforge Reader keeps your data on your device. Your books, your library, where you are in each of them, your notes and your settings never leave the phone or tablet they are on. We operate no servers for the app, so there is nothing for us to receive, store, or lose.
The single exception is purchase verification: the app asks Google Play or the App Store whether your copy is a legitimate purchase. That check happens between your device and the store you bought from. We are not told who you are.
We run no analytics, no crash reporting, no advertising, and no accounts.
Who we are
Heapforge Ltd. is the data controller for the limited processing described in this policy.
- Company: Heapforge Ltd., incorporated in England and Wales
- Company number: 17418393
- Registered address: 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE
- Privacy contact: privacy@heapforge.com
We process personal data in accordance with the UK GDPR and the Data Protection Act 2018, and, where it applies to our activities, the EU General Data Protection Regulation (Regulation (EU) 2016/679).
What stays on your device
Everything below is stored locally, in the app’s own private storage on your device. It is never transmitted to Heapforge, and never to any third party:
- the books, documents and other files you add to the app, and their contents;
- your library: titles, authors, covers, collections, tags and other metadata;
- your reading positions, bookmarks, highlights, annotations and notes;
- your appearance and reading preferences — theme, typeface, margins, and so on;
- search history within the app, and any local cache the app builds to render your files quickly.
This data is removed when you delete the app, or when you clear its data through your device’s settings.
A note on device backups. If you have turned on your operating system’s backup service — Android Auto Backup or Google One, or iCloud Backup on iOS — your device may include the app’s local data in that backup. That copy is made by your device and governed by Google’s or Apple’s privacy policy, not by ours. Heapforge has no access to it. You can turn this off in your device settings.
Purchase verification and licence checks
Heapforge Reader is a paid app. To confirm that a copy is legitimately purchased — and so to protect the app against unauthorised copying and distribution — the app performs a purchase and entitlement check against the store it was installed from.
Android — Google Play
On Android, the app uses Google Play Services and the Google Play Billing Library to verify purchases and licence entitlement.
In carrying out that check, Google processes data including your Google account identifier, the purchase token for your order, and information about your device and the installed app. Google carries out this processing under its own terms, as an independent controller, not on our behalf. It is described in the Google Privacy Policy and the Google Play Terms of Service.
iOS — App Store
On iOS, the equivalent check is made through StoreKit and App Store receipt validation. Apple processes the associated purchase and device information as an independent controller, as described in the Apple Privacy Policy.
Our lawful basis, and what we actually see
- Article 6(1)(b) — performing the licence agreement under which the app is supplied to you; the check confirms your entitlement to use it.
- Article 6(1)(f) — our legitimate interest in preventing unauthorised use and distribution of software we sell. The check is limited to the purchase status of the copy in front of it and does not profile you.
From Google and Apple, Heapforge receives only the aggregated, non-identifying sales and payout reporting that every developer sees in the Play Console and App Store Connect — unit counts, revenue, refunds, and broad country and device breakdowns. We do not receive, and cannot request, the identity of an individual purchaser.
What the app does not do
Heapforge Reader contains:
- no analytics or usage telemetry of any kind;
- no crash or diagnostic reporting to us or to any third-party service;
- no advertising, ad SDKs or advertising identifiers, and no tracking across other apps or websites;
- no accounts, sign-in, or cloud sync operated by Heapforge;
- no sale or sharing of personal data, because there is none to sell or share.
Permissions
The app asks for access to files and storage solely so that it can open the books and documents you choose to open. Reading, indexing and rendering those files happens entirely on your device. The app does not scan your storage for unrelated content and does not upload anything you open.
Network access is used only for the store purchase check described above.
Store privacy disclosures
This policy is the disclosure referenced by the app’s store listings. Our Google Play Data safety declaration and our Apple App Store privacy labels state that the app collects and shares no data, other than the purchase processing that Google and Apple themselves perform in order to sell and license the app.
Retention
Because we receive no personal data from the app, we have none to retain. Data held on your device is kept until you delete it or uninstall the app. Purchase records held by Google or Apple are retained under their own policies.
Your rights
Under the UK GDPR and the EU GDPR you have the right to access your personal data, to have it rectified or erased, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent.
Because Heapforge holds no personal data originating from the app, a request to us about your use of Heapforge Reader will honestly return nothing — we will confirm that in writing so you have a record of it.
- For data held on your device, you are in control: delete individual items in the app, or clear the app’s data or uninstall it through your device settings.
- For purchase data, the controller is Google or Apple. Use Google’s privacy tools or Apple’s Data and Privacy portal to exercise your rights over it.
If you want to ask us anything or make a request anyway, email privacy@heapforge.com or write to the registered address above. We respond within one month, extendable by up to two further months for complex or numerous requests, in which case we will tell you within the first month and explain why.
We carry out no automated decision-making or profiling that produces legal or similarly significant effects.
Complaints
If you think we have handled your personal data improperly, please tell us first so we can put it right. You also have the right to complain to a supervisory authority:
- in the United Kingdom, the Information Commissioner’s Office — ico.org.uk, helpline 0303 123 1113;
- in the EU/EEA, the supervisory authority of the country where you live, work, or where you believe the problem occurred — in Bulgaria, for example, the Commission for Personal Data Protection (cpdp.bg).
Complaints about Google’s or Apple’s own processing should be directed to them, though you may also complain to your supervisory authority about it.
Children
Heapforge Reader is not directed at children and we do not knowingly collect personal data from them. As the app collects nothing, a child using it discloses nothing to us.
Changes to this policy
If we change how the app handles data, we will publish an updated version of this policy at this address and change the “last updated” date at the top. Material changes will be summarised here, and, where the change is significant, noted in the app’s release notes.
Contact
Questions about this policy: privacy@heapforge.com, or Heapforge Ltd., 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.
← Back to Legal & Privacy