Privacy Policy
How Acerola handles local data, third-party requests, and device-to-device connectivity.
This page mirrors PRIVACY_POLICY.md at the root of the repository. In case of any discrepancy, the file in the repository is the official version. The policy is governed by Brazilian law (LGPD, Law No. 13.709/2018) — the legal citations below reference it directly.
1. Nature of the app
Acerola is a CBZ/CBR reader that runs entirely locally on the user’s device. There’s no account creation, login, or collection of registration data.
2. Stored data
All data generated by using the app (library, reading progress, settings) is stored exclusively on the device’s local storage. No library, progress, or settings data is sent to the developer’s own servers or third-party servers for storage — the only exception involves network connectivity metadata when remote sync between devices is enabled (see section 3). Uninstalling the app permanently removes all locally stored data.
3. Connectivity and device sync
Acerola syncs library, history, and reading progress directly between the user’s own devices, without going through an account or a central database. This sync is optional. For how each mode works mechanically, see Architecture — here the focus is what each one implies for data:
In none of the four modes is library content (files, progress, history) ever stored on relay servers — the relay only ever acts as a network traffic intermediary.
Processing connection metadata is based on the controller’s legitimate interest in enabling the sync functionality the user requested (Art. 7, IX, LGPD); for the paid tier, the subscription itself is based on the user’s consent when signing up (Art. 7, I, LGPD).
4. Third-party requests
To fetch metadata and cover art, the app makes GET HTTP requests to the public MangaDex and AniList APIs. These requests:
- don’t include personal user data (name, email, files, etc.);
- only contain the search parameters entered by the user (e.g. a title);
- expose the device’s IP address to those services’ servers, as happens with any network request.
Data processing in this context is based on the controller’s legitimate interest in providing the functionality the user requested (Art. 7, IX, LGPD). The returned data is only used during app execution and isn’t stored externally by us.
Third-party privacy policies: MangaDex · AniList
5. Data sharing
Acerola doesn’t share, sell, or transmit data to third parties beyond the requests described in item 4 (MangaDex/AniList) and the connectivity metadata transit described in item 3 (relay), both strictly necessary for their respective features to work.
6. Minors
The app doesn’t collect personal data from any user, regardless of age, and isn’t specifically directed at minors under 18.
7. Data subject rights (Art. 18, LGPD)
Since no personal data is stored by us, exercising rights like access, correction, and deletion happens directly through the user, locally, by managing or uninstalling the app, or by disabling remote sync (item 3). Questions about data eventually processed by MangaDex, AniList, iroh’s relay infrastructure, or the payment provider should be directed to those services.
8. Security
Even though no personal data is collected, the app follows secure development practices to protect the integrity of its operation, including end-to-end encryption (TLS 1.3) across all device sync, regardless of which connectivity mode is chosen.
9. Applicable law
This policy is governed by Brazilian legislation, including Law No. 13.709/2018 (LGPD).