Privacy policy

PageBite · Last updated: 18 September 2026

The German version of this policy is the legally binding one. This English version is provided for your convenience.

1. Controller

Email: henri.irmscher@gmail.com

This policy covers the PageBite app and this website.

2. An anonymous account instead of registration

When you scan your free page in onboarding, or at the latest right before you see the subscription options, the app creates an anonymous account with our service provider Supabase. It consists of a random identifier. We don't need your name or email address for it. We use the same identifier at RevenueCat to link your subscription to your account.

We automatically delete anonymous accounts without a subscription after 30 days. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

3. What data we process

Our legitimate interest (Art. 6(1)(f) GDPR) is running the app securely and protecting it against abuse.

What your reading list can reveal

The books you read can reveal something about your health, your beliefs or your political views. That is why we protect this data especially well: it never goes into usage statistics, the original text stays on your phone, the servers are in the EU, access is strictly limited to your account, and you can delete everything at any time.

Daily reminder

If you turn on the daily reminder, the app plans the notifications on your phone only, using the notification feature of iOS or Android. They only say how many cards are due, never what is on your cards or in your books. We do not use push notifications, and none of this is sent to us or anyone else. You can turn the reminder off in Settings at any time.

4. Scanning: photos stay on your phone

• For scanning, PageBite uses your phone's document scanner: Apple VisionKit on iPhone, Google's ML Kit Document Scanner on Android. Text recognition also runs on the device (Apple Vision or Google ML Kit).
• We never upload the photos. The app deletes every page photo as soon as the text is read, even if text recognition fails.
• If you scan a book cover, the app keeps only a small picture of it on your phone and deletes the photo right away. The cover is not uploaded and not synced to other devices. The app sends the recognized text of the cover to Google Gemini, so you don't have to type title and author (see section 5). Our server does not store this text.
• On Android, Google ML Kit sends technical data to Google, for example the device model, app version, performance values and error codes. ML Kit does not send images or texts.
• The app only uses the camera when you start a scan.

5. AI processing with Google Gemini

Before your first scan, the app asks for your permission. Only then is the recognized text of a page sent to our server and from there to Google Gemini. Google Gemini creates the key idea, quiz and flashcards from it. Our server does not store the page text and does not write it into any logs.

In onboarding you can scan one page for free before you subscribe. Until you buy, the result stays on your phone only. So that each account gets only one free page, our server stores your account identifier and the time. We delete this record with your account. The legal basis is our legitimate interest in limiting abuse and costs (Art. 6(1)(f) GDPR).

• Provider: Google Cloud (Vertex AI), Gemini model. Processing in the EU (location eu).
• No training: Google does not use your texts to train AI models.
• Storage at Google: Request and response logging is off, and caching of requests is switched off for our Google project, so Google does not keep your text after the answer. Google may store a request for up to 90 days in the EU if automated safety filters flag it as possible abuse.
• Labeling: Everything the AI creates is marked "AI-generated" in the app and can contain errors. If in doubt, check the original text.
• Withdrawal: You can withdraw your permission at any time in the app under Settings → AI processing. After that, the app sends no more pages, including pages that are still waiting.
• Legal basis: Art. 6(1)(b) GDPR. Creating the cards is the core of the app.

6. Usage statistics (only with consent)

On first launch, we ask whether we may collect usage statistics. Both answers are equally easy to choose. If you say no, the app does not even start the statistics service.

• Provider: PostHog, EU servers. The IP address is discarded, location lookup is off, and there are no session recordings.
• What we collect: which screens you open, certain actions (for example "scan started" or "quiz completed" with the score), your onboarding answers, device type, operating system, app version and a random device identifier. Once you have an account, we link the data to your account identifier.
• What we never collect: page texts, card texts, book titles, authors, page labels or any other free text.
• Withdrawal: at any time in the app under Settings → Share usage statistics. After that we collect nothing more. We delete data already collected when you delete your account, or on request by email.
• Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

7. Subscription and purchases

You buy the subscription through Apple's App Store or Google Play. Apple and Google process your payment data under their own responsibility. We never see payment data. RevenueCat manages for us whether your subscription is active and reports this to our server. For this, RevenueCat receives your anonymous account identifier and the purchase data from the store (product, period, status).

8. Backup, sync and sign-in with an email code

• Your books, cards and review history are backed up with your account on Supabase's servers in Frankfurt am Main. This keeps them safe and available on your other devices.
• The original text of your pages is not synced. It stays on the device you scanned it with.
• Optionally, you can add an email address. We then send you a one-time code; there is no password. We only use the email address for signing in.

9. Recipients and processors

These service providers process data on our behalf. We have data processing agreements with all of them.

Apple (App Store) and Google (Google Play, and Google ML Kit on Android) act under their own responsibility. Their own privacy policies apply.

Transfers to the USA

RevenueCat processes data in the USA. Supabase, Google and PostHog are US companies, even though your data is stored in the EU. For the USA, the European Commission's adequacy decision for the EU-US Data Privacy Framework applies (Art. 45 GDPR). In addition, the agreements include EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Your content such as cards and page texts stays in the EU.

10. Retention and deletion

• Data on your phone stays until you delete it in the app, delete your account or uninstall the app.
• Data on our servers stays as long as your account exists. If your subscription ends, it stays stored until you delete your account.
• We automatically delete anonymous accounts without a subscription after 30 days.
• When you delete your account, we delete your data at Supabase, your customer record at RevenueCat and, if you had agreed to statistics, your data at PostHog. Here's how: Delete account.
• Deleted data can remain in Supabase's backups until they are overwritten in the regular cycle.

11. Security

• All connections are encrypted (HTTPS).
• On the server, every account can only see its own data.
• Your sign-in is stored encrypted on your phone.
• Server logs contain no page texts and no card content.

12. Your rights

Under the GDPR you have these rights:

• Access to your data (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20). In the app: Settings → Export my data (JSON)
• Objection to processing based on Art. 6(1)(f) GDPR (Art. 21)
• Withdrawal of consent with effect for the future (Art. 7(3))

To use them, write to henri.irmscher@gmail.com. This also covers data held by our service providers, for example at PostHog.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (datenschutz.hessen.de).

13. Minimum age

PageBite is intended for people aged 16 and over. We do not knowingly collect data from younger children.

14. Changes

If the app or the law changes, we update this policy. The date at the top shows the current version. If anything about the AI processing changes, the app asks for your permission again before your next scan.