Privacy policy

PageBite · Last updated: 12 October 2026

The German version of this policy is the legally binding one. This English version is provided for your convenience.

1. Controller

Email: info@pagebite.eu

This policy covers the PageBite app and this website.

2. An anonymous account instead of registration

When you scan your free page in onboarding, or at the latest right before you see the subscription options, the app creates an anonymous account with our service provider Supabase. It consists of a random identifier. We don't need your name or email address for it. We use the same identifier at RevenueCat to link your subscription to your account.

We automatically delete anonymous accounts without a subscription after 30 days. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

3. What data we process

Our legitimate interest (Art. 6(1)(f) GDPR) is running the app securely and protecting it against abuse.

What your reading list can reveal

The books you read can reveal something about your health, your beliefs or your political views. That is why we protect this data especially well: it never goes into usage statistics, the original text stays on your phone, the servers are in the EU, access is strictly limited to your account, and you can delete everything at any time.

Daily reminder

If you turn on the daily reminder, the app plans the notifications on your phone only, using the notification feature of iOS or Android. They only say how many cards are due, never what is on your cards or in your books. We do not use push notifications, and none of this is sent to us or anyone else. You can turn the reminder off in Settings at any time.

Learning streak

The app counts the days on which you learn and shows your learning streak. For each learning day it only stores the date and the length of your streak. Like your cards, this is backed up with your account, so your streak continues on a new phone. Whether you had a day without a subscription is only kept on your phone. None of this goes into usage statistics.

If you send us feedback from the app

Under Settings → Send feedback you can write to us right from the app. We store your message with your account identifier, the app version, your phone's operating system and its version, and the app language. These details help us find bugs. You only give an email address if you want an answer. We use it for nothing else.

• Where: In our database at Supabase in Frankfurt am Main. Your feedback never goes into usage statistics.
• Legal basis: Our legitimate interest in reading feedback, improving the app and answering you (Art. 6(1)(f) GDPR).
• How long: At most 12 months, then we delete it automatically. If you delete your account, we delete your feedback with it. We delete anonymous accounts without a subscription after 30 days, and their feedback with them.
• Your feedback is part of the data export (Settings → Export my data).

If you tell us why you cancelled

If you cancelled your trial or your subscription, the app asks you once for the reason the next time you open it. You tap a reason or "I'd rather not say". We store the reason right away, together with whether it was the trial or a paid subscription, your account identifier, the app version, your phone's operating system and its version, and the app language. After that you can add a message if you want. You only give an email address if you want an answer. We use it for nothing else.

• Where: In our database at Supabase in Frankfurt am Main. If you agreed to usage statistics, the reason you tapped also goes to PostHog, never your message or your email address.
• Legal basis: Our legitimate interest in understanding why people cancel, improving the app and answering you (Art. 6(1)(f) GDPR). For PostHog your consent (Art. 6(1)(a) GDPR).
• How long: At most 12 months, then we delete your answer automatically. If you delete your account, we delete it with it.
• Your answer is part of the data export (Settings → Export my data).

If you write us an email

If you write to info@pagebite.eu, we process your email address, your name if you give it, and the content of your message. We only use this to answer you.

• Mailbox: Our mailbox is at Hostinger (Hostinger International Ltd., Cyprus). That is where your email arrives, is checked for spam automatically and waits until we answer it. Hostinger states that it stores data in the EU and the United Kingdom. Some of Hostinger's own service providers, for example for spam protection, can sit outside the EU; EU Standard Contractual Clauses apply to them.
• Legal basis: If it is about your subscription or the app, Art. 6(1)(b) GDPR. If you exercise your rights from section 12, Art. 6(1)(c) GDPR. Otherwise our legitimate interest in answering requests (Art. 6(1)(f) GDPR).
• How long: We delete your email when your request is done and we no longer need it. We keep it longer only if the law requires that.

4. Scanning: photos stay on your phone

• For scanning, PageBite uses your phone's document scanner: Apple VisionKit on iPhone, Google's ML Kit Document Scanner on Android. Text recognition also runs on the device (Apple Vision or Google ML Kit).
• We never upload the photos. The app deletes every page photo as soon as the text is read, even if text recognition fails.
• If you scan a book cover, the app keeps only a small picture of it on your phone and deletes the photo right away. The cover is not uploaded and not synced to other devices. The app sends the recognized text of the cover to Google Gemini, so you don't have to type title and author and the app can suggest whether it is non-fiction or fiction (see section 5). Our server does not store this text.
• On Android, Google ML Kit sends technical data to Google, for example the device model, app version, performance values and error codes. ML Kit does not send images or texts.
• The app only uses the camera when you start a scan.

5. AI processing with Google Gemini

After your first photo, the app asks for your permission before it sends the recognized text. Only then is the recognized text of a page sent to our server and from there to Google Gemini. If you choose "Not now", nothing is sent, and the text stays on your phone only until you leave the screen. Google Gemini creates the key idea, quiz and flashcards from it. Our server does not store the page text and does not write it into any logs.

Together with the page text go the kind of book (non-fiction or fiction) and the characters or terms PageBite already knows from this book: for each one its name and a short description, at most 50. They were themselves made by the AI, from pages you scanned earlier. This lets Gemini add to them instead of creating them twice. Earlier page texts and the book title are not sent. For the free page in onboarding there is no book yet, so Gemini decides from the page whether it comes from a novel.

In onboarding you can scan one page for free before you subscribe. Until you buy, the result stays on your phone only. So that each account gets only one free page, our server stores your account identifier and the time. We delete this record with your account. The legal basis is our legitimate interest in limiting abuse and costs (Art. 6(1)(f) GDPR).

• Provider: Google Cloud (Vertex AI), Gemini model. Processing in the EU (location eu).
• No training: Google does not use your texts to train AI models.
• Storage at Google: Request and response logging is off, and caching of requests is switched off for our Google project, so Google does not keep your text after the answer. Google may store a request for up to 90 days in the EU if automated safety filters flag it as possible abuse.
• Labeling: Everything the AI creates is marked "AI-generated" in the app and can contain errors. If in doubt, check the original text.
• Withdrawal: You can withdraw your permission at any time in the app under Settings → AI processing. After that, the app sends no more pages, including pages that are still waiting.
• Legal basis: Art. 6(1)(b) GDPR. Creating the cards is the core of the app.

6. Usage statistics (only with consent)

On first launch, we ask whether we may collect usage statistics. Both answers are equally easy to choose. If you say no, the app does not even start the statistics service.

• Provider: PostHog, EU servers. The IP address is discarded, location lookup is off, and there are no session recordings.
• What we collect: which screens you open, certain actions (for example "scan started" or "quiz completed" with the score), your answers and choices during onboarding (for example, whether you want a reminder or turn on the app lock — never which apps), the reason you tap after a cancellation, device type, operating system, app version and a random device identifier. Once you have an account, we link the data to your account identifier.
• What we never collect: page texts, card texts, book titles, authors, page labels or any other free text.
• Withdrawal: at any time in the app under Settings → Share usage statistics. After that we collect nothing more. We delete data already collected when you delete your account, or on request by email.
• Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

7. Subscription and purchases

You buy the subscription through Apple's App Store or Google Play. Apple and Google process your payment data under their own responsibility. We never see payment data. RevenueCat manages for us whether your subscription is active and reports this to our server. For this, RevenueCat receives your anonymous account identifier and the purchase data from the store (product, period, status).

If you install PageBite on Android through a creator's link, Google Play tells the app which link the install came from. The app reads this once to show you that creator's discount. This information and the code stay on your phone and are not sent to us or anyone else.

8. Backup, sync and sign-in with an email code

• Your books, cards, review history and learning streak are backed up with your account on Supabase's servers in Frankfurt am Main. This keeps them safe and available on your other devices.
• The original text of your pages is not synced. It stays on the device you scanned it with.
• Optionally, you can add an email address. We then send you a one-time code; there is no password. We only use the email address for signing in.

9. Recipients and processors

These service providers process data on our behalf. We have data processing agreements with all of them.

Apple (App Store) and Google (Google Play, and Google ML Kit on Android) act under their own responsibility. Their own privacy policies apply.

Transfers to the USA

RevenueCat processes data in the USA. Supabase, Google and PostHog are US companies, even though your data is stored in the EU. For the USA, the European Commission's adequacy decision for the EU-US Data Privacy Framework applies (Art. 45 GDPR). In addition, the agreements include EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Your content such as cards and page texts stays in the EU, and our mailbox for your emails is with a provider from the EU.

10. Retention and deletion

• Data on your phone stays until you delete it in the app, delete your account or uninstall the app.
• Data on our servers stays as long as your account exists. If your subscription ends, it stays stored until you delete your account.
• We automatically delete anonymous accounts without a subscription after 30 days.
• We automatically delete feedback from the app and answers to the question after a cancellation after 12 months at the latest.
• When you delete your account, we delete your data at Supabase, your customer record at RevenueCat and, if you had agreed to statistics, your data at PostHog. Here's how: Delete account.
• Deleted data can remain in Supabase's backups until they are overwritten in the regular cycle.

11. Security

• All connections are encrypted (HTTPS).
• On the server, every account can only see its own data.
• Your sign-in is stored encrypted on your phone.
• Server logs contain no page texts and no card content.

12. Your rights

Under the GDPR you have these rights:

• Access to your data (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20). In the app: Settings → Export my data (JSON)
• Objection to processing based on Art. 6(1)(f) GDPR (Art. 21)
• Withdrawal of consent with effect for the future (Art. 7(3))

To use them, write to info@pagebite.eu. This also covers data held by our service providers, for example at PostHog.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (datenschutz.hessen.de).

13. Minimum age

PageBite is intended for people aged 16 and over. We do not knowingly collect data from younger children.

14. Changes

If the app or the law changes, we update this policy. The date at the top shows the current version. If anything about the AI processing changes, the app asks for your permission again before your next scan.