How reading apps use your data

A reading app sees more than a bookshelf does. It knows which story you opened, how far you got, what you searched for and which chapter you paid to unlock. Whether any of that leaves the app has a published answer for eleven of the services we cover and no published answer at all for the other 54. This page works through what the eleven say, who else the documents put in the picture, and which questions to put to a policy we have not read.

Everything below is from privacy policies, help pages and the data declarations the two app stores require, read on October 27, 2026. We installed nothing and created no accounts, so there is no traffic analysis here and no claim about what an app does in practice. It sits alongside the rest of this section, and the broader picture of what is and is not published across the niche is in our overview of how private these services are.

The vocabulary the stores forced on everyone

Apple's privacy card sorts everything a developer declares into three buckets, and the distinction between them is the single most useful thing on the page.

• Data used to track you means it is linked to you or your device across other companies' apps and websites, usually for advertising. This is the bucket that matters.
• Data linked to you means it is tied to your identity inside the app, but not followed around the rest of the internet.
• Data not linked to you means it is collected but, by the developer's account, not associated with your identity.

Google Play's Data safety section asks different questions: what may be collected, what may be shared with third parties, whether transfers are encrypted, and whether you can request deletion. The two are not interchangeable, which is why a record carrying both is worth more than one carrying either. Both are filled in by the developer, both carry the store's caveat that practices vary by feature and age, and neither store publishes a routine process for checking that the answers are true.

What the eleven declarations say

Five of the eleven declare tracking: Crave, Erotic Stories - Erotica, Roma: Romance Novels, Smuthie and Spicify, although Smuthie's is limited to contact info. Three declare none at all: Epictos, huush and Velvet Novel. The other three sit in between.

Two entries deserve reading twice. Spicify declares user content among the data linked to you, which on a reading app means what you write or save, and is the only record in the set to do so. Roma's Google Play entry contradicts itself, listing data types that may be shared with third parties while also stating that no data is collected. Both statements are the developer's, filed on the same page, so neither is evidence.

Velvet Novel's policy goes the other way and is worth quoting because so few do: We do not use any third-party analytics or advertising SDKs, and we do not sell your data to third parties. It also says We do not collect your email address, password, or real name. The same section says the app identifies you by an anonymous identifier supplied by a subscription service, which is a piece of candour you will not find in most of these documents.

Advertising is where the measuring happens

Thirty of the 65 services have advertising recorded, usually from the stores' own flags. Four record that they carry none: Epictos, Lore, Archive of Our Own and Outfox Stories. The other 31 say nothing either way.

Where ads are present, the interesting question is whose. Two records in the whole set name the networks. Spicify's privacy policy names Google AdMob, Meta Audience Network and Unity Ads as mediation partners. Satinaire's names Unity Ads for the rewarded ads that unlock free chapters. That is the mechanism behind the tracking buckets in the table above, and it is the reason a free, ad-funded reading app is structurally less private than a paid one, whatever its policy says about selling data.

Rewarded advertising is the common shape here: Satinaire's FAQ describes free reading with ads between chapters, and several interactive apps let you earn their in-app currency by watching one. Our page on what free actually means covers the economics. The privacy half is simply that an ad-funded tier has a second party in the room.

What the AI story services say about what you write

For an AI story app the data is not your reading history, it is your prompt, and five put something in writing.

NovelAI's privacy policy, effective from 10 September 2026, opens with a summary that is unusually direct: your stories are end-to-end encrypted and we cannot read them, and we do not store the prompts you send for generation. That is the strongest statement of its kind in our records, and it is a statement rather than a demonstration.

DreamGen's terms and privacy FAQ sets out a two-part position: private stories are not used to train models unless you opt in, the opt-in is off by default, and automated moderation still scans private content. Both halves are worth knowing. Private does not mean unread by a machine.

Lore's privacy policy lists two purposes for its character chat layer, delivering AI responses and, in its own words, Train our AI: use anonymized chat data. StoryLoom's acceptable use policy notes that content you submit may be processed by third-party AI vendors, the ordinary arrangement for a service that runs no model of its own. Pirr's FAQ addresses publication rather than training: All of the stories you create remain private until you decide to publish them yourself. What these services are allowed to generate is a separate question, covered in what the AI story apps allow.

The questions to ask of a policy we have not read

Fifty-four of the services we cover have no data declaration recorded, so most of the time you will be reading the document yourself. These five questions get you most of the way.

1. Does it name third parties, or only categories? "Service providers" is a category. Google AdMob, Meta Audience Network and Unity Ads are names. A policy that names them has told you something.
2. Does it distinguish sharing from selling? Several policies promise not to sell data while declaring that they share it. Epictos's says the developer does not sell personal data; Satinaire's Play entry declares sharing with third parties. Both can be true at once.
3. Does it say what happens to content you create? Only Spicify's store card mentions user content, and only DreamGen's policy itemises the content you generate. On an AI service this is the central question, not a detail.
4. Does it mention training, and is the default on or off? DreamGen says opt-in and off by default. Lore says anonymised chat data is used. Most records say nothing, which is not the same as no.
5. Is there a deletion section, and does it name a route? A policy that mentions deletion without saying where to do it is the commonest shape in this niche, and what you can actually erase goes through the four services that publish real steps.

If you want the services that can evidence something rather than assert it, the shortlist by property groups them. If the worry is the statement rather than the server, that is a separate question with a very different answer. Our note on how we check explains why the blanks here stay blank.