Legal
Privacy Policy
Last updated September 2026
What Canto is
Canto is a personal reading journal for iPhone. There are no public profiles, no social feed, and no sharing of your data with other users. This policy covers the Canto app and this website.
What we store when you use the app
- Your account. You sign in with Apple. We store the email address Apple gives us, which may be a private relay address, and an Apple credential that lets us revoke the sign-in when you delete your account.
- Your library. Books you add, their reading status, dates started and finished, and any note you attach about why you picked a book up.
- Your reflections. The prompts Canto asked, the answers you wrote, and the reflections Canto wrote back, including any extended rounds and the lens you chose for them.
- Passages you save.
- What Canto writes about you. Your Reader's DNA portraits, the insights Canto surfaces across your books, and the recommendation sets it has made for you.
- Subscription status. Whether you have an active Canto+ subscription.
- Notifications. If you allow notifications, a device push token and your notification preference.
What we do not store
- Your appearance setting (light or dark) stays on your device.
- We do not access your location, contacts, camera, or microphone. The app asks for photo library access only when you choose to save a share card.
Usage analytics
We use PostHog to understand how the app is used. In the app this records events such as opening the app, completing a reflection, viewing the paywall, or searching for a book, along with your account ID, app version, device model, operating system, and language. It does not record the text you write, the titles of your books, or the content of your reflections. On this website, PostHog records page views and clicks, and stores a small identifier in your browser. PostHog is based in the United States. PostHog's privacy policy: posthog.com/privacy.
AI processing
Canto uses Anthropic's Claude API to generate your reflection prompts, your reflections, your Reader's DNA, cross-book insights, and recommendations. To do that, we send Anthropic the relevant parts of your library, your written answers, and Canto's earlier reflections for you. This happens when you start or finish a reflection, when a new Reader's DNA or insight is due, and when a recommendation set is generated. Anthropic processes this data to produce the output and, under its API terms, does not use it to train its models. Anthropic's privacy policy: anthropic.com/privacy.
Book data
When you search for a book, the search text is sent to Google Books to find results, and cover images are loaded from Google Books or Open Library. Those services see the request and your device's IP address, as with any web request.
Subscriptions
Canto+ subscriptions are processed by Apple and RevenueCat. We never see or store your payment details. RevenueCat receives your App Store receipt, subscription status, and your Canto account ID so we can verify your entitlement. RevenueCat's privacy policy: revenuecat.com/privacy.
Notifications
If you turn notifications on, we send them through Expo's push service and Apple's notification service. A notification can include a book title from your library.
How it is stored
Your data is stored in Supabase in the United States, transmitted over HTTPS, and private to your account. To limit abuse, we keep a per-account request counter with Upstash; it holds your account ID and a count, nothing you wrote.
Sharing
When you share a reflection line or your Reader's DNA, Canto renders an image and hands it to the iOS share sheet. What happens after that is up to you and the app you share it to.
What we do not do
- We do not sell your data.
- We do not share your data with third parties for advertising.
- We do not use affiliate links or paid placements in recommendations.
Deleting your data
You can delete your account from the Profile tab. Deletion removes your library, reflections, passages, portraits, insights, recommendations, and notification token from our database immediately and permanently, and revokes your Sign in with Apple credential. Analytics events already recorded in PostHog and your subscription record at RevenueCat are retained by those services under their own policies; contact us if you want those removed too.
Children
Canto is not directed at children under 13.
Changes
We will update the date at the top of this page when this policy changes.