Privacy Policy

Who we are Hibrora is an app and a website run by an independent individual: Mahmoud Alrajhi, from the Kingdom of Saudi Arabia. He is the person responsible for the personal data described here. For anything concerning your privacy: support@hibrora.com 1 — The first principle: your images never leave your device This is not a marketing promise. It is a description of how the app is built. When you translate a page, its text is read on your own device. What is then sent to our server is only the text that was read: the words, the position of each bubble on the page, and the story memory terms for that work if it has a memory. The image itself is never sent to our server, never stored with us, and seen by nobody but you. Our server has no endpoint that accepts images at all. And if you choose on-device translation, not even the text passes through our server. 2 — The floating button and screen capture The app has a floating button that translates what you are reading inside another app. To work, Android asks you for permission to capture the screen, and the app tells you so plainly before it starts. Here is what you should know about it: It only runs when you turn it on, and it stops when you turn it off. The capture stays on your device. It is not sent to our server or to anyone else. Its text is read on the device, and nothing leaves except the text to be translated. We do not keep the capture, and we do not know which app you were reading in. The same applies to an image you share into Hibrora from another app: it is processed on your device. 3 — What we actually collect When you create an account: your email address, your name if you enter one, and your password hashed in a way that cannot be reversed (we ourselves cannot read it). To confirm your email we send it a six-digit code, and we store that code hashed until it is used or expires. We do not accept sign-ups from disposable email addresses that are thrown away after a few minutes — we check the domain of the address only, and we keep nothing about that check. While you use the app: the original bubble text, its translation and its position, story memory terms (a name you translate once is saved so it stays the same through the rest of the chapters), a counter of translated pages, and a log of each operation (when, whether it succeeded or failed, and which provider was used). About your devices: a stable technical device identifier, its name, its system, the app version, and when it last signed in — so you can see them on your devices page and sign out any you do not recognise. We use the same identifier to limit repeated free accounts being opened from a single device. About push notifications: if you allow the app to send notifications, Google's Firebase Cloud Messaging service creates a technical token for your device, and we store it linked to your account so we can reach you while the app is closed. It is a token for the device, not something that identifies you as a person, and it stops working when you sign out, turn notifications off, or delete the app. We do not use it for anything other than sending notifications. About advertising: ads are shown on the free plan only, and they are served by Google AdMob. AdMob uses the advertising ID that Android gives to apps — an identifier that is yours to control: you can reset it or block its use at any time from your device settings. That identifier goes to Google, not to us, and we do not store it. If you watch a "rewarded ad" to earn extra pages, we send Google your account number with us — an internal number, not your email and not your name — so that a signed receipt comes back from Google confirming you finished watching, and we grant you the pages. About that we store the transaction number, its time, and the number of pages granted, so that no reward is granted twice. To protect your account: on every sign-in, sign-up or password-reset attempt we record the internet address (IP), the time of the attempt, and whether it succeeded. This is to stop anyone trying to guess passwords. These records are deleted automatically after seven days. What you send us by choice: your profile picture if you upload one, and any image you attach to a support message you write to us. These are the only two images that ever reach us. Also the text of any appeal you write against a restriction on your account. About your subscription: if you subscribe, we learn from Google Play the order number, the plan, the purchase and renewal dates, and the subscription status. We know nothing about your card. What we do not collect: we do not track your location, we do not read your contacts, and we do not look through your photo gallery — the app does not ask for gallery permission at all; it opens the system picker for you and sees only what you choose. We do not use any analytics tool, behaviour measurement, or crash reporting: we do not know how many times you opened a screen, or where you tapped in it, or when the app crashed on you. The only two Google services inside the app are the advertising and the notifications described above, and each has one specific purpose it does not go beyond. 4 — Content moderation and what it stores Hibrora does not allow sexually explicit content to be translated (see the Content Policy). To enforce that, our server checks the bubble text that reaches it for translation against a list of words and phrases. It does not check images, because images never reach us. When a page appears to be in breach we store a "flag" about it containing: its original text and its translation, its time, your account, and the words that triggered the check along with their weight. With it we store a digital fingerprint proving the text was not altered after it was stored — so that the review is fair to you and to us. We may send the text of flagged pages only — nothing else — to one of the AI providers listed in section 5, so it can judge whether the page really is in breach. It receives the text alone, without your email and without your name. And how long a flag stays: If it turns out to be clean, its text is erased after thirty days and a line with no text remains. If you delete your account, the text of any of its flags that were not confirmed as breaches is erased. A flag that was confirmed as a breach we keep with its text even after the account is deleted, as evidence of a decision we made. 5 — Where the text goes To translate the text we rely on an external AI provider. The provider used may be one of: Google (Gemini), OpenAI, Anthropic, Groq, or Mistral — depending on which is enabled at the time you translate. If we add a new provider we will update this list. What reaches it is the bubble text and the story memory terms for that work. Not your email, not your name, not the title of the work, and nothing that identifies you. We do not use your text to train any model, we do not sell it, and we do not share it with anyone for advertising purposes. Certain other specific things do go to Google, and none of them include your translations: the advertising ID on your device when an ad is shown, your device token when a notification is sent, and purchase data when you subscribe. Subscriptions are sold through Google Play only. Your card details go directly to Google; they do not pass through us and we never store them. With each purchase we send Google an obfuscated identifier for your account — a string from which your email and your name cannot be recovered — so that the purchase is tied to your account alone. To send email (the email confirmation code, password resets, and important notices about your account) we use a mail server at our hosting provider, or an external mail sending service if needed. In both cases nothing reaches the sending party except your email address and the text of the message. 6 — Where your data is stored On Hostinger servers. The connection to the app and the website is fully encrypted. 7 — How long it stays It stays as long as your account does. When you delete your account, everything below is deleted with it: your translations, your works and chapters; your story memories with all their terms; your usage log and your subscriptions; your devices and your notifications; your profile picture; your support messages and their attachments. And only three things remain: A single line in the admin action log showing that an account was deleted and when, without your name, your email, or any content. Content flags that were confirmed as breaches, as in section 4. A line for each payment operation you made: its amount, currency, date, status and plan — with your name, your email and your account number with us cut away from it, so it does not identify you. We keep it because our accounting ledger must not change retroactively, and because a refund notice may arrive after your account is deleted, so we do not act on it twice. Google also keeps the payment records its own system requires, over which we have no control. 8 — Your rights, and how to exercise them yourself To take a copy of your data: in the app, "My account" then "Download my data" — you receive a file containing everything we store about you. To correct it: you can change your name, email, password and picture from your account page. To stop personalised advertising: from your device settings, under "Ads" or "Privacy", you can reset or block the advertising ID. Ads disappear entirely if you subscribe to a paid plan. To stop notifications: from the app, or from the notification settings on your device. To delete your account: from the app, or from the web without needing the app at all: https://hibrora.com/account/delete Deletion has a short grace period before it takes effect, so you can undo it if you pressed the button by mistake or if someone else got into your account. You receive an email containing a cancellation link, and once the grace period passes the account is deleted irreversibly. To appeal a restriction on your account: in the app, "My account" then "Account status". To object or complain about anything else: write to us at support@hibrora.com 9 — Children Hibrora is not directed at anyone under thirteen, and we do not knowingly create accounts for them. If you learn of such an account, tell us and it will be deleted. 10 — If this policy changes We update this page and change its date above. If the change is material — such as collecting a new kind of data — we will tell you inside the app before it takes effect. 11 — Governing law This policy is governed by the laws of the Kingdom of Saudi Arabia, including the Personal Data Protection Law.