Security
Security at eBook Pro
What we actually do to protect your account and data, without exaggeration.
Last updated:
Authentication
Sign-in is handled by Google Firebase Authentication (email and password, phone one-time code, username and password, or Google). We never see or store your password. Our server checks your sign-in token on every AI request. Password-reset codes for username accounts expire after 15 minutes.
Secure communication
The apps talk to our backend and to the third-party services listed in the Privacy Policy over HTTPS.
Cloud data and access control
Account data lives in Firebase (Firestore and Storage), protected by security rules that restrict who can read and write. Your Premium status can only be set by our server, never by the app: subscriptions are created on our server, payment confirmations are verified by signature, and the subscription’s state (paid until, renewed, cancelled) is read from Razorpay by our server. The same check runs on our server and in the database rules, so changing the app cannot unlock Premium.
Secrets
The Gemini API key and payment secret keys are kept on the server, never in the app or this website.
AI data handling
AI requests are sent to Google’s Gemini through our server, as described on the AI page.
Data on your device
Books and reading data are stored in the app’s private storage on your device. Protect your device with a screen lock.
Data deletion
You can delete your account and server-side data at any time: Account & data deletion.
Limits
We rely on Google’s infrastructure and its default protections, such as encryption in transit and at rest as documented by Google. We have not had an independent security certification, and no service can guarantee perfect security.
Reporting a security issue
Email support.ebookpro@gmail.com with the subject “Security report”. Please give us reasonable time to fix an issue before disclosing it, and do not access other people’s data while testing.