Privacy Policy

1. Who We Are

Litty ("we", "us", "our") is operated by Litty Software Publishing, a sole proprietorship registered in the Republic of the Philippines. We provide an electronic reading and "commonplace book" application available at littyme.com and through our mobile applications (the "Service").

For the purposes of the Data Privacy Act, Litty Software Publishing is the Personal Information Controller responsible for your personal data processed through the Service.

2. Scope of This Policy

This Policy applies to personal data we collect through the Service — our website, mobile apps, and related features. It does not apply to third-party services, websites, or applications that you may access through links in the Service, which have their own privacy policies.

3. Personal Data We Collect

We collect the following categories of personal data:

3.1. Information you provide to us

• Account information: your email address and chosen username when you register.
• Authentication data: your password (stored only in hashed/encrypted form by our authentication provider — we never see your plaintext password).
• Profile information: any display name, profile details, or settings you choose to add.
• Payment information: if you subscribe to a paid plan, billing details are collected and processed by our third-party payment processor. We do not store your full payment card details.
• Communications: information you provide when you contact us for support.

3.2. Information generated through your use of the Service

• Reading data: the books you add to your library, your reading progress, and reading session activity (including reading time).
• Your content: highlights, annotations, notes, and vocabulary entries you create.
• Social activity: follows, reading groups ("Parties") you join or create, and content you choose to share with others.
• Achievement and statistics data: reading streaks, milestones, and related statistics derived from your activity.

3.3. Information collected automatically

• Technical data: device type, browser type, operating system, and similar technical identifiers necessary to deliver and secure the Service.
• Usage data: log information such as access times and feature usage, used to operate, maintain, and improve the Service.
• Cookies and local storage: we use cookies and similar technologies necessary for authentication and the functioning of the Service. See Section 9.

3.4. Sensitive personal information

Litty is a reading application and does not intentionally collect "sensitive personal information" as defined under the Data Privacy Act (such as information about your health, race, ethnic origin, religious or political beliefs, genetic or biometric data, or government-issued identifiers). Please do not submit such information through the Service. Note that the books you read and the content you save may reveal personal interests; we treat your reading data and content as private to you and process it only as described in this Policy.

4. How and Why We Use Your Personal Data (Purposes and Legal Bases)

We process your personal data for the following purposes, relying on the lawful bases indicated:

Where we rely on consent, you may withdraw it at any time (see Section 8); withdrawal does not affect processing carried out before withdrawal.

5. Sharing and Disclosure of Personal Data

We do not sell your personal data. We share it only as described here:

5.1. Service providers (sub-processors)

We use trusted third-party providers to operate the Service. They process personal data on our behalf, under contract, only for the purposes we specify:

• Supabase — database, authentication, and storage hosting.
• Vercel — application hosting and delivery. We also use Vercel Web Analytics, a cookieless, privacy-friendly analytics service that measures aggregate traffic (such as page views and referral sources) without using cookies, tracking you across sites, or storing information that identifies you personally.
• Resend (or our email provider) — sending transactional emails (e.g., verification, password reset).
• PayMongo (or our payment processor) — processing subscription payments.

These providers may process or store data outside the Philippines. Where data is transferred across borders, we take steps to ensure it remains protected to a standard consistent with the Data Privacy Act.

5.2. Other users

Content you choose to share — for example, a highlight you share to friends or activity within a Party — is visible to the users you share it with. You control what you share through the Service's privacy settings. By default, reading activity is private unless you opt to share it.

5.3. Legal and protection

We may disclose personal data if required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of Litty, our users, or the public.

5.4. Business transfers

If Litty is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, including providing the Service to you, complying with our legal obligations, resolving disputes, and enforcing our agreements.

• Account and content data are retained while your account is active.
• If you delete your account, we will delete or anonymize your personal data within a reasonable period, except where we are required or permitted by law to retain it (for example, transaction records for tax or accounting purposes).

7. Security of Your Personal Data

We implement reasonable and appropriate organizational, physical, and technical security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction, including:

• Encryption of data in transit;
• Access controls and row-level security restricting data access to your own account;
• Hashed/encrypted storage of credentials by our authentication provider;
• Regular review of our security practices.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and affected data subjects in accordance with the Data Privacy Act (within 72 hours of knowledge of the breach, where required).

8. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights regarding your personal data:

• Right to be informed — to know whether your personal data is being processed, and the purposes and extent of processing.
• Right to access — to obtain a copy of the personal data we hold about you.
• Right to rectification — to correct inaccurate or incomplete personal data.
• Right to erasure or blocking — to request the deletion or blocking of your personal data, subject to legal exceptions.
• Right to object — to object to the processing of your personal data, including for direct marketing or automated processing.
• Right to data portability — to obtain and reuse your personal data in a structured, commonly used, machine-readable format (you can export your highlights and content through the Service).
• Right to damages — to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.
• Right to lodge a complaint — to file a complaint with the National Privacy Commission.

You can exercise many of these rights directly within the Service (for example, editing your profile, changing privacy settings, exporting your highlights, or deleting your account). To exercise any right, you may also contact us using the details in Section 11. We will respond within the period required by law.

9. Cookies and Similar Technologies

We use cookies and similar local-storage technologies that are necessary to operate the Service — primarily to keep you logged in and to remember your settings. We do not use these technologies for third-party advertising. You can control cookies through your browser settings, but disabling necessary cookies may affect the functioning of the Service.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you are under the age of majority in your jurisdiction (18 in the Philippines), you should use the Service only with the involvement of a parent or guardian. If we learn that we have collected personal data from a child without appropriate consent, we will delete it.

11. Contact Us and Data Protection Officer

For any questions, requests, or complaints regarding this Policy or your personal data, or to exercise your data subject rights, please contact:

Litty Software Publishing
Email: support@littyme.com
Website: https://littyme.com

If you believe your data privacy rights have been violated, you also have the right to lodge a complaint with the:

National Privacy Commission (NPC)
Website: https://www.privacy.gov.ph
Email: info@privacy.gov.ph

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice through the Service or by email. Your continued use of the Service after the changes take effect constitutes your acknowledgment of the revised Policy.