Privacy Policy

Effective date: August 21, 2026

RiddleBoox ("the app") is a native Android diary app for BOOX (Onyx) e-ink tablets, developed by an individual developer. This policy explains what data the app handles, why, and what choices you have.

What RiddleBoox does not do

• No account or sign-in is required or offered. The app has no server of its own and does not know who you are.
• No advertising and no analytics or tracking SDKs are included in the app.
• Nothing is sold to third parties.

What the app stores on your device

Everything you write — page images, transcripts, conversation history, agent workspaces, and settings — is stored locally in the app's private storage on your tablet. Your AI provider API key is stored in an encrypted file backed by the Android Keystore, not in plain text.

What leaves your device, and why

RiddleBoox is "bring your own key": to generate a reply, the page you wrote (as an image and/or transcribed text) and the recent conversation thread are sent directly from your device to the AI service you configure in Settings — by default an OpenRouter endpoint, or any OpenAI-compatible endpoint you choose. That request is authenticated with your own API key. This is necessary for the app's core feature to work at all, and it happens only when you send a page.

The app developer does not receive, log, or have access to this content. It is a direct connection between your device and the AI provider you chose, governed by that provider's own privacy policy (for example, OpenRouter's if you use the default).

Device permissions

• All files access (MANAGE_EXTERNAL_STORAGE) — used only to let the library agent read book files (e.g. EPUB) already on your device's shared storage, so it can discuss or search them when you ask. Books are read locally; RiddleBoox does not upload your library.
• Internet access — used to reach the AI endpoint you configure, and to let the library agent download a book when you explicitly ask it to.

RiddleBoox also reads your BOOX Notes/library metadata (titles, reading progress, highlights) through Onyx's on-device content providers, so agents can reference what you're reading. This data stays on-device unless it becomes part of a page you send to your AI provider as described above.

Your choices

• You choose which AI provider and model to use, or can run the app with no API key configured (the diary stays offline and does not reply).
• Deleting the app removes all locally stored data. There is no server copy to separately request deletion of.

Children

RiddleBoox is not directed at children and does not knowingly collect data from children.

A note on care

RiddleBoox can be a gentle space to reflect, but it is not a therapist, crisis service, or substitute for professional mental-health care.

Changes to this policy

If this policy changes, the updated version will be published at this same address with a new effective date.

Contact

Questions about this policy: nguyenvanduocit@gmail.com