Privacy Policy
Effective date / last updated: 8 August 2026 · Applies to the Codexa application for Android and iOS, and to the Codexa web application ("Codexa," "the App," "we," "us," or "our")
Summary: Codexa is free, open-source, self-hosted software. The App is only a client: it sends and receives data exclusively with the server address that you, the user, configure — a server that you or someone you trust owns and operates. The Codexa project itself does not operate any server, does not receive, collect, view, or store any of your personal data or content, and the App contains no analytics, advertising, or tracking technologies of any kind.
1. Introduction and scope
This Privacy Policy describes how the Codexa application handles information when you use it. Codexa is free, open-source software (licensed under the AGPL-3.0 license) that connects to a server you or your household or organization independently deploys and controls (for example, a home NAS or a small personal server). The App itself has no connection, independent of that server, to the Codexa project or its developers, and the developers of Codexa never receive, see, or store any data you generate or provide while using it.
By using Codexa, you acknowledge that your data is being sent to and stored on the server address you configure, which is operated by you or a third party you have chosen and trust — not by the Codexa project.
2. Information we collect
The App handles the following categories of information, all of which stay between your device and the server address you configure:
- Account credentials. Server address, username, and password/session token, entered by you. These are stored locally on your device (in the App's local storage) and transmitted only to the server address you configured, solely to authenticate you and keep you signed in.
- User content. Books, cover images, reading progress, bookmarks, highlights, and notes. This content is stored on your own server; downloaded books and their reading progress are also cached locally on your device to support offline reading.
- Usage data you generate. Reading statistics (such as time read, pages turned, and session counts) are calculated on your device and stored on your own server, associated only with your own account on that server.
None of the information above is transmitted to, or made accessible to, the Codexa project or any server other than the one you explicitly configured. The Codexa project operates no backend, database, or analytics service of its own.
3. How information is used
Information described in Section 2 is used exclusively to provide the App's core functionality on the server you configured: authenticating your account, storing and syncing your library and reading data, displaying your reading statistics, and enabling offline access to books you have downloaded. The Codexa project does not use this information for any other purpose, because the project never receives it.
4. Optional third-party integrations
The App can optionally exchange data directly with other services, but only if you or your server's administrator explicitly configures them. No such service is contacted by default:
- OPDS catalogues you add (for example, Calibre-Web, Komga, or Kavita) — the App communicates directly with whichever catalogue URL you enter.
- A BookOrbit server you connect, for library browsing and optional two-way synchronization of highlights, reading sessions, and progress.
- KOReader Sync — either your Codexa server's own built-in sync endpoint, or an external KOSync-compatible server you point it at.
- Single sign-on providers (such as Google, Apple, or a self-hosted identity provider) — only if your server's administrator enables this; authentication happens directly between your device and that provider.
In every case, these connections are made directly between your device (or your own server) and the third-party service you specified. The Codexa project is never an intermediary in this traffic and does not receive or log any of it.
5. Data sharing and disclosure
The Codexa project does not sell, rent, or share your personal information or content with any third party, and does not have any data to disclose, because it does not operate a server that receives it. Any sharing of data that occurs (for example, with an OPDS catalogue or BookOrbit server you configure, as described in Section 4) happens directly between your device or your own server and the service you chose, under that service's own terms — not under this policy.
6. Data retention, access, and deletion
Because all of your account credentials and content are stored on the server you or your administrator control, that server — not the Codexa project — determines how long your data is retained. You (or your server's administrator) can access, export, correct, or permanently delete your account and all associated data at any time using the administration tools of your own server; the Codexa project has no separate copy of your data to retain or delete, since it never receives one.
If you no longer wish to use the App, you can stop using it and/or ask your server's administrator to delete your account, at which point your credentials and content are removed from that server according to its own configuration.
7. Data security
Credentials and session tokens are stored using your device's standard local application storage and are only ever transmitted to the server address you explicitly configured. The App supports connecting over encrypted (HTTPS) connections when your server is configured to use one; we recommend doing so. Because your data resides on a server you or your administrator operates, the security of that server (software updates, network exposure, access control, backups) is your responsibility, not the Codexa project's.
8. Children's privacy
Codexa does not knowingly collect personal information from anyone, including children under 13 (or the relevant minimum age in your jurisdiction), because the App itself does not collect or receive personal information at all — everything described in this policy is stored on the server that you, a parent, guardian, or household administrator controls, never on any system operated by the Codexa project.
9. Permissions
The Android application requests only the INTERNET and
ACCESS_NETWORK_STATE permissions, used solely to communicate with the server
address you configure and to detect when network connectivity is restored. The App does
not request access to your contacts, location, camera, microphone, or any files beyond
what you explicitly select through the system's own file/document picker (for example,
when uploading a book or a custom font on an administrator account).
10. Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be posted at this same URL with an updated "last updated" date at the top of this page. We encourage you to review this page periodically.
11. Contact us
If you have questions about this Privacy Policy or how Codexa handles information, please raise them as an issue on the project's repository: github.com/thehijacker/codexa/issues.