Open Citadel is built on a simple premise: your notes, your reading, and your thinking are yours. This policy explains exactly what data the app touches, where it lives, and what — if anything — leaves your device.
Who We Are
Open Citadel is developed by Thamsanqa Ncube, registered as an individual developer on Google Play. There is no separate company entity at this time; this policy will be updated to reflect the responsible entity if that changes in the future.
Summary
- Everything you create in Open Citadel — books, notes, highlights, timeline entries — is stored in a local database on your device. We do not operate a server that stores your content.
- The app does not require account creation or sign-in, and we do not collect your name, email, or other personal information.
- We do not sell data, show ads, or use third-party tracking or advertising SDKs.
- The app connects to the internet only to download AI models you choose to use (from Hugging Face) — never to transmit your notes or reading data.
- Paid features (milestone/goal/task tracking, and an optional cloud AI tier) are in development and not yet available. See Upcoming Paid Features for how this policy will change when they ship.
Data We Collect
As of this version of the app, Open Citadel does not collect, transmit, or store any of your personal data on servers we operate. All content you add — books, highlights, notes, timeline entries, and downloaded AI models — is stored in a local SQLite database on your device, inside the app's private storage. We have no access to this data, and it is never sent anywhere by the app.
We do not use analytics, crash-reporting, or advertising SDKs inside the app itself.
Permissions We Request
The Android app requests the following:
- Storage — to let you import books/documents into your library and export or save images (e.g. highlight cards) to your device's gallery. Files you pick or export are only accessed with your explicit action.
- Internet — to download AI models you select (served from Hugging Face) and, for the future cloud AI tier described below, to send requests to that service.
Third-Party Services
Hugging Face — when you choose to download an on-device AI model (e.g. Gemma, Qwen, DeepSeek), the app downloads that model file directly from Hugging Face's public hosting. This is an anonymous file download; the app does not attach any personal or usage data to these requests.
Google Play Billing — when paid features launch, purchases will be processed entirely by Google Play. We will not see or store your payment details; Google's own privacy policy governs that data.
Note: this website (the page you're reading now) uses Vercel Web Analytics to count anonymous, aggregated page views. This is separate from the app and does not use cookies or collect personal data.
Upcoming Paid Features
Open Citadel currently ships as a free, fully on-device app with no accounts. We are building paid features — milestone, goal, and task tracking/review, plus an optional cloud AI tier — which are not yet available. Here is what to expect, and what will change in this policy before each ships:
- Milestone, goal, and task tracking will work the same way your other data does today: stored locally on your device. It does not by itself introduce any new data leaving your device.
- Cloud AI tier will be an optional, opt-in upgrade for running AI conversations in the cloud instead of on-device. When enabled, the content of your messages and the context needed to generate a response will be sent to OpenRouter, a third-party AI model routing service we use to process those requests. OpenRouter's own privacy policy governs how they handle that data. This feature will be off by default, clearly labeled in the app, and will never be applied to content you haven't explicitly sent to it.
Before either feature is released, we will update this policy with the full, specific details (including any additional processors involved and data retention practices) and note the change in the app's update notes.
Data Retention & Deletion
Because your content lives in a local database on your device, you are always in control of it. You can delete individual books, models, or notes from within the app, or remove all app data by uninstalling Open Citadel — this permanently deletes the local database, and we have no copy to retain.
Children's Privacy
Open Citadel is not directed at children under 13, and we do not knowingly collect personal information from children.
Changes To This Policy
We may update this policy as the app evolves, particularly as paid features launch. The "Last updated" date at the top of this page will always reflect the most recent revision, and material changes will be called out in the app's release notes.
Contact
Questions about this policy or your data can be sent to thamsanqa.dev@gmail.com.