Privacy Policy
Effective November 10, 2026. This is a translation; the Korean version prevails.
TOBEST (“we”) runs the Tobestbooks e-book store and the TOBEST Reader app (the “service”) and handles your personal information under the Korean Personal Information Protection Act. This policy explains what we handle and why, how long we keep it, and how you can exercise your rights.
1. What we handle and why
| Kind | Items | Purpose | Kept for |
|---|---|---|---|
| Account | Email address | Sign-in; linking purchased books to your account | Until you delete the account |
| Sign-in code | The 6-digit code we email you (stored only as a hash), number of codes sent | Verifying it is you; preventing abuse | 10 minutes (count: 1 hour) |
| Sign-in session | Session token (stored only as a hash), when it was created and last used | Keeping you signed in | Until sign-out or account deletion, at most 1 year |
| Devices | Device identifier and device public key (created by the app), device name, operating system, when registered and last used | Issuing licenses for purchased books; the per-account device limit | Until you remove the device or delete the account |
| Reading data of purchased books (sync) | Per purchased book: reading position, bookmark positions, highlight positions and colors, note text, and when each was made, changed or deleted (never book text) | Continuing to read on your other devices signed in to the same account | Until you delete the account. Sync can be turned off in the app |
| Orders | Order number, order email, product, payment and refund status, order time | Delivering purchased books, refunds, transaction records | 5 years, as required by Korean e-commerce consumer protection law |
| License records | Book, device identifier, time issued | Record of delivered books; detecting misuse | 5 years, with the order records |
| Connection data | IP address, request time | Limiting sign-in attempts; diagnosing errors | Not stored (used while handling the request). Error logs: at most 30 days |
We use this information for nothing else. If a purpose changes, we tell you in advance and ask for consent where required.
What we do not handle
- Payment details: card numbers and other payment details go directly to our reseller Lemon Squeezy; we never receive them.
- Reading data: your library, the files you add to the app, and the reading positions, bookmarks, highlights and notes of those files are stored only on your device and are never sent to us. For purchased books, the items in the table above are sent only while you are signed in with sync turned on; highlighted book text is never sent.
- Analytics and ads: the app and this website use no analytics tools, advertising identifiers or tracking cookies.
2. How we collect it
- You enter your email address when you sign in to the app.
- The app sends device information when it registers the device you sign in on. You can change the device name.
- The signed-in app sends the reading data of purchased books as you read them or change bookmarks, highlights and notes. Turn off the sync option in the “Purchased” tab (on by default) to stop sending it.
- When you buy a book at tobestbooks.com, Lemon Squeezy sends us the order through its payment and refund notifications.
3. Sharing with third parties
We do not share your personal information with third parties, except where the law requires it (for example, a lawful request from investigators).
4. Processors and transfers abroad
These companies process personal information for us on servers outside Korea. Information is transferred over the network when you use the service.
| Company (country) | Task | Items | Kept for |
|---|---|---|---|
| Cloudflare, Inc. (United States and other Cloudflare data centers) | Servers, database and book file storage | Everything in section 1 | As in section 1 |
| Resend (Plus Five Five, Inc., United States) | Sending sign-in code emails | Email address, sign-in code | Delivery logs up to 30 days under Resend's policy |
Lemon Squeezy (Lemon Squeezy, LLC, United States) is the merchant of record and processes payments itself; personal information in the checkout is covered by the Lemon Squeezy privacy policy.
If you do not want your information transferred abroad, you can choose not to use accounts and purchases. You can still read your own EPUB and PDF files in the app without an account.
5. Outside services you open from the app
The dictionary and translation features open the word or passage you choose on the Naver Dictionary or Papago web pages. That text goes directly to those services, whose privacy policies apply. Read aloud uses your device's speech feature.
6. Deletion
We delete personal information without delay once its retention period ends or its purpose is fulfilled, so that it cannot be recovered. When you delete your account, we immediately delete your email address, sessions, devices, book access rights and synced reading data. Order and license records that the law requires us to keep are stored apart from other data and deleted after 5 years.
7. Your rights
You can ask at any time to see, correct or delete your personal information, or to stop its processing.
- Delete your account: in the app, open the “Purchased” tab while signed in and choose “Delete Account”. Without the app, see Delete Your Account.
- Other requests: email support@tobestbooks.com from your account email address. We reply with the result within 10 days.
Children under 14 may not create an account.
8. Security
- All connections are encrypted with HTTPS.
- Sign-in codes and session tokens are stored only as hashes.
- Purchased book files are stored encrypted and open only on registered devices.
- Access to servers and the database is limited to as few administrators as possible.
9. Privacy officer
Hosuk PARK, CEO · support@tobestbooks.com
You can also report a privacy concern to the Korea Internet & Security Agency's Personal Information Infringement Report Center (privacy.kisa.or.kr, +82-118) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr).
10. Changes
We announce changes on this page 7 days before they take effect, or 30 days before for changes that matter to your rights.