Carrel
Carrel has no account, no analytics, and no server of ours for your reading to be sent to. This page says exactly what that means, and is specific about the few moments Carrel does touch the network.
Last updated 21 September 2026
We collect nothing about you. There is no sign-up, no email, no identifier, and no telemetry of any kind. Your library, your marks and your reading history live on your device, and sync through your own iCloud account whenever the device is signed in to it, where we cannot read them.
On your device: your books and imported files, your reading position, highlights, notes and notebooks, your reviews, your reading history and goals, and every setting, including your typography and themes.
Whenever the device is signed in to iCloud, Carrel also keeps its library in your own iCloud private database, using Apple's CloudKit. There is no switch for this inside Carrel. To keep your library out of iCloud, switch iCloud off for Carrel in iOS Settings. The synced copy is governed by your iCloud account and Apple's terms. We have no ability to read it, and no copy of it exists anywhere else.
What travels that way is the library's records: titles, authors and covers, reading positions, highlights, notes, notebooks, bookmarks, your reviews, collections, series and tags, your own themes, the photographs you keep with a book or a mark, your reading history, goals and streaks, the record of unlocks and of changes to the block, and your blocking setup, described below. The book files themselves do not sync, so each device keeps its own. Your typography, appearance and reminder settings are not synced; they stay with this device and its backups. iCloud's key-value storage also carries the addresses of any OPDS libraries you add, and two small markers: that the bundled classics are already on your shelf, and that you have imported a book of your own.
Widgets and the Lock Screen's reading activity draw on a space on this device shared only with Carrel's own extensions. iOS may also show them on your own Mac or Apple Watch, through your Apple Account, as it does for any app's widgets. Notifications are scheduled on this device by Carrel itself, and none come from a server of ours. The reading reminder, if you turn it on, arrives at the hour you chose and says back the place you said you would read. Both are kept on this device and are never synced.
If you choose an Obsidian folder, Carrel writes one Markdown file of your marks per book into it after each sitting, and whenever you ask. The folder is yours: if it lives in iCloud Drive or a vault that syncs, the files go wherever that folder goes, and Carrel sends them nowhere itself. Exports and shared cards go only where you send them from the share sheet.
Carrel uses Apple's Family Controls framework, with individual authorization, meaning an adult managing their own device. It is not configured for supervising anyone else.
When you choose which apps, categories and websites to hold, iOS gives Carrel opaque tokens, not names. Carrel cannot turn a token back into an app, and we never learn which apps you selected. When you open a held app or website, iOS lends its name to the small extension that draws the shield, which uses it for the line on the shield and keeps it nowhere.
Those tokens are stored with your blocking setup in three places. The first is Carrel's library, so they travel through your own iCloud private database to your other devices, as described above. The second is a small record in this device's Keychain, which exists so that deleting and reinstalling Carrel does not reset the block. It holds the tokens and the settings around them: whether blocking is on, your hours, strictness, reading goal and how reading unlocks, your banked time, your progress toward the next unlock and any spend in progress, the emergency unlocks and daily windows you have used, any change still waiting out its delay, the date blocking was first set up, when you last changed the strictness, how many apps, categories and websites you chose, a count of reinstalls, and the last clock reading, used to notice the date being changed. That record stays on this device, is not carried to a new device by a backup, remains after Carrel is deleted, and is never sent anywhere. Erasing the device removes it. The third is the space on this device shared only with Carrel's own extensions, where the one that keeps your hours reads them. It goes when Carrel is deleted.
None of this makes the block unbreakable, and Carrel does not pretend it is. An adult can always revoke Carrel's Screen Time permission in iOS Settings, and the app says so.
Carrel uses the camera only when you open it, to photograph a paper book. Each photograph is read on your device by Apple's text and barcode recognition, and none is sent anywhere to be read. What is kept depends on why you took it.
Kept photographs are part of your library, so they travel through your own iCloud with the rest of it. Choosing a picture from your photo library gives Carrel only the one you pick, and Carrel adds to your photo library only when you choose Save Image or Save Video while sharing a mark.
Recaps are off until you turn them on. Where your device supports it, recaps, answers to the questions you ask about what you have read so far or about a passage, and suggestions of words to look at when you read closely are written by Apple's model running on your device. The text of your books and your notes is not sent anywhere for this. On a device that cannot run the model, Carrel says so, and a recap offers your own marks instead.
Carrel has no server, so each of these is a direct request from your device to the party named. None carries an account of ours, and apart from your own accounts with Apple and, if you connect it, Readwise, none carries anything that identifies you. Like any request on the internet, each shows the party your network address. Requests to Gutendex, Project Gutenberg and Wikipedia, and books taken from an OPDS library, name Carrel and its version and link to this page. Most happen only while you are using the feature that needs them; the rows say where that is not so. Each is subject to that party's own privacy policy.
| When | Where it goes, and what it carries |
|---|---|
| Browsing or taking a free book | gutendex.com receives your search terms and the headings you browse. gutenberg.org receives the requests for the covers you see and the book you take, which name that book. Fetching a free book whose file has not reached this device asks gutendex.com for it by its catalogue number, then gutenberg.org for the file. |
| A library of your own (OPDS) | The address you type, a Calibre server at home for example, and any address its catalogue points to for a shelf or a book, receive the requests for its catalogue pages and for the books you take from it. A library on your home network is reached only with the local network permission iOS asks you for. |
| A Wikipedia lookup | When you choose Wikipedia in a lookup, up to the first six words you selected go to en.wikipedia.org to fetch a summary. Apple's built-in dictionary and Apple's translation sheet are handled by iOS and involve no request from Carrel. |
| Readwise, only if you connect it | Off unless you paste your own Readwise access token, which Carrel checks with Readwise when you save it. Once connected, your marks go to your Readwise account after each sitting in which something changed, and whenever you choose SYNC NOW: each mark's text, your note, the book's title and author, the page, and when you made it. That is under Readwise's privacy policy. The token is kept in this device's Keychain and is never sent anywhere but Readwise. FORGET IT removes it and stops all of this. |
| iCloud, while signed in | Apple's CloudKit carries your library between this device, your iCloud private database and your other devices, as described above, in the background too, so that a change made on one device reaches the others. Apple holds it under your account; we cannot read it. |
| Handoff, while an EPUB is open | iOS offers the EPUB you are reading to your other devices nearby that are signed in to the same Apple Account, passing its title and Carrel's own reference to it through Apple's Handoff. You can switch Handoff off in iOS Settings. |
| Buying or restoring | Apple processes every purchase and restore through the App Store, and subscriptions are managed on Apple's own sheet. Carrel asks the App Store for prices only when a screen that offers a purchase is open, and reads which of its purchases your Apple Account holds from StoreKit on your device. We never see your name, your payment details or your Apple Account. The occasional request for a rating is Apple's own prompt, and a rating goes to Apple. |
A few things open in your web browser, and only when you tap them: a web link inside a book, a Wikipedia article and its licence, Apple's standard terms of use from the purchase screen, and this page. From there it is the browser, not Carrel, that makes the request.
A book can point to pictures, fonts or styles kept on the web rather than inside its own file. If one does, the page that shows them asks for them from wherever the book points, as a web page would. Which address receives that request is the book's choice, not Carrel's.
Carrel is not directed at children and does not knowingly collect anything from anyone. Its Screen Time authorization is for a person managing their own device, not for supervising a child's.
Because we hold no data about you, there is nothing for us to export, correct or delete, and no request you could make that we would be able to act on. Deleting the app removes your library, your book files and your settings from the device. Two things stay in this device's Keychain afterwards: the blocking record described above, on purpose, and your Readwise token if you connected one. A reinstall finds both. FORGET IT on the Export sheet removes the token, and erasing the device removes both. The synced copy is in your own iCloud account, where we cannot reach it, and is managed from your iCloud settings in iOS. Anything you exported, saved to your photo library, wrote to an Obsidian folder or sent to Readwise stays where you put it.
If this policy changes, the date at the top changes with it, and the previous versions remain in this page's public history.
Questions about this policy: code@roydsantiago.com