Privacy & Security

Tsumihon includes a set of privacy controls that put you in charge of what the app sees, what other apps see of Tsumihon, and how external links behave. Everything is opt-in and configured from Settings → Account & Privacy → Privacy.

App Lock

When app lock is enabled, Tsumihon requires authentication to open. On mobile, that means Face ID, Touch ID, or your device passcode.

The lock prompt appears on cold launch and when resuming from the background.
If your device does not have biometrics or a passcode set, app lock cannot be enabled. The setting is disabled in that case.
If authentication is cancelled or fails, the library content stays hidden until you authenticate successfully.

Hide in App Switcher

When you switch apps on mobile, the OS captures a snapshot of the current screen for the app switcher view. With Hide in App Switcher enabled, Tsumihon blurs or hides its content in that snapshot so library covers and titles are not visible from the multitasking screen.

This setting is mobile-only and does not affect what you see while you are actively using the app.

Clipboard Monitoring

Some sources let you copy a book or gallery URL to your clipboard, and Tsumihon can offer to open or look it up automatically when the app comes back into the foreground.

This is off by default. When you turn it on, the app checks your clipboard each time it resumes; if it finds a supported link, it prompts you. The clipboard is never read in the background, and nothing is uploaded — the check happens locally.

You can toggle this setting off at any time to stop clipboard checks entirely.

In-App Browser

The in-app browser opens external links inside Tsumihon instead of handing them off to your system browser. It is useful for sources that need authentication cookies you have already set up in the app — those cookies are reused so the page works without a separate browser login.

When Use In-App Browser is on, taps on external source URLs open a browser sheet inside Tsumihon.
When it is off, links open in your system browser (Safari on iOS, Chrome/your default on Android).

Tip: Turning the in-app browser off is useful if you prefer the address bar, extensions, or password manager features of your system browser. The trade-off is that any source cookies you have stored in Tsumihon are not shared with that browser.

Privacy Mode

Turn on Privacy mode in Settings and an eye button appears over the app. One tap blurs every cover, so you can browse your library in public without the artwork being readable over your shoulder. Tap it again to unblur.

The reader is never blurred: the point of the setting is to make the shelf safe to look at, and a blurred page is not a page.

Signing Out Erases the Device

Signing out does not just forget the session — it erases every device-local trace of the account: the library database, downloaded pages, cached covers, scratchpad captures, exported files, logs, extension settings and their credentials.

It works by sweeping the app’s storage and keeping only an explicit preserve-list, rather than clearing a list of known caches. That direction matters: with a list of things to clear, every new cache added later becomes a leak into the next account to sign in on that device, and this one is designed so a new cache is erased by default.

What survives is deliberate and short: your local backup files, which are yours and are not account data, and the key needed to restore them.

Where Your Data Lives

A short summary of where each kind of data is stored:

Library metadata — stored locally on each device, and synced through your account when sync is enabled.
Downloaded pages — stored locally on each device; not synced.
Extension settings — stored locally on each device, and synced through your account when sync is enabled.
Source logins (credentials/cookies) — stored locally, and when sync is enabled also synced, encrypted on the device before they leave it. The key is held in Apple’s or Google’s own keystore, which they move between your devices end-to-end; we hold only ciphertext and cannot read it. This is what makes signing in to a source once work on every device you own.
AI OCR API key — the same: stored locally, synced encrypted in the same vault, and only ever sent to the AI provider you chose, by your device, when you start an OCR search. We never use it.
Account credentials — handled via your chosen sign-in method; Tsumihon never stores your password.

For the public databases Tsumihon credits as metadata sources, see Settings → Advanced & Safety → Data Credits.