Bound Privacy Policy

Bound is an audiobook and podcast player for Android phones and Wear OS watches by Rodmonster LLC. It plays books and podcasts from an Audiobookshelf or BookOrbit server that you choose. This page explains exactly what leaves your devices and why. In short: your library, downloads, listening history and sign-in stay on your devices and your own server. Bound sends crash reports and usage analytics, and you can turn both off. The optional Bound AI subscription sends the text each feature needs to Bound's server and its AI provider, and nothing is sent unless you subscribe.

Your server and sign-in

Your phone and your watch each talk directly to the server address you enter. Your username and password go only to that server. Bound keeps the sign-in token the server returns, not your password, and encrypts it on the device with the Android Keystore. If you sign in with single sign-on on the watch, Google's Wear OS sign-in service opens the page on your phone and passes the result back to the watch; the token itself comes from your server.

Like any player for these servers, Bound sends your server your listening progress, bookmarks and playback sessions (with a random device ID and the app's name), and it downloads covers, audio and ebooks from it. What your server does with that is up to whoever runs it. Bound uses HTTPS unless you type an address that starts with http://, which is allowed so home servers without a certificate work.

Phone and watch

The phone shares your sign-in, server address and username, what's playing and where, your privacy choices below, and your Bound AI access with the watch through Google's Wear OS connection between your paired devices. The watch sends back playback commands and progress.

Pause when I fall asleep, on the watch, uses the watch's motion sensors while it is turned on (it's off unless you turn it on). Sensor readings are not stored or sent anywhere; only the pause command goes to the phone.

Bound AI (optional subscription)

Nothing is sent to Bound's server unless you subscribe. When you tap Subscribe, Bound gets an anonymous random ID for the device from Bound's server (bound-api.rod.monster, run on Cloudflare). There's no sign-up, name or email address.

While you're subscribed and Use Bound AI features is on, each feature sends only the text it needs: the text of your spoken commands; the titles, authors and series of books in your library (with genres, lengths, descriptions and how far you are into them for suggestions, your year in listening, podcast picks and "Pick up again?", and narrators, subtitles and years to spot the same book in two libraries); short passages of book or episode text you've already heard, for recaps, the smart sleep timer, scene starts, "I zoned out", bookmark quotes and the cast list; questions you ask about a book or in Help; library searches you type or say, with up to 60 narrator and 60 author names from your library; your bookmark quotes, to sort them into themes; with the spoiler shield on, blurbs of later books in a series or notes of later podcast episodes; and transcribed snippets of podcast episodes, to find sponsor reads and topic changes. Only with family mode on, passages of chapters you haven't heard yet are sent, and only yes/no content flags come back.

Bound's server passes the text to TypeSafe's Jev model (typesafe.ai), which answers it. The server doesn't store the text. It keeps your anonymous ID, your subscription status from Google Play, how many credits you've used this period, and a record of each request's feature, size and time. For sponsor skipping and topic chapters it also keeps, per episode, the segment times, scores and a fingerprint of the transcript that can't be turned back into text, shared between subscribers who listen to the same episode, plus a scrambled code for the subscription that paid for it. Errors on Bound's server go to Rodmonster LLC's crash reporting server without the text you sent, your device's access token or your IP address. Like any website, Cloudflare sees your IP address when the app connects; Bound's server uses it only to limit how many new IDs one network can create.

Voice commands use your device's speech recognizer (usually Google's) to turn your voice into text; Bound never records audio itself, and only the text reaches Bound. What the recognizer does with your voice is covered by its maker's privacy policy. Podcast and book audio is transcribed on your phone by a speech model Bound downloads from Google Play.

On phones with enough memory, subscribers also get an AI model (Google's Gemma, about 2.6 GB) downloaded from Hugging Face (huggingface.co), over Wi-Fi unless you allow mobile data. It writes recaps, answers and suggestion reasons on your phone, and what it reads and writes never leaves your phone. The download sends nothing about you beyond what any download does, like your IP address. Turning off On-device model in Settings › Bound AI deletes it.

Turning off Use Bound AI features in Settings › Bound AI stops every feature, including the ones that run in the background, without cancelling your subscription.

Purchases

Purchases and subscriptions are handled by Google Play. For Bound AI, the app gives Google Play your anonymous ID, and Bound's server receives the purchase token from your device and asks Google Play whether the subscription is active, when it renews and whether it's a trial. Rodmonster LLC never receives your payment details, name or email address. Google's privacy policy covers what Google Play collects. You can cancel any time in Google Play.

Crash reports

When Bound (on your phone or watch) crashes or hits an error or warning, it sends a report to a crash reporting server operated by Rodmonster LLC (self-hosted GlitchTip, not shared with anyone). A report contains the error, the app's own recent log lines, how the app last closed, recent screens and app events, the app version, device model and Android version, and a scrambled code for your server address that can't be turned back into it. Bound also sends timings for a small sample of screen loads. Web and server addresses, e-mail addresses, passwords, tokens and keys are removed before anything is sent, and reports contain no book contents, account names or listening history. Each report carries a random ID created for this installation, so reports from one install can be counted together; it isn't linked to your name or any account.

Crash reports are on until you turn them off in Settings › About & Diagnostics › Privacy › Send crash reports; the watch follows the phone's choice. If you use Report a problem in Help & Feedback, what you write is sent the same way, with the same removals, along with the app's recent log lines unless you untick "Attach recent app activity". This happens only when you send a report, even with crash reports off.

Usage analytics

Bound (on your phone and watch) uses Google Firebase Analytics to count which screens are opened, which errors happen (the error's tag and type, and its message with web and server addresses, e-mail addresses, passwords, tokens and keys removed). Firebase creates a random app-instance ID for this installation so events from one install can be counted together. Bound sets no user ID, and events contain no book contents, account names or listening history. The Firebase library also lets Google read your device's advertising ID with these events; Bound doesn't use it for ads.

Analytics is on until you turn it off in Settings › About & Diagnostics › Privacy › Anonymous App Analytics; the watch follows the phone's choice.

Updates and Google Play

To tell you when an update is available, the phone app checks update settings from Google Firebase Remote Config and Google Play's in-app updates when you open it. This happens even with analytics off, and sends Google the app's version and Firebase's ID for the installation. Bound can also show Google Play's in-app review prompt.

With Google Play Engage Recommendations on (it's on unless you turn it off in Settings › Library & Display), the phone shares the titles, authors, narrators, descriptions, lengths and progress of the books in Continue Listening and your recent books with Google Play on your phone, so Google can show them on its surfaces. Turning it off, or signing out, removes them.

On your device

Your library, downloads, bookmarks, progress and settings are stored on your device. On the phone, only your display and playback preferences are included in Android backup and device-to-device transfer; your sign-ins, Bound AI ID, library data and downloads are not. Nothing on the watch is backed up.

Bound asks only for permission to show notifications (for playback and downloads). It doesn't ask for your microphone, location, contacts or health data.

No ads

Bound shows no ads. We don't sell your data or use it for advertising.

Deleting your data

Signing out of a server deletes that account's data from your device, including downloads, and removes its books from Google Play Engage. Uninstalling Bound removes everything it stored on that device. To stop paying, cancel Bound AI in Google Play. To delete your anonymous Bound AI record on Bound's server, email us and include your Google Play order number. Crash reports are kept on Rodmonster LLC's crash reporting server for troubleshooting, and Google keeps analytics events according to Firebase's retention settings.

Children

Bound is not directed to children under 13, and we don't knowingly collect data from them.

Google Play Data safety summary

• Data collected: crash logs and diagnostics (optional; can be turned off in Settings); app interactions and device or other IDs for analytics (optional; can be turned off in Settings); the text of a Report a problem note (only when you send one); and, only for Bound AI subscribers, the text each AI feature needs, library searches and purchase history (subscription status).
• Data shared with third parties: not sold or used for advertising. Google (Firebase Analytics), Cloudflare and TypeSafe process data for Rodmonster LLC.
• Encrypted in transit: yes. Everything sent to Rodmonster LLC, Google and TypeSafe uses HTTPS. Your own server uses HTTPS unless you enter an http:// address.
• Data deletion: signing out or uninstalling removes your data from the device; you can turn crash reporting and analytics off at any time in Settings; email us to delete your Bound AI record.

Changes

If this policy changes, we'll update this page and the date at the top.

Questions? Email [email protected].