BookletMaker

Privacy

Last updated: 22 October 2026

BookletMaker is designed around the principle that your documents are yours and should never leave your devices. This page describes exactly what data the app touches and what it does with it.

Data we don't collect

What runs on your device

All imposition, OCR, find & replace, annotation, and export operations are performed locally using Apple's PDFKit, Vision, and Core Graphics frameworks. Output PDFs and exported images stay in the location you choose via the system file picker.

Saved presets

Print-setting presets you save in BookletMaker (My Presets) are stored only on your device, in BookletMaker’s application data. They are not sent to us and are not synced through iCloud. A preset holds print settings and the name you give it, never document content.

Recent setups (the print settings of the last files you printed or exported, offered again for the next one) keep each file’s name and its pattern, such as “Bulletin *.pdf”, only on your device; they are never sent to us or synced.

Crash logs

If you opt in to share diagnostics with Apple via Settings → Privacy & Security, Apple may collect crash reports for BookletMaker like any other app. Mobile Alchemy receives these reports anonymized via App Store Connect to fix bugs.

If BookletMaker crashes, the Mac, iPhone and iPad apps also send a crash report to our own server (api.bookletmaker.app) using Apple’s MetricKit, at most once a day. A report contains the app version and build, the system version, the type of device (Mac, iPhone or iPad) and its processor, the technical kind of crash (exception type, signal and termination reason), and the call stacks at the moment of the crash: only the names of the program libraries, their build IDs and the positions inside them, which is what we need to find the faulty code. If the crash was caused by a system exception, the report also holds the exception’s name and its message template, with file paths, web addresses, e-mail addresses and long numbers removed. A crash report contains no personal data, no document contents or file names, nothing you typed, no install ID, and no device name or model. Your IP address is not stored with it (only a one-way hash of the connection address is kept for up to 24 hours, solely to limit abuse). The report itself is deleted automatically after 13 months; deleted data can stay in our host’s backups for up to 30 days. It is not linked to you or your Apple Account, is never used for advertising and is never shared with anyone. It follows the setting for anonymous usage data: no crash report is sent before you have answered the app’s question about it (see “Anonymous usage data” below), and none is sent if you choose Don’t Share or turn off Settings → Privacy → Share Anonymous Usage Data.

Anonymous usage data

To learn what people make with BookletMaker and where they get stuck, the Mac, iPhone and iPad apps send a small number of anonymous events to our own server (api.bookletmaker.app). An event records, for example, that a PDF was opened, or that a booklet was printed or exported, together with the layout, paper size and page-count range used (for example “9–16 pages”), which tools were used, which template was previewed or used (its ID in the public template catalog), whether opening it succeeded, whether BookletMaker Pro is active, the type of error if something went wrong, and the answer if you choose to tell us what you’re making. Each event also carries a random install ID created on your device, a random ID for the current launch of the app, the platform (Mac, iPhone or iPad), the app version and build number, the system version, and the app language and your device’s region; our server adds the country, derived from the connection, and does not store your IP address with the events. Events never include the contents or names of your files, or anything you type. They are not linked to your Apple Account, are never used for advertising and are never shared with anyone. You can change this at any time in Settings → Privacy → Share Anonymous Usage Data. Events are deleted automatically after 13 months; deleted data can stay in our host’s backups for up to 30 days.

The app asks before it sends any of this. The first time you open BookletMaker, and once after updating to the version that brings this question, it asks “Share Anonymous Usage Data?”. Until you answer, the events stay on your device and nothing is sent. If you choose Share, the events kept until then are sent and the Share Anonymous Usage Data switch is on. If you choose Don’t Share, they are deleted, nothing is sent and the switch is off. If you had already turned the switch off, it stays off and the app does not ask.

On iPhone and iPad, the app also uses Apple’s ad attribution to choose the booklet layout it starts on. When you first start the app and choose Share, unless a link has already chosen a layout, it sends Apple’s anonymous attribution token (it names no person or device) to our server, without the install ID; if Apple has no answer yet, the app tries again later, for up to 24 hours after that first try. Our server passes the token to Apple, which says whether BookletMaker was installed from an Apple Search Ads ad. If it was, our server reads only the campaign, ad group and keyword IDs of that ad, turns them into one word for the starting layout (for example church or zine) and answers with that word alone. The token and the campaign details are not stored or logged: they are dropped as soon as the server has answered. The app keeps the word on your device and records one anonymous event, install_intent, with how that start was chosen (an ad, a link, a custom App Store page or none) and the layout word, both from a fixed list. None of this is used to track you across other companies’ apps and websites, so no tracking permission is needed. The Share Anonymous Usage Data switch covers our own usage data, crash reports and this step: with it off, the token is not sent, and if you choose Don’t Share when the app asks, this step never happens, even if you turn the switch on later. It does not cover Adapty, the purchase service described under “Third-party services” below, which works the same whether the switch is on or off.

When you edit a template or use My Templates, the same rules apply. The events record only the kind of edit (template_text, template_style, template_photo, template_color, template_hide, template_delete, template_move, template_resize, template_add, template_layer, template_duplicate, template_recolor_art, template_page; once per document), what was done to one of your saved templates and whether it worked (my_template: save, save as, duplicate, rename, delete or use; ok, Pro screen shown or failed). They never include a template’s name, the text you typed, your photos or any file name.

Seasonal content

For seasonal events such as Christmas cards, the apps check bookletmaker.app every few hours for a small public file that describes the current event (its dates, a short message and an optional sample PDF). This is a plain download: nothing about you or your documents is sent.

Templates

The apps download a small public catalog of the available templates from bookletmaker.app every few hours and whenever you open Templates, followed by the files of the templates you look at or use (their PDFs, thumbnails and fonts). With each of these downloads the app sends its name, version and build number, the platform and type of device (Mac, iPhone or iPad), the system version, the app language and your device’s region, the catalog format it reads, and whether BookletMaker Pro is active. It contains no ID of any kind, no device name or model, and nothing about you or your documents. We use it only to decide whether templates are available for your version and to serve the right files. It is not linked to you, and it is separate from the anonymous usage data above, so turning that off does not stop it.

My Templates

Editing a template changes only your own copy. Saving your own templates (a BookletMaker Pro feature) stores them on your device, in BookletMaker’s application data. They are not sent to us and are not synced through iCloud or any other service, so they do not appear on your other devices. A saved template holds its design, the text you typed and any photos you put in it. Photos stay on your device and are never sent to us; their location and other metadata are removed when you add them. Deleting a template removes it from this device. Templates may be part of your own device backup, which is controlled by you and Apple, not by us.

Third-party services

BookletMaker shows no ads and uses no advertising network. In-app purchases go through Apple’s StoreKit. Apart from Apple, we use three service providers: Adapty, Stripe and Cloudflare.

Adapty runs the upgrade screen and records in-app purchases, so we can see which plans people choose and which ads lead to a purchase. Its SDK starts only when the upgrade screen opens, and it does not follow the Share Anonymous Usage Data switch. Once started, it sends Adapty: Apple’s attribution token, from which Adapty records the Apple Ads campaign and keyword if BookletMaker was installed from an ad; the identifier Apple gives our apps on your device (on a Mac, the Mac’s hardware UUID), with the device model, system version, language and region, time zone, screen size and the time the app was installed; your public IP address, which the SDK looks up through api.ipify.org and Adapty stores, and which shows roughly where you are; app opens and views of the upgrade screen; and your purchases and subscriptions. Adapty keeps all of this on a profile tied to that identifier. It never receives your documents, their file names or anything you type, and none of it is used to track you across other companies’ apps and websites. See Adapty’s privacy policy.

Stripe processes payments for Pro bought on this website, as described under “Purchases on this website” below.

Cloudflare hosts bookletmaker.app and our server, api.bookletmaker.app. Everything the apps send us passes through Cloudflare, and what we keep, as described on this page, is stored on Cloudflare’s servers on our behalf. Like any host, Cloudflare receives the IP address of each connection in order to deliver it. See Cloudflare’s privacy policy.

Purchases on this website

Pro bought at bookletmaker.app/buy (for the Windows and Android apps and the web tool) is paid on a page hosted by Stripe, our payment processor. Stripe receives your name, email address, billing address, payment details and the location used to calculate tax, and handles them under its own privacy policy; we never see your full card number. From Stripe we receive and keep only what is needed to issue and support your licence: the plan, the payment and subscription status, your email address and Stripe’s customer reference. Your documents are never part of this. When you buy Pro, manage your subscription or recover a lost key on this website, our server keeps your IP address (and, for a lost key, the email address you enter) for up to a day, solely to limit abuse. Purchases made in the App Store go through Apple and are not affected.

Children's privacy

BookletMaker is not directed at children under 13 and does not knowingly collect personal data from anyone, including children.

Contact

Questions or concerns: [email protected]