Account and local data

The library on this device, and reinstalling the app

Free import does not create a cloud account: imported content, favorites and review progress are stored on this device. When you import or read again, old notes that the source no longer lists are not deleted. Signing out of or deleting the cloud account is not a way to clear the device library. If a subscriber has turned on iCloud sync, the library is also stored in your own iCloud, and other devices signed in to the same Apple Account can get it back.

“My thoughts” are kept in an encrypted vault on this device and are not included in device backups. Removing the app deletes the library and your thoughts on this device; if iCloud sync is off and you have not saved a “Thoughts backup”, your thoughts cannot be recovered. Signing out of or deleting the Wi-Fi cloud account does not remove thoughts, tags or collections from this device; they are not written back to the eReader or uploaded to LeafTrove servers. A “Thoughts backup” file is not encrypted, so keep it somewhere you trust.

To remove the app and its local data, first save the files you need and turn off LeafTrove widgets and daily reminders. Then, in iOS, open Settings → General → iPhone Storage (or iPad Storage) → LeafTrove and choose “Delete App”. “Offload App” keeps documents and data, and removing the icon from the Home Screen is not the same as deleting the app. See Apple’s guide to iPhone and iPad storage.

Before reinstalling, do not expect LeafTrove’s servers to restore the library. Without iCloud sync, read the Kobo by cable again when you need to, or import the export files you kept. System backups and restores are managed by Apple; JSON or Markdown files you saved, original backups on a computer and content on other devices have to be managed where they are. Deleting the app does not delete the LeafTrove cloud account or cancel a subscription.

Signing out of the cloud account only

Open Settings → “Wi-Fi wireless updates” (LeafTrove 1.3.1: “Wi‑Fi cloud account (optional)”) → “Account, sign out and deletion” → “Sign out”. The app clears that account’s cloud cache and credentials on the current device. Synced cloud content and the Kobo link are kept, and after you sign in to the same account again you can get back the cloud content that has not been deleted. “My Library”, favorites and review progress on this device are not affected.

If the network or the storage cleanup fails, retry as the app tells you. Do not take “The local screen has been cleared” to mean that every sign-out step has finished.

Deleting the cloud account

1. Open Settings → “Wi-Fi wireless updates” (LeafTrove 1.3.1: “Wi‑Fi cloud account (optional)”) → “Account, sign out and deletion”, and choose “Delete account and cloud data”.
2. Read what will be deleted, export the data you need first, then tap “Delete account permanently”.
3. In the confirmation, choose “Verify and delete” and verify with Face ID, Touch ID or the device passcode. The request is sent only after verification succeeds.
4. Check the status of the request in the app and keep the request identifier. If it shows as unconfirmed or the cleanup failed, stay online and update the status; the app reuses the request it has saved.

The system verification does not give your biometrics or device passcode to LeafTrove. Once the request is accepted, the account’s queryable cloud book list, highlights, notes, preferences, sync content and device authorizations are removed through the deletion process. Revoking the Sign in with Apple authorization continues on the server and is retried if it fails; there is no guaranteed completion time. The same account cannot be created again until processing is complete.

This device clears that cloud account’s data; other signed-in devices clear it after their next online verification, and offline devices are not cleared remotely right away. The original e-books, highlights and notes on the Kobo, “My Library” on this device and files you exported are not removed remotely by this cloud account deletion.

Do not delete the app while the result is unconfirmed. If you close the app, an accepted deletion continues on the server; open the app again to update the status. If it says “The deletion receipt can no longer be looked up”, a missing receipt does not confirm that the deletion finished; contact support with the request identifier.

Deleting only one archived cloud source

Unlinking a Kobo only archives its source, and the content still counts toward cloud storage; the 30-day protection period is not a countdown to automatic deletion. If you no longer need it, open “Account, sign out and deletion” → “Data & Storage”, choose the archived source and confirm permanent deletion. This removes the source’s queryable book list, notes, preferences and related change content. It does not delete the original content on the Kobo or “My Library” on this device, and the minimum technical records that are required are kept for their own periods. After a subscription ends you can still manage and explicitly delete archived data.

How deletion is processed, and what is kept

While a deletion is processed, the account identifier and encrypted authorization needed to complete the Apple revocation are kept; they are removed once revocation is complete. The completion receipt contains no reading content. It keeps the request identifier, a receipt hash, the status and the time, and is cleaned up by a scheduled job after 30 days. A hashed barrier that stops an old sign-in from recreating the account is kept for about 24 hours.

Cloudflare D1 disaster-recovery history may remain for 7 or 30 days depending on the plan, and cannot be cleared immediately by a deletion in the app. Export files and system backups that you keep have to be managed separately. Full details are in the privacy policy.

Cancelling an Apple subscription is a separate step

Signing out, deleting the LeafTrove account or deleting the app does not cancel an Apple subscription. Manage it in iOS under Settings → your name → Subscriptions → LeafTrove, and check the cancellation or expiry status Apple shows. If you do not want a trial to renew, Apple recommends cancelling at least 24 hours before the trial ends. See Apple’s guide to cancelling a subscription.

The pre-1.2 entitlements preserved on eligible devices still apply. When a subscription ends, iCloud sync, Wi-Fi wireless updates, Schedule for review, multiple reminders and medium or larger widgets stop; imported content can still be read, searched and exported. Free import and the sample library stay free, and cloud content is not deleted automatically when a subscription ends. Lock Screen widgets stop too, and note tags can no longer be added or changed; existing tags stay visible and searchable.

Subscription purchases and optional cloud linking

Buying, restoring and using on-device subscription features do not require a LeafTrove account. The App Store handles payment; LeafTrove uses Apple-verified transactions to check the product, validity, refunds and revocation. Signing in and linking an account are needed only if you choose LeafTrove’s personal Wi-Fi cloud service.

Before a purchase while signed out, LeafTrove servers generate a random purchase-proof identifier and linking secret. The server stores only the identifier, a hash of the secret and the creation time. This does not create a user account or require a name or email address. The full secret is kept in the system Keychain; if you have enabled iCloud Keychain, Apple may sync these proofs between your devices. They are not included in your library, thoughts backups, exports or diagnostic records.

Only when you later choose to link Wi-Fi cloud access does the app send your LeafTrove account, purchase proof and Apple-signed transaction to the server for verification. Restoring a purchase does not automatically transfer a subscription already linked to another account. Missing linking proof does not affect on-device subscription access confirmed by Apple.

Minimal purchase-proof records not yet linked to an account have no fixed automatic expiry: issuing a proof alone does not tell the server whether a purchase was cancelled or paid for without a later cloud link. These identifiers and hashes contain no name, email address or reading content and are retained for a later voluntary link and to prevent conflicting ownership; the full secret and transaction text are not stored. Linked records follow account deletion. To exercise your data rights, contact us as described in section 6. Apple’s own payment and transaction records follow Apple’s policies.