01 Hold as little as we can
The free reader needs no account. Tomelet Sync encrypts your library on your device before it leaves, with keys only your devices can use, so what we store we cannot read.
Trust center
Built so your reading stays yours.
The thinking you do inside your books should stay yours. This page sets out how Tomelet protects it: what our servers can and cannot see, how we build and run the service, who can reach production, and what we do when someone asks us for your data.
The free reader needs no account. Your books and notes stay on your device unless you turn on Tomelet Sync.
Our approach
Four principles behind every decision.
Security at Tomelet starts with holding as little as possible, and every safeguard builds on that.
02 Make it hard to get in
Every code change we make is reviewed independently of its author, the rules that matter are checks that fail the build, and outside code waits a week and is pinned before we use it.
03 Limit the damage
Separate cloud accounts for development, staging and production, narrow permissions for every part of the service, and a token-signing key that never leaves AWS Key Management Service.
04 Find and fix quickly
Alarms on the service, crash reports you can switch off, published response times for security reports, and a permanent test for every bug a reader reports.
What we can see
We store your library. We can’t read it.
Tomelet Sync encrypts your library on your device. To sign you in, keep your changes in order and measure your storage, the service holds a small set of account details.
Encrypted on your device
- Your books and their covers
- Titles, authors and every other book detail
- Highlights, notes and pen ink
- Reading positions and reading history
- Shelves, tags and collections
Visible to our servers
- Your account identifier, e-mail address and subscription status
- Your devices, their platform and app version
- Sign-ins and sign-outs, with IP address
- The sizes, number and timing of your encrypted changes
- Request logs, kept for three months
Encryption
Keys that stay with you.
Your library is encrypted with AES-256-GCM under a vault key made on your first device. Our servers hold that key only sealed: once for each device you approve, and once under a Recovery Key that only you keep.
- You let devices inA new device joins only when one you trust approves it, after you compare a 16-character code on both screens.
- Signing in is separateSigning in proves who you are. Your library opens only on a device you approve or with your Recovery Key.
- A Recovery Key only you holdShown once at setup and kept only by you, so your library opens with your key alone.
- Tampering showsEvery change is authenticated and every sync request is signed by the device that sent it.
How we build it
Safeguards built into every change.
Every change to Tomelet follows a written engineering standard and reaches production only when the responsible team releases it. Every code change we make is reviewed independently of its author, and each safeguard is an automated check that every change must pass.
- Independent reviewEvery code change we make is reviewed independently of its author, most deeply for encryption, sync, sign-in and payments.
- No warningsZero analyzer and compiler warnings, and secret checks on every commit that the build repeats.
- Outside code waitsA new dependency must be a week old, pinned to an exact version and recorded before we use it.
- Bugs stay fixedA reported bug gets a failing test before its fix, and the test stays in the suite for good.
How we run it
Narrow access by design.
The sync service runs on Amazon Web Services in the United States, with development, staging and production in separate accounts. Only the responsible team can release to production, and a sync service release must pass on staging before it reaches production.
- Encrypted in transitTLS 1.2 or newer, strict transport security, and storage that refuses unencrypted requests.
- Short-lived accessOne-hour sign-in tokens, refresh tokens that rotate on every use, and 15-minute links for file transfers.
- Read-only diagnosisProblems are investigated through a role that can’t change anything or use our keys, preferring counts to records.
- Logs that expireLogs leave out request bodies, tokens and ciphertext. Service logs last three months, the security log up to a year.
Open to independent review
We publish how Tomelet works in detail and invite the security community to examine it.
The design is public
The security white paper sets out the encryption, the keys, device approval and what our servers see, so anyone can examine the design.
Every change is reviewed
Every code change we make passes an independent review and the required automated checks before it can be released.
Researchers are welcome
Anyone can report a finding under a safe-harbour policy with published response times, and every valid report is credited.
When someone asks for your data
TOMELET PTE. LTD. is a Singapore company. Since 4 October 2026 it has followed a written procedure for requests for user data from public authorities.
One team answers
Every request goes to the team responsible for legal requests, which checks who sent it, its legal basis and that it binds a Singapore company, with legal advice where needed.
We push back
A request that is unlawful, too broad or unclear is challenged, and the authority is asked to narrow or withdraw it before anything is provided.
The minimum, and you’re told
We disclose only what the law requires, and tell the reader concerned beforehand unless the law forbids it.
Everything is recorded
Each request, decision and disclosure is recorded and kept for at least five years, and the procedure is reviewed every year.
Anything we could be required to provide is limited to what we hold: account details and the metadata listed above. Your library’s contents stay encrypted with keys only your devices can use.
Report a flaw
Found something? Tell us first.
Write to [email protected], and please keep the details private until we’ve shipped a fix. You don’t need a working exploit; a precise description is enough.
- Acknowledged in 3 working daysAnd assessed within 10, with the severity and whether we could reproduce it.
- Fixed within 90 daysOr a documented mitigation. Critical issues are handled at once.
- Safe harbourGood-faith research that stays in scope and uses your own accounts is protected.
- Credit, your wayUnder the name you choose, or none, when we publish what changed.
Who processes data
The services we rely on.
Only AWS stores your synced library, and only as ciphertext. This summarises the Privacy Policy, which is the authoritative list and says where each one processes data.
| Service | What it does for Tomelet | What it receives |
|---|---|---|
| Amazon Web Services | Runs the sync service and stores your encrypted library. | Encrypted data, account and device records, and logs. |
| Cloudflare | Serves this website and the browser app, counts page visits without cookies, and routes e-mails you send to our addresses. | Page requests; visits counted by country and browser; e-mails you send us. |
| Mailgun | Sends sign-in codes and account-deletion notices. | Your e-mail address. |
| Google (Gmail) | Holds the mailbox for e-mails you send to our addresses. | Your message and e-mail address. |
| Sentry | Collects crash and error reports. | Scrubbed reports; IP addresses are not stored. |
| RevenueCat | Manages subscriptions across stores. | The product, dates and status of your purchase. |
| Paddle | Sells web subscriptions as merchant of record. | What you give it at checkout. |
| Google Play, Apple App Store | Take payment for subscriptions bought in their stores. | Their own purchase records. |
| Google AdMob | Shows ads in the free Android, iPhone and iPad apps. | Advertising identifiers, approximate location and ad interactions. |
| Google and Apple push services | Wake your devices to sync. | A push token and a message with no content. |
| Google, Apple, Meta | Sign-in, when you choose it. | That you signed in. On phones and tablets, Facebook’s software also contacts Meta when the app starts. |
| Open Library | Looks up book details; you can turn this off. | A book’s ISBN, or its title and first author. |
Documents
Go deeper.
The documents behind this page.
FAQ
Questions & answers
Can Tomelet read my books or notes?
No. Tomelet Sync encrypts them on your device with a key only your devices can use. Our servers store ciphertext and the metadata listed above, such as sizes and timing, but not the contents.
Do I need an account to use Tomelet?
No. The free reader works without one, and your books and notes stay on your device. An account is needed only for Tomelet Sync.
What would an attacker get if they broke into your servers?
Encrypted data they can’t open, and account metadata such as e-mail addresses, device records and logs. Your library’s contents stay protected by keys our servers never hold in readable form.
Who at Tomelet can see my data?
No one can see the contents of your synced library. When a problem needs diagnosing, account metadata can be read through a read-only role, under a standing rule to read the minimum and never copy it anywhere.
How can I check Tomelet’s security for myself?
Our security white paper sets out the full design, from the encryption to what our servers can see, and our engineering white paper explains how Tomelet is built and run. Security researchers can report findings to [email protected] under our vulnerability disclosure policy.
What if I lose my Recovery Key?
While you still have a signed-in device, you can approve new devices without it. The Recovery Key is the one key that restores your library without another device, and Tomelet never holds a copy, so keep it somewhere safe. The copies already on your devices stay put.