Kithara
Legal

Privacy Policy

Kithara has no accounts, no analytics and no telemetry. It talks to the servers you add, and nothing else apart from a one-time speech model download if you use transcripts. This page explains what that means in practice, and what this website collects.

Last updated: 10 September 2026

This Privacy Policy explains how Charitou Multimedia Solutions Inc., a company incorporated in Ontario, Canada ("we", "us"), handles information in relation to the Kithara Android application (the "App") and this website (the "Site"). We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply to you, the GDPR, the UK GDPR and comparable laws. Where we act as a data controller, it is only for the small amount of data described in section 7.

1. The short version

  • The App has no account system, no analytics and no telemetry, and shows no advertising.
  • The App does not send us anything. Its network traffic is to servers you add yourself, plus a one-time download of a speech model if you turn on transcripts.
  • Your audiobooks, listening positions, statistics and transcripts stay on your device, and on your own server if you connect one.
  • The only personal data we hold is what you send us through the contact form or by email.

2. Data in the app

The App stores the following on your device so that it can work. None of it is transmitted to us.

  • Your library: file paths, titles, authors, covers, durations and chapter lists read from the audio files you point it at.
  • Listening data: your position in each book, bookmarks, listening statistics measured from time spent actually playing, and achievements.
  • Transcripts: text generated from chapters you choose to transcribe (see section 4), plus the downloaded speech model.
  • Pro status: whether Kithara Pro is owned, cached from Google Play so Pro keeps working offline.
  • Server credentials: if you connect a server, your password is exchanged for an access token at sign-in and then discarded. Only the token and the server address are stored.
  • Downloads: books you choose to pin for offline use are stored in the App's private storage.

This data is included in Android's standard app backup if you have backup enabled on your device, which is governed by Google's policies, not ours. Uninstalling the App removes all of it from your device.

3. Servers you connect to

You can connect the App to an Audiobookshelf server, or to a server implementing the Kithara sync protocol. When you do, the App sends that server your credentials at sign-in, and afterwards your listening positions and library requests, so that your progress stays in step across devices.

That server is operated by you or by whoever you got the login from, not by us. We have no access to it and no visibility of what it holds. How it handles your data is governed by its operator and, for Audiobookshelf, by that project's own documentation.

4. Transcripts

Kithara Pro can turn a chapter into timed text so you can read along or search a book. Transcription runs entirely on your device. No audio, text or metadata is uploaded anywhere, and transcripts are stored only on the device alongside your other listening data.

Speech models are not bundled with the App because of their size (roughly 100 MB to 360 MB). The first time you use transcripts, the App downloads the Whisper model you choose from a public mirror maintained by the sherpa-onnx project on Hugging Face (huggingface.co), and a small voice-activity model from the same project's releases on GitHub (github.com). Those downloads are ordinary HTTPS requests and, like any web request, expose your IP address and the file requested to Hugging Face and GitHub under their own privacy policies. Nothing about you, your books or your listening is included. Once downloaded, the model stays on the device and no further requests are made.

5. Google Play

The App is distributed through Google Play, and Kithara Pro is sold as a one-time in-app purchase processed by Google Play Billing. Google collects information about your download, purchases and device under Google's privacy policy. We receive purchase confirmations, and Google may share aggregated, anonymised crash and installation statistics with us through the Play Console. We never receive your payment details.

6. Android permissions

The App requests only what it needs to play audio:

  • Notifications: for playback controls and for download and transcription progress. Playback works without it.
  • Foreground service: so playback, downloads and transcription keep running when the App is not on screen.
  • Wake lock: to keep audio playing with the screen off.
  • Internet and network state: for the connections described above, and to honour a Wi-Fi-only preference. Nothing else uses them.
  • Run at startup: to resume interrupted downloads after a reboot. The App does not otherwise start itself.
  • Folder access: only for folders you explicitly pick through Android's file picker. The App never asks for broad storage access.

The App does not request access to your location, contacts, camera, microphone or other apps. The App does not use the telephony permission; it detects interruptions such as calls through audio focus instead.

7. This website

The Site is the one place we collect personal data:

  • Contact messages: your name, email address, chosen topic and message when you use the contact form or email us. We use these to reply to you and to refer back to previous support conversations. Legal basis: our legitimate interest in responding to enquiries.
  • Launch notifications: if you leave your email address on the "coming soon" form, we store it so we can send you one message when the App is released on Google Play. We do not use it for anything else, and we delete the list within 30 days of sending that message. Legal basis: your consent, which you can withdraw at any time by emailing us.
  • Server logs: our hosting provider records the IP address, browser and pages requested for each visit, for security and debugging. Legal basis: our legitimate interest in keeping the Site secure.

We use a hosting provider and an email delivery provider to run the Site and the contact form. They process this data on our behalf under contract, and their servers may be located outside Canada, including in the United States and the European Union. Data held there is subject to the laws of that country and may be accessible to its authorities. We do not sell personal data and do not share it with anyone else, except where required by law.

8. How long we keep it

  • Contact messages: up to 2 years, so we can refer back to previous support conversations.
  • Launch notification emails: until 30 days after the release announcement is sent.
  • Server logs: up to 90 days.
  • App data: on your device until you delete it or uninstall the App. Transcripts and speech models can be deleted individually from within the App. We hold none of it.

9. Your rights

You have the right to ask what personal data we hold about you, to have it corrected, and to withdraw consent or ask for it to be deleted. Depending on where you live you may also have the right to receive a copy in a portable format, to object to or restrict certain processing, and to complain to a privacy regulator: in Canada, the Office of the Privacy Commissioner of Canada; in the UK, the Information Commissioner's Office; in the EU, your national supervisory authority.

In practice, the only data we hold is contact correspondence. Email support@kithara-app.com and we will respond within 30 days. We may ask you to verify your identity first.

California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we do not discriminate against you for exercising your rights.

10. Children

The App and Site are not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, contact us and we will delete it.

11. Security

The Site is served over TLS, and the contact form is protected against automated abuse. Data on your device is protected by Android's app sandbox. If you connect a server, use a strong, unique password for it and prefer an https address when connecting over the internet rather than a home network.

12. Cookies

The Site uses only strictly necessary cookies: a session cookie and a CSRF token that protect the contact form. We do not use advertising or tracking cookies, so no consent banner is required. The App uses no cookies.

13. Changes to this policy

We may update this policy from time to time. We will post the new version here and update the "last updated" date at the top.

14. Contact us

Privacy questions or requests: support@kithara-app.com, or use the contact form.

Charitou Multimedia Solutions Inc.
29 Longwood Avenue, Richmond Hill, Canada