XReader is a local-first Android app for personal DRM-free libraries.

For now, report security issues privately to the repository owner through GitHub. Do not open a public issue for a vulnerability that exposes private user data or imported book contents.

• Imported books are copied into app-owned private storage.
• Reading state, annotations, analytics, search indexes, and dictionary data are stored locally.
• The app does not request broad all-files access.
• Network access occurs for user-requested direct book/OPDS URLs and neural-model downloads; external dictionary/share actions can open another app. XReader has no account sync, background telemetry, or automatic network scan.
• Android backup is disabled in the manifest.
• User-created .xreader-backup archives exclude imported books/audio, covers, generated audio, neural models, private file paths, and checksum inventories intended for display. Backup v2 bounds compressed/uncompressed/section sizes and entry counts, rejects unsafe or undeclared ZIP paths, and validates per-section size/count/SHA-256 before restore.
• Separate legacy JSON imports also enforce the 64 MiB section input limit. Restore attempts are serialized; failed rollback retains its recovery journal, and an unavailable migration fails without deleting the database.
• Backup v2 detects corruption and supports crash recovery across Room and DataStore. It is not encrypted and does not provide confidentiality or cryptographic authenticity; store exported backups accordingly.
• ACSM files are treated as Adobe license instructions and can only be handed to an external authorized app. XReader does not implement DRM removal, loan fulfillment, or library-card credential storage.

Do not commit:

• imported commercial books
• screenshots with copyrighted book text
• commercial cover-art screenshots
• keystores
• signing passwords
• local Android SDK configuration