Landfall is made by NextBase LLC, 30 N Gould St Ste N, Sheridan, WY 82801.
Effective September 2, 2026 · Contact: verma.arun@gmail.com
Landfall is local-first. Its free reading, library, and note features do not
require a Landfall login. Optional cloud features are described below.
What the Premium service retains
Landfall displays no advertising. Premium does not create a separate username
or password. To verify an App Store purchase, prevent preview
abuse, enforce allowances, and control spend, the service retains pseudonymous
entitlement, installation-attestation, quota, request-status, feature-usage,
and cost-accounting records. Feature-usage records identify the operation and
allowance consumed, not the book, passage, prompt, or conversation content;
they support allowance enforcement, service diagnostics, capacity planning,
and aggregate usage statistics. It does not retain full books, notes, prompts,
transcripts, request-specific narration audio, API keys, or raw Apple transaction
identifiers in operational records. Published Landfall Studio audiobook files are
public catalog assets, not user records.
What stays on your iPhone
Your books, margin notes, bookmarks, listening positions, podcast subscriptions,
downloaded audio, and settings are stored on your device (and in your own iCloud
device backup, under Apple's terms). Spoken notes are transcribed
on-device using Apple's speech recognition. If you explicitly select
Apple On-Device for book and podcast Jam, the supplied passage and conversation
are processed by Apple's Foundation Models on your iPhone and are not sent to
Landfall or OpenAI. Apple Premium narration voices are free system assets that
run on-device after you download one in iPhone Settings. If you choose a published
Landfall Studio audiobook, its public audio files stream from Landfall's content
delivery service or download to your iPhone; those files contain no user data.
What leaves your iPhone, and when
Install and purchase measurement. Landfall uses Meta's iOS SDK to send
an app activation event and limited device/app diagnostic information so we can
measure whether an advertisement led to an install, and two further kinds of
event so we can measure whether it led to a subscriber: when a Premium offer
screen is shown (and which screen showed it), and your original Premium
purchase — a free trial start or a paid subscription — with the plan's product
id, its price and currency, and Apple's StoreKit transaction id for that
purchase. Meta uses these events for analytics and advertising measurement.
Renewals, plan changes, restores, refunds, and Family Sharing purchases are not
sent. Landfall does not send Meta your books, notes, searches, podcasts,
listening activity, prompts, conversations, name, email address, Apple ID, or
other direct identifiers. Apple's App Tracking Transparency prompt controls
access to the advertising identifier and cross-app attribution. If you decline,
Landfall keeps advertiser-ID collection disabled; Apple may still provide
privacy-preserving aggregate campaign measurement. Landfall does not use
Facebook Login.
Your own provider key — only if you add it and use an AI feature.
Starting a Talk conversation streams your voice and the current
passage to OpenAI; converting a book's reading level sends its text; note-tidying
sends the note; and podcast discussion may send a short audio excerpt for
transcription. Personal-key transcription happens directly
between your device and OpenAI under
OpenAI's API terms; we are not in the
middle. Your key is stored in your iPhone's Keychain and is removable in the app
at any time.
Landfall Premium — only when you choose a Premium operation. The text
or audio needed for that operation is sent to Landfall and its AI processor.
This can include a requested passage, conversion paragraphs, narration text,
live-session audio, or a short podcast audio excerpt used to build a time-aligned
transcript on your device. Podcast audio and transcript text are not retained by
Landfall after that request. Live, request-specific narration audio is not retained
after completion; this is separate from the published Studio audiobook catalog.
A completed premium text reply can be stored for up to 24 hours so retrying the
exact request returns the same answer instead of charging twice, then it is
deleted automatically. Short-lived challenge/session records expire, while
pseudonymous quota and cost records are retained for allowance enforcement and
charge reconciliation.
Apple's podcast directory and each show's own RSS feed are fetched
directly to browse and stream episodes.
The daily digest is a public, identical-for-everyone file. Reading it
sends nothing but an ordinary web request.
What we never do
No ads inside Landfall, no selling of data, no sharing with data brokers, and no
advertising fingerprinting. Meta measurement is limited to the activation,
offer-screen, and original-purchase events described above and is never given
reading or conversation content.
Children
Landfall is not directed at children and is rated accordingly on the App Store.
Changes
If this policy changes, the new version will be posted at this address with a
new effective date.