BookBook Privacy Policy

Effective date: July 13, 2026 Last updated: July 13, 2026

This Privacy Policy explains how BookBook ("we", "us", "our") collects, uses, shares, and protects information when you use the BookBook application and related services (the "App" or "Service"). It applies to the BookBook web app and to the planned BookBook iOS and Android apps.

BookBook is a personal book-library app. You photograph your bookshelf, BookBook reads the book spines and matches them against book databases, and you catalog, rate, and review your books, connect with Friends, and lend or borrow books.

Please also read our Terms of Service and our Account & Data Deletion page, which work together with this Policy.

Who we are and how to contact us
Summary
Personal Data and Content we collect
How we use your information and our legal bases
Camera and photo library; on-device text recognition (OCR)
Sign in with Google and Google user data
Third parties and subprocessors
Sharing and visibility inside BookBook
No sale of data; no behavioral advertising; no tracking SDKs
International data transfers
Data retention
Security
Your privacy rights
Account and data deletion
Children and minimum age
Cookies and local device storage
Changes to this Policy
Contact us

1. Who we are and how to contact us

BookBook is an independently developed book-library app and website ("BookBook", "we", "us", "our"). BookBook is not yet incorporated as a company; the Service is operated by an independent developer, who acts as the data controller for the purposes of the EU and UK General Data Protection Regulation (GDPR).

Privacy and support contact: moltenorobin@gmail.com

If you have any questions about this Policy or how we handle your information, contact us at moltenorobin@gmail.com.

2. Summary

We collect the information you give us to run your Account and library: your email and password or your Google sign-in details, your display name, an optional profile picture, your birthdate, and the books, ratings, reviews, shelves, Friends, and Lending Records you create.
Photographs you take or choose are used to scan bookshelves, to save book covers and spines, and to set an avatar. Text recognition (OCR) that reads spine and cover text runs on your device / in your browser. Raw photos are not sent to third parties for OCR.
We use a small number of third parties: a hosting/database and storage provider that stores your Account and Content, Google (for "Sign in with Google"), and the Google Books and Open Library book databases (which receive only text search queries such as an ISBN, title, or author — never your Account data or your photos).
We do not sell your Personal Data and we do not share it for cross-context behavioral advertising. The App currently contains no third-party analytics, advertising, or tracking SDKs.
You can delete your Account and associated Content from inside the App, and you can also request deletion through our web page at https://bookbookbookbookbook.com/delete-account.

3. Personal Data and Content we collect

We collect the following categories of "Personal Data" (information that identifies or relates to you) and "Content" (the book and library data you create).

3.1 Account identity

Email and password, if you register with email; or, if you use "Sign in with Google", your name, email address, and Google profile picture provided by Google (see Section 6).
Your chosen display name.
An optional profile picture / avatar that you upload.

3.2 Birthdate and age

Your birthdate, which we collect for age verification and to gate access to mature-content books. We use this to confirm you meet our minimum age and to determine whether you may view mature titles. See Section 15.

3.3 Book library Content you create

Books you catalog: title, author, ISBN, publisher, year, page count, and language.
Reading status, star ratings (in quarter-star increments from 0.25 to 5), and written reviews and notes (some of which you can mark private).
Your reading-language preferences and your shelves.

3.4 Images

Photos you capture with your camera or choose from your photo library, used to (a) scan bookshelves and read spine text, (b) capture book covers and spines saved to your library, and (c) set your avatar.
Cover and spine images you choose to keep are stored in your Account. See Section 5 for details on how these images are processed and on on-device OCR.

Friend connections (friend requests, acceptances, and your list of accepted Friends).
Lending Records: the owner, borrower, book, status, dates, an optional due date, and borrow-queue position for books you lend or borrow.
Invite / share links you generate to invite a Friend or a borrower.
A borrower's free-text name that you may type in when the borrower is not (yet) a BookBook user. If you enter another person's name, we process it solely to help you track that loan. Please only enter another person's name where you are permitted to do so.

3.6 Technical and local data

Local on-device storage (such as IndexedDB and localStorage) used to keep your data available offline and to remember your session and preferences.
Authentication cookies and tokens, including Google OAuth tokens where you sign in with Google. See Section 16.

We do not intentionally collect special-category / sensitive data beyond what is described above. Please do not put sensitive personal information into free-text fields such as reviews, notes, or borrower names.

4. How we use your information and our legal bases

We use your information for the purposes below. Where the GDPR applies, the relevant Article 6 legal basis is shown in brackets.

Create and operate your Account — authenticate you, keep you signed in, and maintain your profile. [Contract, Art. 6(1)(b)]
Provide the core library features — catalog books, store ratings, reviews, notes, shelves, and reading status, and match your photos and searches to book metadata. [Contract, Art. 6(1)(b)]
Scan bookshelves and read spine/cover text via on-device OCR, and store the cover/spine images you choose to keep. [Contract, Art. 6(1)(b)]
Age verification and mature-content gating using your birthdate. [Legal obligation and/or Legitimate interests, Art. 6(1)(c) / 6(1)(f); we have a legitimate interest in operating an age-appropriate service]
Friends, lending and borrowing — manage friend connections, Lending Records, borrow queues, and invite links. [Contract, Art. 6(1)(b)]
Communicate with you — send service messages such as account, security, and deletion-related notices, and respond to support requests. [Contract and Legitimate interests, Art. 6(1)(b) / 6(1)(f)]
Maintain security and integrity — protect the Service and users against fraud, abuse, and misuse. [Legitimate interests, Art. 6(1)(f)]
Comply with law — meet legal obligations and respond to lawful requests. [Legal obligation, Art. 6(1)(c)]

Where we rely on consent (for example, device permissions for camera and photos), you may withdraw it at any time through your device or App settings; withdrawal does not affect processing carried out before withdrawal. [Consent, Art. 6(1)(a)]

5. Camera and photo library; on-device text recognition (OCR)

BookBook requests access to your camera and photo library only when you use a feature that needs them — for example, when you start a shelf scan, add a cover photo, or set your avatar. You control these permissions through your device settings.

We use your photos to:

Scan bookshelves. When you scan a shelf, BookBook reads the spine text so it can suggest books to add.
Save book covers and spines you choose to keep to your library.
Set your avatar from a photo you select.

Text recognition (OCR) runs on your device / in your browser. On the web, OCR uses tesseract.js in your browser; on iOS, OCR uses Apple's on-device Vision framework. Your raw photos are not sent to any third party for OCR. The transient frames used only to read a shelf and then discarded are not stored or transmitted off your device.

Images you choose to keep are stored in your Account. Cover images, spine images, and your avatar that you save are uploaded to and stored by our hosting/storage provider (see Section 7) as part of your library. Book cover images displayed in the App may also load from third-party cover databases (see Section 7).

On Android, BookBook uses the Android system photo picker so you can choose specific images without granting broad access to your whole media library. On both platforms we show an in-app explanation before requesting camera or photo access.

If you choose "Sign in with Google", Google provides us with your name, email address, and Google profile picture, and we receive Google OAuth tokens to authenticate you. We use this information only to create and sign you into your Account and to populate your profile.

We request only the basic identity scopes: openid, email, and profile. We do not request access to your Google contacts, Gmail, Drive, or any other Google data.

Limited Use. BookBook's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Google user data only to provide and improve the user-facing sign-in and profile features; we do not sell it; we do not transfer it to third parties except as needed to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you; we do not use it for advertising; and we do not allow humans to read it except with your consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized.

7. Third parties and subprocessors

We share information only as described here. We do not sell your Personal Data.

7.1 Processors (act on our behalf)

Supabase (hosted database, authentication, and file storage). Stores your Account, your Content, and the images you keep, and provides authentication for the native apps. Supabase processes this data on our behalf under our instructions and is not permitted to use it for its own purposes. Our domain name is registered through GoDaddy, which does not receive your Account data or Content.

7.2 Third parties that receive limited data

Google LLC ("Sign in with Google" / OAuth). If you use Google sign-in, Google authenticates you and provides the data described in Section 6. Google's handling of your data is governed by Google's Privacy Policy.
Google Books API and Open Library API. When you search for or match a book, we send only text queries (such as an ISBN, title, or author) to fetch book metadata and cover images. These services do not receive your Account data or your photos.
Book cover CDNs (Open Library, Google Books). Book cover images shown in the App may load from these third-party servers, which necessarily receive the standard technical request information (such as an IP address) needed to deliver an image.

We require third parties that process Personal Data on our behalf to provide protection for your data consistent with this Policy. A current list of subprocessors is available on request at moltenorobin@gmail.com.

Some of your Content is visible to other BookBook users depending on your choices:

Friends. Your non-private books and shelves are visible to Friends whose connection you have accepted.
Lending counterparties. A Lending Record is visible to the other party to that loan (the owner and the borrower).
Private items are never shared. Books, reviews, and notes you mark private are not shown to Friends or counterparties.
Invite links. Anyone who has an invite or share link you generate can use it to connect or accept a loan, so share links only with people you trust.

BookBook does not make your library public to the internet, and it does not sell your data or share it for cross-context behavioral advertising.

9. No sale of data; no behavioral advertising; no tracking SDKs

We do not sell your Personal Data.
We do not share your Personal Data for cross-context behavioral advertising, and we do not display third-party targeted advertising in the App.
The current App contains no third-party analytics, advertising, or tracking software development kits (SDKs), and we do not track you across other apps or websites.

If we ever add such a tool in the future (for example crash reporting or analytics), we will describe it here — including the data it processes and why — and update our app-store data disclosures, before the version that includes it ships.

10. International data transfers

We are based in Germany, and your information is stored by our hosting provider, Supabase. Where our Supabase project is located in the European Union, your Personal Data is stored within the European Economic Area (EEA). If any processing or storage takes place outside the EEA, the United Kingdom, or Switzerland, we rely on an appropriate transfer mechanism such as the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), or another lawful basis. You can request more information about these safeguards at moltenorobin@gmail.com.

11. Data retention

We keep your Personal Data and Content for as long as your Account is active or as needed to provide the Service. When you delete your Account, we delete your Account and associated Content as described in Section 14 and on our Account & Data Deletion page.

We may retain a limited amount of information after deletion where we are required or permitted to do so — for example, to comply with legal obligations, resolve disputes, prevent fraud or abuse, or enforce our agreements. Where a Lending Record involves another user, a record of a completed loan may remain visible to that other user as part of their own history. Any retained data is limited to what is necessary and is deleted or anonymized when no longer needed.

12. Security

We use reasonable technical and organizational measures designed to protect your information, including encryption of data in transit (HTTPS/TLS) between the App and our backend, access controls, and authentication safeguards. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please protect your Account by using a strong, unique password and keeping your credentials confidential.

13. Your privacy rights

Your rights depend on where you live. We honor the rights below regardless of location where we reasonably can.

If you are in the EEA, the UK, or Switzerland, you have the right to:

Access the Personal Data we hold about you;
Rectify inaccurate or incomplete data;
Erase your data ("right to be forgotten");
Restrict or object to certain processing, including processing based on our legitimate interests;
Data portability — receive certain data in a portable, machine-readable format;
Withdraw consent at any time where we rely on consent; and
Lodge a complaint with your local data protection authority.

We will not discriminate against you for exercising these rights. To exercise them, contact moltenorobin@gmail.com. We may need to verify your identity before acting on a request.

13.2 California (CCPA / CPRA) and similar US state laws

If you are a California resident, you have the right to:

Know the categories and specific pieces of Personal Data we have collected, the sources, the purposes, and the categories of third parties with whom we share it;
Delete the Personal Data we collected from you, subject to legal exceptions;
Correct inaccurate Personal Data; and
Opt out of the "sale" or "sharing" of Personal Data.

We do not sell your Personal Data and we do not share it for cross-context behavioral advertising, as those terms are defined under California law, so there is no opt-out for you to exercise. We will not discriminate against you for exercising your rights.

The categories of Personal Data we collect map to Section 3 above: identifiers (email, name, display name, Account ID); customer records (avatar); age/birthdate; internet or other electronic activity limited to your use of the App; visual information (photos and images you save); and other information you create (books, ratings, reviews, notes, shelves, Friends, and Lending Records). We collect these for the purposes in Section 4.

To exercise your rights, contact moltenorobin@gmail.com. You may use an authorized agent where the law permits. We may need to verify your identity before responding.

14. Account and data deletion

You can delete your Account at any time:

In the App — from the Profile / Settings screen, using the "Delete Account" flow. We may ask you to re-authenticate or confirm before proceeding.
On the web — by submitting a request at https://bookbookbookbookbook.com/delete-account, without reinstalling or signing back into the App.

Deleting your Account removes your Account and associated Content, including your library (books, ratings, reviews, notes, shelves), the cover/spine images and avatar you saved, your friend connections, your Lending Records, and any linked Google sign-in. As noted in Section 11, a limited amount of data may be retained where the law requires or permits, and a record of a completed loan may remain in the other party's history.

For full details, see our Account & Data Deletion page.

15. Children and minimum age

BookBook is not directed to children under 13 (or 16 in the EEA/UK where required). You must be at least 13 to create an Account, and we use your birthdate to enforce this and to gate mature-content books.

We do not knowingly collect Personal Data from children under 13. Consistent with the U.S. Children's Online Privacy Protection Act (COPPA) and similar laws, if we learn that we have collected Personal Data from a child under the applicable age without appropriate consent, we will delete it. If you believe a child has provided us Personal Data, contact moltenorobin@gmail.com.

16. Cookies and local device storage

BookBook uses cookies, tokens, and on-device storage to run the Service, not for advertising:

Authentication cookies and tokens (including Google OAuth tokens) keep you signed in.
Local device storage (IndexedDB and localStorage) keeps your data available offline and remembers your session and preferences.

All of these are strictly necessary for the App to function (signing you in and storing your own library data on your device). We do not use any analytics, advertising, or cross-site tracking cookies or storage. Because we only use strictly-necessary storage, no cookie-consent banner is required. You can clear this storage through your browser or device settings, but doing so will sign you out and may remove locally stored data.

17. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the App or by email. If we add a new data flow or third-party SDK, we will update this Policy and our app-store privacy disclosures before the change takes effect. Your continued use of the Service after an update means you accept the revised Policy.

18. Contact us

If you have questions, requests, or complaints about this Policy or your Personal Data, contact us at:

BookBook — an independently developed app and website (not yet incorporated)
Privacy and support: moltenorobin@gmail.com

You also have the right to lodge a complaint with a data-protection supervisory authority — in Germany, your competent state (Land) data-protection authority, or the authority in your EU/EEA country of residence.

See also our Terms of Service and Account & Data Deletion page.