Privacy policy
Last updated 2026-04-27.
What we collect
- Account info: username, email address, display name, optional bio and avatar.
- Library data: books you add, libraries you create, friendships, borrow requests and reviews.
- Operational logs: IP address (for rate limiting and abuse prevention), session cookies, and routine HTTP request logs. Logs are retained for 30 days.
How we use it
- To run the platform — show you your data, share with people you've explicitly friended, etc.
- To prevent abuse (rate limiting failed logins, signup spam).
- We never sell, rent, or transfer your personal data to third parties.
What we share
- Public libraries and books you mark "public" are visible to anyone, including search engines.
- Friends-only content is visible to people you've mutually accepted as friends.
- Private content is visible only to you.
External services
- OpenLibrary and Google Books — when you enter an ISBN we look up book metadata. The ISBN is sent to those services. No personal info goes with it.
- OpenStreetMap / Nominatim — used for the map view to convert suburb labels into pins. Your IP address visits these services if you load the map.
- Google Fonts — the Manrope font is loaded from Google's CDN.
Your rights
- Export: Download all your data as JSON from Settings.
- Delete: Delete your account from Settings. Soft-deleted data is purged within 30 days.
- Contact: Email the platform admin (configured per deployment).
Cookies
We use a single session cookie to keep you signed in. That's it — no tracking cookies, no advertising cookies, no third-party trackers. If analytics is configured for this deployment, it runs through Plausible, which is cookieless and aggregates anonymously.