Privacy policy
Bookties is operated by Appsibly, Czech Republic. This policy covers the website at bookties.app and the Bookties apps for Android and iOS. Questions or requests: hello@bookties.app.
What we store
- Account. We store your email address, display name and sign-in methods. Google and Apple provide their account identifiers and profile details; for email sign-in we store a one-way password hash, never the password itself.
- What you put in. Books on your shelf, reading progress, notes, replies, reactions, and who you share a book with.
- Reports and blocks. If you report a note, a reply or a person we keep the report, your account, the reason and details you wrote, and a copy of the reported text so we can review it. If you block someone we keep that fact so they cannot invite you again. The person you report is not told it was you.
- Photos. The book scanner reads a photo of a contents page on your device and discards it; the image is never uploaded. A photo you choose as a book's cover is uploaded and stored so your other devices can show it.
- Sessions. A signed session cookie on the web, and in the apps a device record (device name, platform, app version, last-used time) so you can see and revoke your signed-in devices.
- Activity. When you last used Bookties and which calendar days you used it on, as dates only, never what you did. We use it to see how many people actually use the service and whether they come back. It is included in your data export.
- Traffic. Standard server logs (IP address, request, user agent) retained short-term for security and debugging, plus Cloudflare Web Analytics, which is cookieless and does not fingerprint or track individuals.
Emails we send
- Account emails. A welcome email when you first sign in with Google or Apple, a link to confirm your address when you register with email and password, and a password reset link when you ask for one. These are part of running your account and cannot be switched off.
- Monthly reading summary. On the 1st of each month, an email with the books you and your friends started and finished the month before, and how many notes you wrote. It contains book titles and counts only, never the text of a note. It is on by default and goes only to a confirmed address. Turn it off at any time in Settings or with the unsubscribe link at the bottom of every summary; one click is enough. Your friends' titles appear in your summary for the same reason they appear in the app: you are friends on Bookties.
Why
To run the service you asked for: signing you in, storing your library and notes, unlocking friends' notes at the right chapter, and keeping the service secure. That is contract performance and, for the security parts, our legitimate interest. The monthly reading summary is our legitimate interest in keeping you up to date with your own reading on the service, and you can object to it at any time by switching it off. We do not profile you and we do not sell data.
Who else touches it
- Oracle Cloud - hosting (servers in the EU).
- Google / Apple - only for the sign-in you choose.
- Open Library and Hardcover - queried for book metadata and covers. They receive the search terms and book identifiers needed to answer, never your notes or account.
- Cloudflare - cookieless traffic analytics.
- Purelymail - email delivery for account emails and the monthly reading summary. It receives the recipient address and the message itself, which for the summary includes the book titles in it, but never your notes.
Who can see your notes
Only you and the people you explicitly share a book with, and only once their reading progress reaches the chapter a note belongs to. The unlock rule is enforced on the server: a note you have not reached is not sent to your device at all.
How long we keep it
Your account data lives as long as your account does. Delete your account and it is removed, along with your books, notes and sessions, and any report or block that involves you. Server logs roll over within 30 days. Confirmation and password reset links expire after 48 hours and 60 minutes, are stored only as a one-way hash, and are deleted a week after they expire. Email delivery records contain the message type, recipient, outcome and timestamp, never the subject or body, and are removed after 90 days. Activity days are removed after 400 days. Backups are purged on their own schedule and never restored selectively to bring deleted data back.
Your rights
Under the GDPR you can request access, correction, export, deletion, and restriction of processing, and you can object to processing. Account deletion is available in the app; for anything else write to hello@bookties.app and we will answer within 30 days. You may also complain to the Czech supervisory authority (Úřad pro ochranu osobních údajů).
Cookies
Bookties sets one cookie: the httpOnly session cookie that keeps you signed in. It is strictly necessary and cannot be turned off while you are signed in. There are no advertising or cross-site tracking cookies. If we ever add non-essential tracking, it will be behind an explicit opt-in.
Children
Bookties is not directed at children under 13, and we do not knowingly collect their data.
Changes
Material changes will be announced in the app before they take effect. The date at the top always reflects the current version.