Privacy Policy

• Account information: your email address, username, and optional display name. If you set a password we store only a salted hash of it, never the password itself.
• Sign in with Google: if you choose Google sign-in, Google shares your email address, whether it is verified, and your name. We do not receive your Google password and do not access any other Google data.
• Purchases and memberships: the books, bundles and membership plans you buy, order status and amounts. Payments are processed by Stripe; we store a Stripe customer reference but never your full card number.
• Devices: for each reading device or browser you authorize, a device identifier, an optional device name and a device public key, used to issue download licenses to that device.
• Reading activity: reading progress and position, book check-ins and your answers to check-in questions, ratings, reviews, replies, votes and reports you submit.
• Content you upload: if you publish as an author, the books, cover and preview images, and author profile details you provide.
• Technical data: sign-in tokens and your device identifier are kept in your browser's local storage so you stay signed in. Our hosting provider records standard server logs (such as IP address, browser type and request time) for security and troubleshooting. We do not use advertising or third-party analytics cookies.

• To create and secure your account, sign you in, and send verification codes and account emails.
• To process purchases and memberships, and to deliver and license books to your authorized devices.
• To sync your reading progress and check-ins across devices, and to show your reviews and ratings.
• To prevent fraud, abuse and unauthorized copying, including watermarking licensed content.
• To respond to your requests and to comply with legal obligations.

Information received from Google APIs is used only to sign you in and to create or identify your BookShop account, and, if you connect Google Calendar, to show your calendar events on your Cove. Google Calendar access is read-only: we read the list of your calendars and the events of the calendars you choose, within 30 days in the past and 180 days ahead, and never create, change or delete anything in your Google account. We keep your Google authorization encrypted on our servers and a copy of those events only so your devices can download them; both are deleted as soon as you disconnect Google Calendar or delete your account, and you can also revoke access from your Google Account at any time. Our use of that information adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell it, use it for advertising, or transfer it to others except as needed to operate the service or as required by law.

We do not sell your personal information. We share it only with service providers that run BookShop for us:

• Vercel — website and API hosting.
• Supabase — database and file storage.
• Stripe — payment processing.
• Resend — delivery of verification and account emails.
• Google — Sign in with Google and Google Calendar, if you use them.

Your public reviews, ratings and replies are visible to other users together with your username. We may also disclose information when required by law or to protect the rights and safety of our users and of BookShop.

We keep your information for as long as your account is active. You can ask us to delete your account and associated personal information by emailing lucas@getbleno.com; we will do so except where we must keep certain records (for example payment records) to meet legal or accounting obligations.

You can request a copy, correction or deletion of your personal information, or ask us to remove an authorized device, by emailing lucas@getbleno.com. Depending on where you live, you may have additional rights under local law, which we will honor.

We use encrypted connections (HTTPS), hashed passwords, short-lived access tokens and device-bound licenses to protect your account and content. No system is perfectly secure, so please keep your password and devices safe.

BookShop is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy from time to time; the date above shows the latest version, and significant changes will be announced on the site or by email. Questions or requests: lucas@getbleno.com.