Privacy Policy

Who We Are

The Readers Collective ("we", "us") is run by J. Barradell, an independent developer, who is the data controller responsible for the personal information described in this policy. For any privacy question or request, email support@thereaderscollective.com.

Information We Collect

We collect the information you provide when you create or use an account, including your email address, username, profile image, reading goal, profile details, books, reading progress, ratings, reviews, notes, quotes, tags, and messages or discussions you create.

When you choose Google sign-in, we receive your Google account identifier, email address, and profile image from Google to create and secure your account. We do not receive or store your Google password.

When you choose Sign in with Apple, we receive an Apple account identifier and the email address Apple shares with us, which may be a private relay address that forwards to your real inbox. On your first sign-in Apple may also share your name, which we use only to suggest a username. We do not receive or store your Apple ID password.

Push Notifications

If you allow notifications in our mobile app, your device is registered with Firebase Cloud Messaging, a Google service, and we store the device token it issues alongside your account. We use it only to send the notifications you have turned on, such as new messages, friend requests, and book club activity. Notification content is passed to Firebase Cloud Messaging and Apple's push service to deliver it. You can turn notifications off at any time in your device settings, and deleting your account removes its device tokens.

How We Use Information

We use your information to provide the app, authenticate your account, sync your library across devices, show your reading history and statistics, display your public profile according to your settings, and enable community features such as friends, recommendations, book clubs, and messages.

Private notes and favorite quotes are not displayed publicly. Profile and community content is shared only as needed for the visibility settings and features you choose.

Service Providers

We use Google and Apple for optional account sign-in, Firebase Cloud Messaging for push notifications in the mobile app, ISBNdb to look up book information, Hardcover to look up series information and covers, and Resend to send emails: account emails (welcome, email verification, password resets), replies to support requests, and, if you own a book club, notifications when members post. You can turn club notification emails off in Settings → Privacy. Requests to ISBNdb and Hardcover are made by our server and contain only the book title, author, or ISBN being looked up, not your account details; our API keys are not shared with readers. Series results from Hardcover are cached in our database. We share your email address with Resend only to deliver these emails. Hosting providers may process data only to operate the service.

Our website and API are hosted on Render and GitHub Pages, which process request details such as your IP address to serve pages and keep the service secure. Fonts are served from our own servers, not from Google Fonts.

Legal Bases for Processing

If you are in the UK or European Economic Area, we rely on these legal bases: performance of a contract to create and run your account and provide the features you use; legitimate interests to keep the service secure, prevent abuse, handle reports, and keep backups; consent for push notifications and optional Google or Apple sign-in, which you can withdraw at any time; and legal obligation where the law requires us to keep or disclose information.

International Transfers

Some of our service providers, including Render, GitHub, Google, Apple, Resend, ISBNdb, and Hardcover, are based in or process data in the United States and other countries outside the UK and EEA. When your information is transferred, we rely on safeguards such as the providers' Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US and UK-US Data Privacy Framework where the provider participates.

Data Storage and Security

Account and library data is stored in the app's database. Authentication is protected with signed session tokens and passwords are stored using one-way hashing. No method of transmission or storage is completely secure, but we use reasonable safeguards designed to protect your information.

Browser Storage

We store display preferences in your browser's local storage, such as your theme, language, shelf layout, and series filters and sorting. These stay on your device and are not used for advertising or tracking. We do not set cookies or use analytics or advertising trackers. The Google sign-in button on the sign-in page is provided by Google and may use Google's own cookies, as described in Google's privacy policy.

Your Choices

You can update your account and profile information, change your profile visibility settings, remove books and messages where the app provides that option, and delete your account from Profile Settings on the website or in the mobile app. Deleting your account removes your profile, library, messages, and push notification device tokens from the application database, along with the images you uploaded, and it cannot be undone. Book clubs you own pass to another member unless you choose to delete them.

How Long We Keep Information

We keep your account information for as long as your account exists. When you delete a message, its text and attachment are erased straight away, unless someone has reported it: a copy of a reported message, including any attachment, stays with the report so moderators can review it. When you delete your account, your data is removed from the live database immediately and drops out of our daily backups within 7 days, after which it is gone for good. Email verification links expire after 24 hours and password reset links after 1 hour. Content reports are kept while the reporter's account exists so moderators can review them.

Your Rights

Depending on where you live, you have the right to access the personal information we hold about you, correct it, delete it, receive a copy in a portable format, restrict or object to how we use it, and withdraw consent at any time. You can download a copy of your library and profile from Profile Settings and delete your account there yourself. For anything else, email support@thereaderscollective.com and we will respond within one month.

If you are unhappy with how we handle your information, you can complain to a data protection authority. In the UK this is the Information Commissioner's Office; in the EU, the authority in your country. California residents have similar rights under the CCPA. We do not sell or share personal information for advertising.

Children

The Readers Collective is not intended for children under 13, and you must be at least 13 to create an account. If you live in a country that sets a higher age for consenting to online services (up to 16 in some EU countries), you must be that age or have a parent's or guardian's permission. We do not knowingly collect information from children under 13. If you believe a child under 13 has created an account, email us and we will delete it.

Changes to This Policy

We may update this policy when the service changes. We will post the updated policy here and revise the last-updated date.