Bookary · Privacy

Privacy

"We" is Bookary (contact: support@bookary.io).

What we hold

• Your account: email address, display name, and a hash of your password — never the password itself. We also keep when the account was created, and how many books and how many bytes you hold, which is how your plan's limits are counted. If you send books to a Kindle, your Kindle address too, and when you last acknowledged our note about the sender address. If you change your email address, we keep the new address from the request and, once you confirm it, the old one too, until the account is deleted. If you send books to a Kindle, we keep a history of those sends (the Kindle address, the book, whether it was delivered and any error) until the book is permanently removed or you delete the account. If you arrived from an ad or a link that carried campaign labels, we also keep those labels — which ad or link it was — on your account.
• Your books: the files you upload, kept exactly as you sent them, plus any format we convert them into so they can be read in a browser. A book you delete is kept for a short time, normally one to two days and occasionally a little longer, and then permanently removed.
• What we read out of your books: title, authors, series, publisher, description, cover.
• How you read: your position in each book, how far you have reached, and your reader settings.
• How you organise: your shelves and tags.
• What you write: your highlights, bookmarks and notes — including the passage each one marks and any note you attach to it. This is the only thing here you author rather than upload.
• If you subscribe: which plan you are on, whether the subscription is active, when the current period ends, and the identifiers our payment processor uses for you. Your card details never reach Bookary — payment happens on the processor's own pages.

Why we process it, and on what basis

• Your account, books, reading data, shelves, tags, highlights and notes — to run your library and let you read it. Basis: contract, providing the service you signed up for.
• Email we send you — to confirm your address, reset your password, warn you of a duplicate registration, confirm an email change and tell you that your email was changed. When you send a book to your Kindle, the book file and your Kindle address go through our email delivery provider. Basis: contract.
• IP address for rate limiting, the sign-up check and server logs — to keep the service available and stop abuse. Basis: legitimate interests (security and preventing abuse).
• Payment identifiers, once paid plans open — to know which plan you are on. Basis: contract.

Security and abuse protection

• Rate limiting. Requests to our API are counted per account when you are signed in and per IP address when you are not, and sign-in and account forms are counted per IP address, so that no one caller can overwhelm the service. The counts are kept in memory in the running web process. They are not stored, and are gone when it restarts.
• Server logs. Our servers keep access logs, including your IP address, the page or file requested and your browser type, to run and secure the service. We have not yet set a fixed time limit for them, and will before Bookary leaves alpha.
• A check that you are a person. Sign-up, password reset and resending a confirmation email include a Cloudflare Turnstile check. Your browser loads a script from Cloudflare, and our server sends Cloudflare the result and your IP address to verify it. Cloudflare processes your IP address and browser signals to tell people from bots, under our legitimate interest in security and preventing abuse; see Cloudflare's Turnstile privacy addendum. Cloudflare may also store data of its own in your browser while the check runs; that is covered by Cloudflare's privacy policy. Bookary sets no cookie for the Turnstile check.
• A cap on account emails. We accept at most 3 requests an hour, per account, for a new confirmation, reset or duplicate-registration email, so that nobody can use Bookary to flood an address. We count them from records we already keep; nothing new is stored.

Bookary has no advertising pixels and no analytics pixels of its own, and does not track you across sites. The live service neither sends nor collects error reports from your browser; that reporting exists only on development builds. The feedback link in the footer opens the feedback page; its "Write to us" button then opens your own email program with a message addressed to us. Bookary sends nothing itself.

Server diagnostics. Our own servers write diagnostic logs — what was requested and when, how long it took, and what failed — which we use to find errors. Nothing is sent to an outside telemetry service today; the logs stay on our own servers. A log line can include your account id, your Kindle address, and a book's file name. Nothing about them runs in your browser, and they are not used for advertising. Google Search Console sets nothing in your browser.

Who processes it for us

• our hosting provider, which runs the servers and stores the data;
• our email delivery provider, which sees the addresses we send mail to;
• Cloudflare, for the Turnstile check described above;
• Stripe, for payments, once paid plans open. They are not open yet.

How long we keep it

• Your account and library: until you delete your account.
• A book you delete: normally one to two days, then permanently removed.
• Email-change records, with the old and new address: until you delete your account. They expire, but are not removed before then.
• Server access logs: a fixed time limit is not set yet.
• Backups: normally about 30 days after deletion (see Backups).
• Records that an event happened (they carry identifiers, not personal detail): removed once they have been processed and are more than 30 days old.

Your rights

You can get a copy of your data (export), correct it (your name and your email address can be changed from your account page), and delete it (deleting your account). You can also object to processing we do under legitimate interests by writing to us, and complain to your data protection supervisory authority. To use any of these, or to ask us anything, write to support@bookary.io.

Where your books are served from

The contents of your books are never served from this site. Pages and text are delivered from a separate books origin that receives no cookie and cannot read your session, so nothing inside a book can act on your account while you read it. That separation is deliberate and is the strictest rule in how Bookary is built. Cover images are the one exception: they are served from here, because a cover is a picture rather than a document that can run.

Cookies

Bookary sets no advertising cookies and no advertising pixels of its own. Analytics cookies are set only where analytics is switched on for this service, and only if you accept them. Bookary sets no cookie for the Turnstile check. The cookies that can be set in your browser are:

Signing out clears the sign-in cookie. So does deleting your account.

Stored in your browser

Two kinds of thing are kept in your own browser, and neither is sent to us:

• Library layout and view state, and the dismissed alpha note: whether your library is laid out as a grid or a list, which view of it you last looked at, and any alpha note you have dismissed. These are kept in your browser's own storage until you clear this site's data.
• Offline caches: a copy of the app's own files, so pages load faster, and copies of the books you choose to keep offline, with a list of them (title, author, format, size, when you kept it and where its file is stored) so they can be opened without a network. Only books you keep open offline; the rest of Bookary needs a connection. The copy of the offline reading page is fetched without your sign-in, so it holds nothing about you.

Books kept offline stay on that device, even after you sign out or delete your account, and anyone using that browser can open them, until you remove them: choose "Remove offline copy" from the book's menu in your library, or clear this site's data in your browser's settings.

Email

We email you to confirm your address, to reset your password, to tell you if somebody tries to register an account with your address, to confirm an email change and to tell you it happened, and, when you ask, to send a book to your Kindle. Those messages go through a delivery provider, which necessarily sees the address they are sent to — and, for Kindle delivery, the book file. We do not send marketing email.

Payment

Paid plans are not open yet. What follows describes how they will work when they are.

If you subscribe, payment is handled by Stripe. You enter your card on Stripe's own pages, not ours: no card number, expiry or security code ever reaches a Bookary server, which is why we can say we could not leak one. What we store is the identifier Stripe gives us for you and for your subscription, the plan, its status and its renewal date — enough to know what you are entitled to and nothing more. Stripe is a processor acting for us and holds your payment details under its own terms.

Taking your data with you

Your account page — or GET /api/v1/account/me/export — returns a single file of your data: your profile, every book's details with its checksum, your shelves, tags, series, reading positions, settings, and your highlights and notes with the passages they mark. That file does not contain the book files themselves. The checksums let you verify that a file you download is byte-for-byte the one we held.

To take the books too, the same page builds your whole library as one zip: every book in your library, exactly as you uploaded it, plus that same data file. We build it in the background and keep it in storage for seven days, so you can download it; after that it is deleted automatically, and deleting your account deletes it too. You can still download any single book from its menu.

Deleting your account

You can delete your account yourself, from your account page. We ask for the password because deletion cannot be undone — a stolen browser session is not enough to erase your library. Deletion removes your files too, so download your originals from each book's menu first.

Deletion removes your account, your books, the uploaded files themselves, every format we derived from them, your covers, shelves, tags, series, reading positions and settings, your highlights, bookmarks and notes, your Kindle send history, your email-change records, and any subscription record. Books you had already deleted are removed too — nothing of yours is kept back for a grace period, and there is no thirty-day window. Your account and its records are removed before the request returns. File removal is requested immediately and runs in the background; a daily cleanup catches files left by interrupted or failed attempts. The response does not mean the files are already gone. This describes the live service; see Backups below for the part it is not true of.

Two things deliberately survive, and neither identifies you to anyone reading them: internal records that some event happened, which carry identifiers and no personal detail; and the shared catalogue of author names, which is not yours to remove and is not linked to you once your books are gone.

Backups

Everything above is about the live service. It is not the whole story, and the difference is worth stating plainly rather than leaving you to assume the better version.

Copies of your data normally persist in our backups for about 30 days after you delete it. Backups exist so that a mistake on our side — a bad deployment, a faulty purge — cannot take your library with it, and a backup that erased everything the instant the live service did would not survive the one failure it is for. So a deleted file and an erased account remain in the offsite copy for that window, and are then removed. The window is a target, not a hard ceiling: it starts once the deletion reaches the backup, and in edge cases the last files can outlast it.

Thirty days is a deliberate figure rather than a description of whatever happens. It is long enough for a fault on our side to be noticed and undone, and short enough to keep what you asked us to destroy for as little time as that allows. The same window applies to your files, your annotations and your account record alike, with the edge cases above.

Backups are not part of the running service. Nothing in them is served to anyone, searched, or used for any purpose other than restoring the service after a failure — and if a restore ever brought back data you had deleted, deleting it again is the remedy.

Asking us something

Write to support@bookary.io. See also our terms.