Privacy policy
Booklog is a reading log made by Jack Crook ("we") in Queensland, Australia. This policy explains what happens to your information. The short version: your library lives on your phone, you don't need an account, if you sign in it's backed up privately to your account, and the only things anyone else can see are community reviews you choose to post.
Your books stay on your phone
Your books, shelves, ratings, reading dates, reading format, progress and reading sessions, notes, and your settings (rating scale, which features are on, colours and theme, haptics, layout) are stored in a database on your device. Streaks, pages per day, the reading calendar and the stats screen are all worked out on your phone from that data. Without an account, none of it is sent to us, and deleting the app deletes it.
If you sign in, a copy of your library is backed up to your account so you can restore it (see Backup). Your phone stays the main copy.
What leaves your phone, and why
Open Library (book details and covers)
Book details and cover images come from Open Library, a free service run by the Internet Archive. We don't run it, and it doesn't receive your name, email or account. Like any website, it sees your IP address. The app sends it:
- What you search for, and the ISBN of a barcode you scan.
- Goodreads import: the export file you choose is read on your phone. Only each book's title, author and ISBN are sent to Open Library to look the book up. Your Goodreads ratings, dates and notes stay on your phone.
- The Search screen: before you type, it asks Open Library for this week's popular books. For the "Because you read…" and "Recommended for you" rows, it asks for the subjects of up to five books you've finished and rated highly (identified by their Open Library ID), then searches for books on one of those subjects. Your ratings, notes and the rest of your library are not sent.
- Book pages: the description, average rating and other details of the book you open, by its Open Library ID.
- Cover images for books Apple Books has no cover for (see below). Your phone downloads each cover and keeps a copy so it doesn't ask again.
Open Library's terms and privacy policy: archive.org/about/terms.php
Apple Books (cover images)
Covers come from Apple Books where it has the book, because those are the publisher's own artwork. For each book you see, the app sends its title and first author to Apple's public book search, once, and remembers the answer on your phone. Nothing else is sent: no account, no ratings, and nothing that identifies you, though like any website Apple sees your IP address. This happens whether or not you have an Apple account or an iPhone. Apple's privacy policy: apple.com/legal/privacy
Cover scanning (only if you use "Photograph the cover")
Barcode scanning happens on your phone. If a book has no barcode you can photograph the cover instead. The photo goes to our server, which sends it to Anthropic's Claude API to read the title and author, and sends back only that text. The app then searches Open Library with it and asks you to pick the right book.
- We don't store the photo. Our server holds it only while the request runs. Anthropic keeps API inputs for at most 30 days, to check for misuse, and doesn't use them to train its models. The camera also saves the photo to the app's cache on your phone; the app deletes it as soon as the scan finishes.
- Scan limits. Each scan costs us money, so the server counts scans
per day: against your account ID if you're signed in, and otherwise against a
scrambled form of your IP address. That is a keyed hash (HMAC-SHA-256) made with a
secret only our server has, and a different one each day, so it can't be worked back
to the address or linked across days. For newer (IPv6) addresses only the network part
is used, because one phone can use many addresses within it.
We store that ID or hash with a count and the start of the day, never your IP address itself. It is used only to enforce the limit, only our server can read it, and old counters are deleted by a nightly job within two days. A signed-in counter is also deleted straight away when you delete your account. Someone holding our server secret and already knowing your address could still match it, so we treat it as personal data.
Our server and its logs
Our server runs on Supabase, in Singapore. Like most hosting, it keeps routine request logs that include IP addresses, for up to 7 days. We use them only to keep the service working and secure.
Accounts (optional)
You can use the app without an account. You can create one with an email address and password, or sign in with Apple or Google. Supabase stores what identifies your account: your email address (with Apple you can hide it behind a relay address), your name if Apple or Google shares it, the profile details Google includes in sign-in such as a profile picture link, an account ID, and sign-in times. If you use a password, Supabase stores it only as a salted hash; we never see it. To confirm an email address or reset a password, we email you a 6-digit code. Your phone keeps a sign-in token so you stay signed in.
What an account is for: backing up your library (below), posting community reviews if you turn them on, and a higher cover scan limit.
Backup (when you're signed in)
While you're signed in, the app backs up your library to your account: your books and shelves, ratings, reading dates, formats, page progress, notes, reading sessions, and your app settings. It backs up when you tap "Back up now", and by itself about twice a day once this phone has backed up or restored. Each backup replaces the last one.
Only you can read your backup. It's used for one thing: putting your books back on a new phone or after reinstalling the app, when you choose to restore. Your notes stay private: they're in your backup, and never shown to anyone.
Community reviews (optional, off by default)
You can turn on community reviews in Settings. With them on, the book page shows other readers' reviews. To show them, the app asks our server for the reviews of the book you are looking at, by its Open Library ID. You don't need an account to read them.
To post a review you need an account, a display name, and to agree to the community terms. We record when you agreed.
What's public. Anyone using the app, signed in or not, can see your display name, your review text, the star rating you gave the book (if you rated it), which book it is, and when you posted it. Each review is also tied to a random account ID. Your email, real name, notes, shelves, reading dates, and when you agreed to the terms are never shown.
Moderation.
- When you post or edit a review or choose a display name, our server checks it against a list of words that aren't allowed. If it matches, it isn't saved and you can edit it.
- You can report a review. We store who reported it, the reason and when. Other users can't see who reported what. A review reported by three different people is hidden until we have looked at it. We check reports within 24 hours, and may delete reviews, or the accounts that post them, if they break the terms.
- You can block someone, and their reviews disappear for you. Your block list is stored on our server so it works on every book. Only you can see it, and you can unblock in Settings.
Changing or removing them. You can edit or delete any of your reviews at any time, and a deleted review is removed for everyone straight away. You can change your display name on any book page, under Community reviews (Posting as … → Change); it changes on all your reviews. It is removed when you delete your account.
Deleting your account
In the app: Settings → Account → Delete account. You can also ask by email (see Delete your account). This permanently deletes, from our servers:
- your account (email, name and sign-in details),
- your library backup,
- your display name and every review you posted,
- reports you made, and reports others made about your reviews,
- your block list, and other people's blocks of you.
If you signed in with Apple, the app first asks you to confirm with Apple. Our server uses that to revoke Booklog's access to your Apple ID, then deletes the account. If Apple can't be reached, nothing is deleted and you can try again. We never store Apple sign-in tokens.
Not removed by this: books on your phone (delete the app to remove them), server logs until they expire (up to 7 days), and Supabase's own copies of the database, which are kept for up to 7 days for disaster recovery.
Who else handles your data
- Supabase hosts our database, sign-in and server code, in Singapore.
- Anthropic reads cover photos, only when you scan a cover.
- Apple and Google handle sign-in, if you choose to sign in with them. Apple's book search also provides covers, as described above.
- Resend sends the 6-digit codes for email accounts. It sees your email address and the message.
- Open Library provides book details and covers, as described above. It is an independent service with its own policy.
Some of these are outside Australia, so information you send through them may be stored or processed overseas, including in Singapore and the United States.
What we don't do
No advertising. No tracking across other apps or websites. No analytics. We don't sell your information or share it with anyone except as described above.
Children
The app is not directed at children under 13, and we don't knowingly collect their data. Community reviews are public, so don't post if you are under 13. If you think a child has posted, contact us and we will delete it.
Your rights
We handle personal information in line with the Australian Privacy Principles. You can ask to see, correct or delete the information we hold about you. Most of it is only on your phone, where you control it. For anything on our servers, delete your account in the app or email us at support@booklog.org, and we will reply within 30 days. If you live in the EU or UK, you also have the rights the GDPR gives you, including to object to how your data is used.
If you're unhappy with how we've handled a privacy complaint, you can contact the Office of the Australian Information Commissioner, or the data protection authority where you live.
Changes
If this policy changes, we'll update the date at the top. If a change means we collect something new, we'll say so in the app before it happens.
Contact
Jack Crook, support@booklog.org