Legal
Privacy Policy
1. Who we are and how to reach us
BookBean is a reading community operated by BookBean Ltd (the "Company"), a private limited company registered in England and Wales (company number: 17376700, registered office: 66 Paul Street, London EC2A 4NA). We are the data controller for the personal information described in this policy.
Contact us at: [email protected]2. What this policy covers
This policy explains what information we collect when you use the BookBean app and website, why we collect it, how long we keep it, who we share it with, and the rights you have over it. It is written to be read by humans, not lawyers.
3. Information we collect
3a. Information you give us directly
- Account details: email address, display name, username, and the avatar/character you choose.
- Your library: the books you add, their reading status, ratings, notes, reviews and quotes you write, collections and lists you create, and copy-level details you choose to record (for example that your copy is signed or a first edition, its condition, or where you got it).
- Photos you take in the app: barcode and cover photos used to identify books, and photos of your own copies (cover, spine, or painted page edge) if you choose to put your real books on your shelf. Copy photos are stored so they can appear on your shelf.
- Libraries you import: if you import your books from Goodreads or The StoryGraph, the export file you choose or paste, including the ratings, reviews, notes, shelves and dates in it.
- Messages to us: anything you send to support or submit through in-app forms (for example a venue nomination or an author application).
3b. Information created by using the app
- Reading activity: reading sessions, progress, streaks and challenge progress.
- Place activity: venue check-ins and book "sightings" you log at bookshops, libraries and charity shops.
- Social activity: friendships, club memberships, buddy reads, recommendations, and gifts you record.
- Optional context: if enabled, light context around reading sessions (such as time of day or general conditions) used to build your personal reading insights.
3c. Information we observe automatically
- Device and technical data: device type, operating system version, app version, language, and crash/error information, used to keep the app working.
- Approximate and precise location: only if you grant location permission, and only while you use location features (finding nearby venues on the map, checking in). We do not track your location in the background.
3d. Information from third parties
- Book data: when you scan or search for a book we send the book's ISBN or title (never your personal details) to book databases (Google Books, Open Library, ISBNdb) to fetch details like the cover, page count and dimensions.
- Payment status: if you subscribe to BookBean+, the App Store (on iOS) or Google Play (on Android) processes the payment and our subscription partner (RevenueCat) tells us whether your subscription is active. We never see or store your card details.
4. How and why we use your information
| What we do | What we use | Legal basis (UK GDPR) |
|---|---|---|
| Provide your account, shelf, tracking, map and social features | Account details, library, activity | Contract (Art. 6(1)(b)) |
| Show you and your friends what you choose to share | Social activity and your visibility settings | Contract (Art. 6(1)(b)) |
| Operate BookBean+ subscriptions | Payment status from the App Store or Google Play / RevenueCat | Contract (Art. 6(1)(b)) |
| Keep the app secure and fix problems | Device and technical data | Legitimate interests (Art. 6(1)(f)) |
| Improve features and understand usage in aggregate | Pseudonymised usage data | Legitimate interests (Art. 6(1)(f)) |
| Optional research insights (see section 5) | Anonymised, aggregated reading behaviour | Consent (Art. 6(1)(a)) |
| Messages we're required to send (service or legal notices) | Account details | Legal obligation (Art. 6(1)(c)) |
You are always in control of visibility. Your profile, reading activity and location activity each have their own setting (public, friends, or private/nobody) in Settings > Privacy, and they default to friends-only.
5. Optional research insights
BookBean's long-term mission includes understanding how people really read (for example, our planned Reading Pulse reporting). If, and only if, you opt in through the consent screen in the app, we may include your reading behaviour in anonymised, aggregated research outputs, findings like "readers of crime fiction most often pause at chapter four", never anything that identifies you.
- Your name, email, and account details are never included in research outputs.
- You can withdraw consent at any time in Settings > Privacy. Withdrawal stops your data being used in future outputs; already-published aggregate findings contain no personal data and cannot be recalled.
- If you never opt in, your data is never used for this purpose.
6. Who we share your information with
6a. Service providers
We use a small number of providers to run BookBean, under contracts that limit what they can do with your data:
- Supabase (database, authentication and file storage), hosted in the UK/EU (London region).
- Apple App Store, Google Play Billing and RevenueCat (subscription processing and management).
- Meta (Facebook), only if you turn on Ad measurement (see 6d). We share your device advertising ID and a hashed (scrambled) email so Meta can tell us which ads brought readers to BookBean. If you leave Ad measurement off, nothing is shared with Meta.
- Expo/EAS (app delivery, updates and push notifications).
- Book databases (Google Books, Open Library, ISBNdb) receive only ISBNs or title searches, never your identity.
- Automated book-data services help fill in missing book details (like series order or mood tags). Only book metadata is sent, never your personal information, your notes, or anything about you.
6b. The Reading Pulse (anonymous research)
When the Reading Pulse is switched on, your reading data is included, only ever anonymised and aggregated, in insights we may share with publishers, bookshops, libraries and researchers. These insights are statistical only and cannot identify you: no name, no email, no account, and no precise location, only broad area-level and habit trends across many readers. You can switch the Reading Pulse off at any time in Settings, then Privacy, and we stop including your data from that point.
6c. Legal and safety requirements
We may disclose information if the law requires it, or where necessary to protect the rights and safety of our readers, our team, or the public.
6d. Ad measurement (only if you opt in)
BookBean shows no ads inside the app. To grow, we sometimes run ads for BookBean on other platforms, and we like to know which ones actually bring readers in. If you turn on Ad measurement (Settings, then Privacy, off by default), we share your device advertising ID and a hashed email with Meta so it can match an ad you saw to your install or subscription. We never share what you read, your shelf, your notes, or your location for this. You can turn it off at any time, and nothing is shared while it is off.
6e. We never sell your personal data
We never sell your personal data. Research data we share is anonymised and aggregated and cannot identify anyone. The only identifying data we ever share is the advertising ID and hashed email described in 6d, and only if you opt in to Ad measurement. For residents of US states such as California, this optional sharing may count as "sharing" for targeted advertising under state privacy laws; you can opt out at any time by turning Ad measurement off, which is also its default state.
7. International data transfers
Your data lives in the UK/EU (London). Where a provider processes data outside the UK, we rely on UK-approved safeguards such as the UK Addendum to the EU Standard Contractual Clauses.
8. How long we keep your data
- Your account and library: for as long as you have an account.
- If you delete your account: your personal data is deleted or anonymised within 30 days, except where we must keep limited records for legal reasons (for example subscription transaction records, kept for 6 years for tax purposes).
- Copy photos: deleted with your account, or individually whenever you remove them.
- Crash and technical logs: kept no longer than 12 months.
- Imported files: when you import a library we keep a copy of the file for up to 90 days so we can fix problems with your import, then delete it. The books themselves stay in your library as normal.
You can delete your account in Settings, or by emailing [email protected].
9. Your rights
Under UK GDPR you can: access a copy of your data; correct it; delete it; restrict or object to how we use it; take your data elsewhere (portability); and withdraw any consent at any time. Email [email protected] and we will respond within one month. You will never be charged for exercising your rights.
10. Children
BookBean is for readers aged 13 and over. We do not knowingly collect data from children under 13; if you believe a child under 13 has an account, contact us and we will delete it.
11. Sensitive information in your reading data
What you read can hint at personal things (beliefs, health interests, identity). We treat your reading data with care: it is private by default, visible only according to your settings, and never used to profile you or shared for advertising. The optional Ad measurement in 6d shares only your advertising ID and a hashed email, never anything about what you read.
12. Cookies and tracking
The app uses no advertising cookies. It does not track you for advertising unless you turn on Ad measurement (see 6d), which shares only your device advertising ID and a hashed email, never your reading. Our website uses only essential cookies and, where enabled, consent-based analytics, governed by the cookie notice shown on the site. You can change your choice at any time by clicking Cookie Settings.
13. Security
Data is encrypted in transit (TLS) and at rest. Access to production data is restricted, and database access is protected by row-level security so readers can only reach their own records and what others have chosen to share with them.
14. Changes to this policy
If we make material changes we will tell you in the app before they take effect, and update the date at the top. Minor clarifications may be made without notice.
15. How to make a complaint
We'd rather fix things first: email [email protected]. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.