Privacy Policy
Last updated: 2026-08-31
Controller
Romana Dorfstr. 7a 23562 Lübeck Germany
What we store
Your account: email address and a hashed password, plus any profile details you choose to add. Your library: shelves, ratings, reviews, reading sessions and imports. Technical signals: first-party daily counters that carry no name, account or address — we use no third-party trackers.
What we use it for
To run the site (sign-in, your shelf, your reviews), to keep it safe (moderation, abuse prevention, rate limits) and to understand usage through nameless aggregate numbers. We do not sell data and we show no advertising.
Legal bases
Providing the service you signed up for (Art. 6(1)(b) GDPR); your consent where we ask for it (Art. 6(1)(a)); and our legitimate interest in keeping the service safe and counting usage without identifying anyone (Art. 6(1)(f)).
Encryption of identifying data
Identifying details — your email address and the optional profile fields — are stored encrypted with a key that belongs to your account alone. Deleting the account destroys that key, so the sealed data becomes permanently unreadable, in backups too.
How long we keep things
Account and library data live as long as the account. Raw technical events are deleted after 90 days; only nameless daily totals remain.
Who receives data
Hosting and email-delivery providers process data for us under data-processing agreements. To enrich the catalogue we may send book facts to an AI service — book facts only, never your personal data.
Your rights
Access, rectification, erasure, restriction, objection and data portability (the export button in your profile downloads everything), plus withdrawing any consent at any time. Write to us at the contact address below.
Deleting your account
You can delete your account yourself in your profile. Published reviews stay under an anonymous name, no longer connected to you; your email address becomes free again.
Cookies and browser storage
We store only what the site needs to work: your sign-in tokens, theme and language, in your own browser. No advertising or third-party tracking cookies.
Site statistics
We count visits ourselves — no third-party tracker, no analytics cookie. Your browser sends the page address, your interface language, and, when you arrive from another site, that site's address. From your network address we derive only a country and city using a local dataset; the address itself is never stored. To count unique visitors, a code is derived from it that cannot be reversed and changes every day at midnight (UTC), so visits on different days cannot be linked. Only daily totals are kept — by country, city (only in groups of at least 5), language, browser family, and traffic source.
Minimum age
The service is intended for people aged 16 and over.
Complaints
You have the right to complain to a data-protection supervisory authority — for us that is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD).
Changes to this policy
We publish updates on this page. When a change matters, we say so on the site; the version you agreed to is recorded with your account.