1.1 Information You Provide

• Account information — when you sign up, we collect your email address and any profile details you choose to provide (name, profile image). Authentication is handled by our provider, Clerk.
• Support communications — if you contact us, we retain the content of your message and your email address to reply.

1.2 Information Collected Automatically

• Reading activity — the books you open, your position within them, reading preferences, and progress. This is what lets us offer features like "Continue reading" and personal libraries.
• Device and session data — IP address, browser type, operating system, and timestamps. This is collected by our hosting and authentication providers for security, fraud prevention, and service reliability.

We process your personal data for the following purposes:

• To create and maintain your account and authenticate you
• To provide the reading experience, save progress, and sync across devices
• To respond to your support requests
• To protect the Service against abuse, fraud, and unauthorized access
• To comply with legal obligations

Under the GDPR, we rely on the following legal bases:

• Performance of a contract — to provide the Service you requested (account, reading features).
• Legitimate interests — to secure the Service, prevent abuse, and maintain operational reliability.
• Legal obligation — where we must retain or disclose data by law.
• Consent — where required, and which you may withdraw at any time.

We do not sell your personal data. We share data only with service providers that help us run the Service, under appropriate data processing agreements:

• Clerk (USA) — authentication and account management
• Convex (USA) — database and backend infrastructure
• Cloudflare (USA) — CDN, edge delivery, and DDoS protection

We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety, or property of users or the public.

Some of our service providers are located outside the European Economic Area, primarily in the United States. When your data is transferred internationally, we rely on safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework to ensure an adequate level of protection.

We keep your personal data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements. You can request deletion of your account at any time (see Section 8).

We implement industry-standard technical and organizational measures to protect your data against unauthorized access, loss, or alteration. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to certain processing
• Receive your data in a portable, machine-readable format
• Withdraw consent where processing is based on consent
• Lodge a complaint with your supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl)

To exercise any of these rights, contact us at lgandecki@bookgenius.net. We will respond within one month.

The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We use a small number of strictly necessary cookies and local storage entries to operate the Service (for example, to keep you logged in). For details, see our Cookie Policy.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the Service.

For any questions about this Privacy Policy or how we handle your data, please contact us at lgandecki@bookgenius.net.