Privacy policy

Last updated: 11 October 2026

This is a translation for convenience. The German version is the binding one.

This policy explains what data the Bookspire app and this website process, why, and for how long. In short: without an account, Bookspire works entirely on your device. Only if you create an account are your books and your tower stored on a server, so you can use them on several devices and with friends. There are no ads, no tracking, and nothing is passed on for advertising.

1. Controller

2. This website

The website is hosted on GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you visit it, GitHub processes technically necessary data, in particular your IP address, date and time and browser details, to deliver the site and protect it from attacks. The legal basis is our legitimate interest in a secure and available website (Art. 6(1)(f) GDPR). GitHub is certified under the EU-US Data Privacy Framework. See GitHub's privacy statement.

The website sets no cookies, uses no analytics or tracking tools and loads nothing from other servers; even the fonts are served from this site. Only if you join the waitlist does it send your address to our server.

Waitlist

If you join the waitlist on the home page, we store your email address, the language of the page and the time, to let you know once when Bookspire is available in the App Store and on Google Play. For this the page sends your address to our server at Supabase (see section 4). You first receive an email with a confirmation link via Mailjet; only after confirming are you on the list. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link or by email. We delete unconfirmed entries after 7 days, confirmed ones as soon as you unsubscribe or we no longer need the waitlist.

3. The app without an account

Without an account your data stays on your device: books, reading progress, ratings, notes, the furnishing of your reading room, your avatar and your dragon. None of it is sent to us. If you delete the app, this data is gone; a backup you export yourself stays wherever you save it.

Book search, covers and blurbs

When you search for a book, scan an ISBN, or the app fetches a missing cover or blurb, your device asks these services directly:

• German National Library (Deutsche Nationalbibliothek), Deutscher Platz 1, 04103 Leipzig, Germany
• Open Library, a project of the Internet Archive, San Francisco, USA
• Google Books (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)

What is sent is the search term, the ISBN or title and author, and – for technical reasons – your IP address. These requests are needed for the search to work (Art. 6(1)(b) GDPR). Each provider is responsible for its further processing.

Camera

The camera is only used to scan a book's barcode (ISBN), and only if you allow it. No images are stored or sent.

Reminders

Reading reminders are scheduled on your device. Nothing is sent to a server for them.

App updates

The app downloads updates through the Expo service (650 Industries, Inc., Palo Alto, USA). Your IP address, the app version and your operating system are sent in the process. The legal basis is our legitimate interest in delivering fixes quickly (Art. 6(1)(f) GDPR).

4. The app with an account

An account is optional. If you create one, we process the following data to sync your devices and offer the features with friends (Art. 6(1)(b) GDPR):

• your email address, to send you sign-in codes
• username and display name
• your library: book details, reading status and dates, current page, ratings, notes, favourites, and who you lent a book to
• the furnishing of your reading room
• how many pages you read on which day (for the monthly ranking)
• friendships, recommendations to friends, blocks and reports

What friends see

Friends only see what you share. In your profile settings you decide whether they may see your library, your tower, your activity and your friends list. Nobody but you sees your email address.

Where the data is stored

Accounts and data are stored with Supabase (Supabase Pte. Ltd., Singapore). The servers are in Ireland (region eu-west-1), so within the EU. A data processing agreement under Art. 28 GDPR is part of Supabase's terms of service; any access from outside the EU is covered by the EU Commission's standard contractual clauses it contains.

Sign-in emails are sent by Mailjet (Sinch Mailjet SAS, 13-13 bis, rue de l'Aubrac, 75012 Paris, France) as our processor. Through Mailjet we also receive reports you make about other people as an email, so we can review them quickly.

Deleting your account

You can delete your account at any time in the app under Profile. Your profile, library, reading room, reading days, friendships and recommendations are then removed from the server immediately. The data on your device stays until you delete it there. Without the app, you can ask by email, see Delete your account.

5. Error reports

If the app crashes or an error occurs, it sends a short report to our server: the error message, where in the code it happened, the app version and the operating system, and if you are signed in, your account ID. Books, notes or names are never included. The reports serve only to find and fix errors (Art. 6(1)(f) GDPR) and are deleted after 90 days at the latest.

6. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) – the app can export your library,
• object to processing based on legitimate interest (Art. 21 GDPR).

Just write to kontakt@bookspire.de. You can also lodge a complaint with a data protection supervisory authority, for example the one where you live.

7. Changes

If Bookspire gains features that involve other data, we update this policy. The version published here applies.