Your data, plainly explained

Privacy Policy

Effective August 1, 2026

Information on Your Device

Your reading library is saved on your device first. It can include book titles and authors, cover links, formats, reading status and order, dates, reactions, recommendation drafts, tags, notes, reading goals, imported source information, and local profile preferences. This information remains on the device unless you choose an app feature that sends it elsewhere, such as signed-in cloud protection, a private Rec'd, book search, Spotify import, export, or support contact.

Account and Profile Information

An account is optional. If you create one, we process your email address, an internal account identifier, authentication session information, display name, username, profile description, format preferences, and Rec'd delivery preference. Supabase provides authentication and database services. Supabase handles your password authentication; Read & Rec'd does not receive or store your plaintext password.

Cloud Library Protection

When you sign in and protect a library, Read & Rec'd stores an account-linked backup with Supabase. The backup can contain the device-library information described above, including books, notes, tags, goals, reading order, reactions, dates, and recommendation provenance. This is a backup and deliberate restore service, not public sharing or live community activity. Database access controls restrict a backup to its owner.

Private Book Rec'ds

If you send or receive a private Rec'd, Supabase stores the participants' account identifiers and sender profile snapshot, book title and author, optional cover and publication details, format and source, your optional recommendation note, delivery status, and timestamps. A Rec'd is available only to its sender and recipient. Exact-username lookup returns only a matching reader who has chosen to receive Rec'ds; the app does not provide public profile browsing or partial-username discovery.

Book Search and Imports

Google Books and Open Library

When you search for a book, the search text is sent directly to Google Books and Open Library so they can return book metadata and cover images. We do not intentionally attach your Read & Rec'd account identity to those searches. Those services may receive ordinary request information such as your IP address and device or browser details under their own privacy policies.

Spotify

Spotify connection is optional. If you connect it, Spotify authenticates you and Read & Rec'd requests access to view your saved audiobooks so you can choose titles to import. The app does not ask for Spotify playback control and does not sync listening progress. The Spotify access token is used for the active connection and is not included in your Read & Rec'd library. Imported audiobook metadata becomes part of your device library and, if cloud protection is active, your account backup.

Files You Choose

Import uses the system file picker for a Read & Rec'd JSON export or Goodreads CSV that you select. Export uses the system share sheet and sends the file only to the destination you choose. The app does not request unrestricted access to your files.

Support and Service Messages

Google email services deliver account confirmation and password-recovery messages and receive support mail you choose to send. A support message may include your email address and whatever details you provide. Do not send passwords, authentication codes, access tokens, or sensitive reading notes in a support request.

Technical Information

Our hosting and service providers may process standard connection and security information—such as IP address, device or browser type, request timestamps, and diagnostic logs—to deliver and protect their services. Read & Rec'd does not include an advertising SDK, cross-app tracking SDK, or a third-party product analytics SDK in this release.

How We Use Information

• Provide the reading library, account, backup, private Rec'd, search, and import features you request.
• Authenticate accounts, confirm email ownership, recover passwords, and keep sessions secure.
• Prevent unauthorized access, investigate failures, and maintain service reliability.
• Respond to support, privacy, and deletion requests.

Service Providers and Disclosure

We use service providers only as needed to operate these features: Supabase for authentication, database, cloud backup, and server functions; Google for account/support email delivery and Google Books search; Open Library and the Internet Archive for book search and covers; Spotify for optional audiobook import; and Cloudflare for these public pages. Their processing is governed by their own terms and privacy policies.

We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We may disclose information when required by law, to protect users or the service, or as part of a business transfer subject to appropriate safeguards and notice where required.

Retention and Deletion

Device-library data remains until you delete it, erase the device library, remove the app, or the operating system removes app data. Account, profile, cloud backup, and private Rec'd data remain while needed to provide the account. In the app, open Profile → Account & library settings → Delete account to permanently delete the account and associated cloud profile, backup, and Rec'd records. You separately choose whether to keep the reading library on that device or erase it too.

Service-provider backups and security logs may persist for a limited period under provider retention schedules and are not used to recreate a deleted account. Support correspondence may be retained as reasonably needed to resolve the request, maintain security records, and meet legal obligations.

Your Choices

• Use the core local reading library without creating an account.
• Choose whether readers with your exact username can send private Rec'ds.
• Disconnect Spotify by ending the app connection and revoke access from your Spotify account settings.
• Edit or delete library items, export a portable copy, or erase the device library.
• Delete your cloud account in the app or contact support if you cannot access it.

Depending on where you live, you may have additional rights to access, correct, delete, or restrict use of personal information. Contact us to make a request. We may need to verify that you control the relevant account.

Security

We use platform security features, encrypted network connections, authenticated access, and database access controls designed to protect account data. No storage or transmission method is completely secure, so we cannot guarantee absolute security.

Children

Read & Rec'd is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Contact us if you believe a child provided personal information so we can investigate and delete it as appropriate.

Changes to This Policy

We may update this policy as the app changes. We will post the revised policy here with a new effective date. Material changes may also be communicated in the app or through another appropriate channel.

Contact

For privacy questions or data requests, email readandrecd.support@gmail.com.