Privacy Policy

Last updated: October 12, 2026

The short version: we collect what's needed to run your bookshelf, we don't sell it, we don't show ads, and we don't track you. You can download or delete everything at any time from Settings.

Who is responsible

The data controller is Wioks Global, S.L. (CIF B67621250), C/ Sant Josep, 132-134, P.I. El Pla, 08980 Sant Feliu de Llobregat (Barcelona), Spain. For anything related to your data, write to librarian@bookshelf.page.

What we collect

• Account data. Your email address, used to log you in. If you log in with Google, we receive your email from Google, nothing else.
• Profile data you choose to add. Username, name, photo, bio and website.
• Your reading. The books you add, their status, ratings, notes, covers you upload and reading dates.
• Social activity. Who you follow and the book recommendations you send and receive.
• Technical data. IP address, browser and timestamps in server and login logs, used for security and to fix problems.

We count visits with Plausible Analytics, a privacy-friendly tool hosted in the EU that uses no cookies and doesn't collect personal data or identify you. It tells us things like how many people visited a page or added a book, never who did. We don't use advertising or tracking tools.

Why we use it, and on what basis

• To provide the service: your account, your shelf, following and recommendations. The legal basis is the agreement you accept by creating an account (GDPR art. 6.1.b).
• To show your public profile. New shelves start public, because sharing is what Bookshelf is for: your username, photo, bio and finished books are visible to anyone, including search engines. Reading dates are hidden unless you choose to show them, and you can make your shelf private, or choose which sections are visible, at any time in Settings. The legal basis is the agreement and your choice of settings.
• To keep the service secure: preventing abuse, spam and attacks. The legal basis is our legitimate interest (art. 6.1.f).
• To send you emails that are part of the service, such as login codes. We don't send marketing emails.

Who processes it for us

We use a few trusted providers, bound by data processing agreements, only to run Bookshelf:

• Supabase: database, login and file storage, hosted in the EU.
• Vercel: hosting of the website.
• Resend: delivery of login emails, from the EU.
• Plausible Analytics: cookie-free, anonymous visit counts, hosted in the EU.
• Google: only if you choose to log in with Google.

Some of these providers are based in the United States. Where data leaves the EU, it's protected by the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.

To show book information we look up titles on Open Library, Apple Books, Google Books and Wikiquote. These lookups are made by our server and contain book titles and authors only, never your personal data. We're not affiliated with any of these services.

We never sell your data or share it with anyone for advertising.

Cookies

Bookshelf only uses cookies that are strictly necessary for it to work, so we don't ask for consent and there's no cookie banner:

• sb-…-auth-token: keeps you logged in. Lasts until you log out or the session expires.
• sb-…-code-verifier: protects the login step. Deleted right after you log in.
• g_oauth: protects the "Continue with Google" step. Lasts at most 10 minutes and is deleted after you log in.
• flash: shows a one-time message such as "Book added". Deleted after a few seconds.

The video in our blog is embedded from youtube-nocookie.com, which doesn't set cookies until you press play. Book covers load from Apple, Open Library and our own storage, without cookies.

If you use the "Ask AI" button, we open ChatGPT, Claude or Perplexity with your shelf in the prompt. That only happens when you click it, and from then on their own privacy policies apply.

How long we keep it

We keep your data while your account exists. When you delete your account, your profile, books, follows, recommendations and uploaded images are deleted immediately. Server and login logs are kept for up to 90 days.

Your rights

You can access, correct, download (portability), delete, restrict or object to the processing of your data. Most of it you can do yourself in Settings: edit your profile, make your shelf private, download your data or delete your account. For anything else, write to librarian@bookshelf.page. We reply within one month.

If you think we're not handling your data correctly, you can complain to the Spanish Data Protection Agency (aepd.es) or the authority in your country.

Children

Bookshelf is not meant for children. You must be at least 14 years old (or the minimum age in your country) to create an account.

Changes

If we change this policy in a meaningful way, we'll update the date above and, for important changes, let you know by email or on the site.

Privacy Policy · Terms of Use