What we store
To run your account we keep: your email address and a hashed password (we cannot see the password itself), your profile (display name, username, optional photo, bio, pronouns, language), and your reading preferences: genres, tropes, and any content you asked us to avoid showing you.
As you use Booklabria we also store what you create and do here: your shelves and reading progress, reviews and ratings, posts and comments, follows, ARC applications, and (for authors) books, series, campaigns and pen-name details.
Photos you upload
An avatar, a profile cover or a book cover you upload is re-encoded on our servers before it is stored: it is resized to three sizes, and every embedded tag (location, camera, timestamps, software) is removed, so a photo never carries where or when it was taken. Uploads are limited to ten a day. Anyone can report a photo; while a report is open the photo is shown to nobody but moderators, and a moderator may remove it and restore the default, in which case you are told. Removed photos are not shown again.
Books that are not published here
Your shelves can hold books no Booklabria author has published. Their title, author, ISBN and cover come from Open Library (openlibrary.org), an open catalog; we look them up from our servers when you search or import, keep a copy of the record and the cover so the book stays on your shelf, and never send Open Library anything about you, not your account, not your address, not what you shelved. A library export you upload (Goodreads, StoryGraph) is read for titles, authors, ISBNs, shelves, ratings and dates only; reviews and notes in the file are not read. You can remove an import from your list at any time.
Letters by e-mail, and the address an author may export
An author cannot see your e-mail address. On an author's page you may tick one box, “Also send me the author's letters by e-mail. The author can export your e-mail address.” Ticking it does two things, both in those words: Booklabria delivers that author's letters (their “Letter to readers” entries) to your address, in full, and the author may export your address, with the date and the words you agreed to, and write to you from their own tools. Nothing else is shared: following an author without the box gives them a follower count, never your address. Every export an author makes is recorded (who, when, how many addresses). Unsubscribe in one click from any letter, in Settings › Notifications, on the author's page, or by unfollowing; from that moment no letter is sent to you and your address is left out of every export they make. What an author does with an address they exported earlier is between you and them, under their own law; the export tells them so on its first lines.
A letter carries a one-pixel image that tells the author, as a total and never by name, how many readers opened it; the button in the letter and a signed-in read on the site count as a read the same way. Replies by e-mail are not open yet: a reply to a letter comes to Booklabria, not to the author, and is never published. To answer a letter, comment under it on Booklabria, public like any comment, under your Booklabria name.
Push notifications and the installed app
If you turn on push for a device, your browser gives us an address for that device and two keys that let only that browser read what we send; we store them with your account and show you the list of devices in Settings › Notifications, where any of them can be removed. A push carries only what the bell in the app would show: a title and one line, which can name another person or a book of yours. It follows the same category choices, and it never carries a sign-in or a secret code. When a device stops accepting pushes we stop sending to it and say so. The installed app keeps only its own icons and an “offline” notice on your device — never a copy of a page.
Analytics without raw IP addresses
We measure Booklabria with our own first-party events, not third-party trackers. There are no advertising pixels and no data brokers. Analytics events never store your raw IP address; visitor counting uses a hash that is re-salted daily, so it cannot be joined across days to build a long-term profile of you.
Who handles your data for us
We run Booklabria with the help of a few outside companies. Each does one job for us, and we give each only what that job needs.
- Render, our host. It runs the app and holds the database, in Oregon in the United States. It also keeps request logs, which include the address a request came from, for a limited period.
- Cloudflare R2, our file storage. It keeps the files uploaded to Booklabria: photos, advance-copy files, book samples and your data exports. The storage is private; files are served through Booklabria itself, never straight from the storage bucket.
- Resend, our e-mail service. It sends every e-mail we send, so it receives the recipient's address and the message, and it tells us when a message could not be delivered.
- Sentry, our error reporting. When something breaks, a report goes to Sentry, from our servers or straight from your browser. It says where in the code it failed and what kind of error it was, and it names you by account number at most. E-mail addresses, cookies, the contents of what you submit and the secret codes in our invitation, delivery, confirmation, reset, unsubscribe and shared-Wrap links, in their address or their query string, are removed before a report is sent.
- Stripe, for payments, once they start. Payments are off during the beta. When they start, you will enter your card on Stripe's own page, so card details go to Stripe and never to us. We send Stripe your e-mail address and name to set up your billing account, and we keep your card's brand and last four digits, plus a code Stripe gives for the card, never the card number.
- Anthropic, for Ask Booklabria. Ask Booklabria is our help assistant: it answers from our help articles, with a language model from Anthropic writing the answer. The question you type, up to the last twenty messages of that chat and the help articles it found are sent to Anthropic. We don't send your name, e-mail address or account details, only whether you are signed in.
- Your browser maker's push service (Google, Mozilla or Apple, depending on your browser), if you turn on push. It carries the notification to your device. It can see that a push was sent, but not what it says: only your browser can read the content.
Ask Booklabria keeps your last chat for seven days if you are signed in, so it is there when you come back; Start over clears it. A chat as a visitor is never stored. A question it could not answer is kept for thirty days, with the page you asked it on (and your account, if you were signed in), so our support team can improve the help.
Keeping one person to one account
Some things on Booklabria are free for each person: an author's free plan, a campaign's free copies, a book's rating. So that one person can't open many accounts to collect several free plans, or to review their own books, we keep a few scrambled codes for each account. Each code is a fact run through a one-way scramble with a secret key, so what we store in a code can't be turned back into the fact. We make a code for:
- the network you sign in from: the first part of your IP address, which many people on one connection share (your full address is never part of it)
- your device: a few things your browser says about itself, such as its time zone, language, screen size and kind of browser
- the web domain of your e-mail address, unless it belongs to a public service such as Gmail, which says nothing about you
- the websites an author lists on a profile
- the book file an author uploads for an advance copy
We make them when you sign up, when you sign in, and when you save a website or upload a book file. When payments start, the code Stripe gives for a card (never the card number) will count the same way.
The codes are never shown to you or to other readers or authors. Only a few people on our team (moderators and admins) can see which kinds of code two accounts share, never what a code stands for. Sharing one kind means nothing: a family can share a computer. When two author accounts share two or more kinds, the pair goes to a person on our team, and neither account can open a new advance-copy campaign until that person decides; every decision is written down with its reason. A review of an author's book is kept, but doesn't count toward the book's rating or the Charts, if it was written from the author's own account, from an account that shares two or more kinds of code with the author's, or from one the team decided is the same person.
To slow down mass sign-ups we also count how many accounts are created from one network in a day (three are allowed), against that same kind of scrambled network code, with no name attached.
These codes are deleted with your account, thirty days after you ask to delete it. If our team closes an account for abuse, it may also keep a scrambled code of the e-mail address, and sometimes of the device, for a year, so that it can't simply sign up again.
One thing is kept differently. The record of a book keeps a plain fingerprint of the book file an author uploaded for an advance copy and of an uploaded cover, so that the same file can't be listed as two live books. These two fingerprints are not scrambled with a key, and they stay with the book's record after the account is deleted.
Who can see your activity
You control what your profile shows: your whole profile can be public, followers-only or private, your library, reading progress, activity and follower lists can each be switched on or off, and your ARC record can be shown to followers or everyone or kept to the authors you request from. Blocking someone hides you from each other entirely, in both directions.
- Reviews you publish are public alongside the book, under your name.
- Posts carry the audience you chose at publish time: Public, Followers, or Only me.
- Authors see aggregate reader metrics (like monthly readers), never a list of who read what. Beyond the ARC delivery records described below.
ARC files and delivery records
Advance copies are delivered through signed links that expire after fifteen minutes, with a per-application download limit. Every download is logged (which application, when, and how many times) because that log is the author's protection for an unreleased manuscript. The author of a campaign can see your application, your compatibility score, your delivery status and your ARC reliability history; they cannot see the rest of your private library. Your ARC record is on your profile only if you choose: in Settings › Privacy, “Advance reader record” starts at “Only authors I request from”, and you can open it to followers or everyone.
Send to Kindle
If an author offers Send to Kindle on an advance copy and you choose it, you give us your Kindle address, the one Amazon gives your device, ending in @kindle.com or @free.kindle.com. We keep it with your account, in Settings › Account, where only you can see it and where you can change or remove it. No author ever sees it. It is part of the copy of your data you can download, and it is deleted with your account. We e-mail the book to that address as an attachment, through our e-mail service, with the same hidden watermark code as a download; Amazon delivers it to your device under Amazon's own terms. We log each send (which copy, when, how large) but not your address, and a copy can be sent five times.
Highlights and notes
In an advance copy you read on Booklabria you can highlight passages and write notes. We keep them with your account, and only you can see them: no author, pen name team or operator screen shows them, and the author sees no count of them. They are part of the copy of your data you can download, and they are deleted with your account. When reading on that copy closes, we keep your notes for thirty days after our daily check sees that it has closed, and send you a notice seven days before they are deleted, as your notification settings allow. The date they will be deleted is kept where no author can read it.
What we never do
- We do not sell or rent your data to anyone.
- We do not run advertising and do not build ad profiles from your reading.
- We do not collect payment details. Payments are disabled platform-wide during the closed beta.
- We do not read direct measurements of you off-platform; everything above is data you gave us or created here.
Your controls
You can edit or delete your profile details, posts, comments and reviews at any time, and deleted content is removed from view immediately. You can download a copy of your data yourself from Settings › Privacy, and delete your account from Settings › Account. Deleting your account hides your profile, posts, comments and reviews immediately and signs you out. Thirty days later the account is permanently deleted. That removes the rows tied to it and every file of yours: photos, data exports, the manuscripts of your campaigns and of any delivery link, book samples and free stories, and a document you sent for a professional verification that was still waiting. It also removes the log of the e-mails we sent to the address on your account, your request on the waiting list if you made one, and the name on your own billing account. Within those thirty days our team can restore the account if you write to us; after them nothing can.
What we keep is a one-line record that an account was deleted (a hash of the address, the account's old id and type, the dates, and counts of what was removed; no name and no address), the moderation trail with its link to your account removed, and financial history kept without a link to your account. If our team closed the account for abuse, that also includes the year-long sign-up block described under “Keeping one person to one account”.
A reading circle you founded passes to its longest-standing moderator, or else its longest-standing member; one with nobody else in it goes with the account. If you are an author, your books stay as a record under your pen name, unpublished drafts included, and readers who shelved or reviewed them keep that. Their files and the covers you uploaded, your campaigns, your analytics and everything you posted are removed; the plain fingerprints described under “Keeping one person to one account” stay with each book's record. For anything else, including a question about what we hold, email support@booklabria.com.
Closed beta caveats
Booklabria is in closed beta. Some screens show clearly fictional demo books and profiles while features are completed, and features may change between visits. If a change affects what we store about you, we will update this policy and move the date at the top. We will not change the substance quietly.
Questions
Write to support@booklabria.com for anything privacy-related, or see the Help center for how-to questions. A human answers both.