Privacy Policy

1. Who we are

Bookish is an independent reading-list app at getbookish.app, run by Norwell LLC ("Bookish," "we," "us"). Questions or requests about privacy go to hello@getbookish.app.

This policy covers the Bookish app and website. Services you reach from Bookish, such as the book catalogs listed below, have their own privacy policies.

2. What stays on your device

Bookish keeps your library in your browser's storage on each device so it works offline. Before you create an account, the books you add exist only there. Anyone who can use that browser can see them.

When you sign out, or delete your account, Bookish clears the copy of your library stored in that browser.

3. Your account and encryption

When you create an account, your device turns your email address and password into encryption keys (using Argon2id). Your password never leaves your device. Everything you save is encrypted on your device (AES-256-GCM) before it's uploaded.

Our servers keep:

• Your encrypted records, which we can't decrypt.
• Locked copies of your encryption keys. Only your password, your 24-word account key, or a passkey you set up can unlock them.
• Account identifiers computed from your credentials with one-way functions. They don't reveal your email address or password.
• Account settings, such as your storage limit.
• A record of each signed-in session: a device label, when the session started, and when it was last used.

Because your password unlocks your data, we can't reset it. If you forget it, you can get back in with your account key or a passkey. If you lose all of them, your data can't be recovered by anyone, including us.

4. Your email address

• On your device: your email is part of what your encryption keys are made from.
• At sign-up: your device sends your email to our server once so we can send a welcome email through our email provider, Resend. We don't save it. Resend keeps delivery records under its own privacy policy.
• Finding friends: your account stores a one-way value computed from your email address, so the sharing system can find you. Someone who already knows your email address could use it to check whether that address has a Bookish account. It doesn't let them read anything.

Because we don't keep a list of email addresses, we can't email you announcements, and we can't look up your account from your email address.

5. Friends and sharing

You connect with a friend by sending them an invite link. Each link works once and expires after 7 days.

• What friends see. Once you're connected, your friends can see the books on your shelf, along with your display name, and you can see theirs. Books you mark as private stay off your friends' shelves.
• What we see. Shared books are encrypted so that only you and your friend can read them. Our servers do keep some information about sharing activity: when invites are created and used, and the account identifiers attached to shared records. We can't see the books, notes, or names you share.
• Removing a friend or making a book private stops sharing from then on. Anything your friend already saw could have been copied, and earlier encrypted shares stay on Arweave (see section 7).

6. Book search and covers

When you search for a book or pick a cover, your device contacts these services directly. We don't route or log these requests.

• Open Library (Internet Archive): titles, authors, and search text; cover images.
• Apple (iTunes Search): search text, for audiobook results and artwork.
• Google Books: ISBNs, to find editions.
• Amazon: cover images, requested by ISBN.

Like any website your browser visits, these services receive your IP address and basic browser information along with the request. The cover you choose is saved inside your encrypted book record.

7. Permanent storage on Arweave

Your encrypted records are uploaded through our servers to Arweave, a public network designed to store data permanently. We use ArDrive's Turbo service to upload them.

• It's permanent. Nobody can delete data from Arweave: not you, not us, not Arweave.
• It's public but encrypted. Anyone can download the encrypted bytes. Without your password, account key, or passkey, they're unreadable.
• Some labels are public. Each upload carries a few public labels, such as the record type, the time it was written, and an account identifier that doesn't reveal your email.

Because the encrypted copies are public and permanent, your password and account key are what keep them private. Use a strong password you don't use anywhere else, and keep your account key safe.

8. Services we use, and what they see

• GitHub Pages hosts the Bookish website and app files. GitHub receives your IP address when your browser loads them.
• Cloudflare runs our servers and stores the encrypted records, account data, and logs described in this policy.
• ArDrive Turbo and Arweave receive and store your encrypted records.
• Resend receives your email address to deliver the welcome email.

We don't take payments today. If we ever offer paid plans, a payment processor will handle your payment details, and we'll update this policy first.

9. IP addresses and logs

• Abuse limits. We use your IP address, in a hashed form, to limit how fast requests can be made, for example sign-ups. These counters expire after about an hour.
• Security log. When you view or change your account key, or add, use, or remove a passkey, we record the time, a hashed form of your IP address, and your browser's user-agent string. We keep these entries for 90 days to help spot misuse of an account.
• Server logs. Our servers' request logs, including IP addresses, are kept by Cloudflare for about a week or less, for troubleshooting.

10. No ads, analytics, or tracking

Bookish has no ads, no analytics, and no third-party trackers. Our fonts are served from our own site. We don't use cookies. The app uses your browser's storage (IndexedDB, localStorage, and sessionStorage) for your library, your sign-in, and your preferences, and a service worker so the app loads offline.

We don't sell your data, use it for advertising, or use it to train AI models.

11. Deleting your account

You can delete your account in the app under Account & Security. Here's what happens:

• Deleted right away: your account record, including the locked copies of your keys, your settings, and the value used for finding friends, along with all of your sign-in sessions. Every device is signed out.
• Added: a public deletion marker on Arweave, so recovery tools can tell the account was deleted.
• What remains: your encrypted records on Arweave, permanently. Encrypted copies we keep on our servers to make syncing faster, and records of past sharing activity, also remain. All of it is unreadable without your keys. Security log entries expire after 90 days, and unused invites expire after 7 days.

If you want a copy of your books, download one from Data Export before you delete your account.

12. Your choices and rights

You can do most things yourself in the app:

• See and export your data: your whole library is in the app, and Data Export downloads a copy. The Forever page can recover your books straight from Arweave using your account key, or your email address and password.
• Correct it: edit any book, change your display name, or change your email address or password under Account & Security.
• Delete it: see section 11.

Depending on where you live, you may have legal rights to access, correct, or delete personal information, and to opt out of its sale. We honor these for everyone. We don't sell or "share" personal information as California law defines those terms, so there's nothing to opt out of. Email hello@getbookish.app with any request. Because we don't store names or email addresses, we usually can't match a request to an account from an email alone, so we may ask you to complete it in the app.

13. Children

Bookish isn't meant for children under 13, and they may not create an account. If you believe a child under 13 has an account, email us and we'll help remove it.

14. Where data is processed

Bookish is run from the United States. Our servers run on Cloudflare's global network, and Arweave stores data on computers around the world. By using Bookish, you understand that your information is processed in the United States and other countries.

15. Security

We protect your data with encryption on your device, HTTPS for every connection, and rate limits on our servers. No system is perfectly secure. If we learn of a breach that affects you, we'll post a notice in the app and on this site explaining what happened and what you should do.

16. Changes to this policy

If we change this policy, we'll update the date at the top. For important changes, we'll show a notice in the app at least 30 days before they take effect.

17. Contact

Questions, requests, or security concerns: hello@getbookish.app.