Privacy

Where Books Go follows books through Little Free Libraries, used bookshops and the other places books change hands. When you log a book you take or leave, that log becomes one stop on that book’s public journey. Building a shared record of where books travel is the whole purpose, so the information you add here is mostly meant to be seen.

Your email address and password. To sign you in and nothing else. Passwords are handled by Supabase Auth and stored hashed — they are never visible to us or to anyone. No marketing email is sent, because there is none to send.

Your username. Required, and public. It appears next to every log you don’t mark private, and it’s how your profile page is reachable.

Your home city, if you give one. Optional, and public on your profile. Alongside it a deliberately coarse coordinate is stored — rounded to roughly a kilometre — which drives counts like “readers from twelve places”. A precise location is never written there.

The books you log. Every take and drop: the book, the place, the time, and whether it was the same copy someone else logged. This is the record the app exists to keep, and it is public.

Notes you write on a log. Up to 500 characters, public unless you mark the note private. Please treat these as public writing — and see the erasure section, because notes are the one thing that leaves with you.

Locations you add to the map. Their coordinates, a name and description if you give one, and a photo if you take one. All public: a map of locations nobody can see would not be much of a map.

Badges you earn. Counts derived from your logs, plus a record of which badge animations have already played so you aren’t shown the same one twice.

If you allow it, the browser’s location is used to centre the map near you and to point the crosshair at roughly where you are standing. That reading is never stored. What gets saved is the point you deliberately place on the map, which is a statement about where a location is, not about where you were.

Declining the permission costs you nothing but a bit of panning. The app is built to work either way.

Anyone, signed in or not, can see: your username and profile, your home city if you set one, your badges and counts, every log you haven’t marked private, every note you haven’t marked private, and every location you have added.

Nobody can see: your email address, your password, or which account logged a private event.

One consequence worth stating plainly. The counts and badges on your profile include your private logs, because they are facts about your own reading and your own profile should not lie to you about your life. So a private stop can move a number without appearing in the list underneath it. Marking a log private promises your name won’t be attached to it — not that it never happened.

There are no advertisers, no analytics providers, and no data brokers involved. Four other parties are, and each for one specific reason:

Supabase. Hosts the database, the sign-in system and uploaded photos. They hold everything described above, as our infrastructure provider.

Vercel. Hosts and serves the app, and therefore handles the network requests that reach it.

OpenStreetMap. The map tiles are fetched by your browser directly from OpenStreetMap servers, so they receive your IP address and can tell which areas of the map you looked at. This is the ordinary behaviour of a web map, and it’s the trade for not running our own tile servers. Their region lookup is also used once per new location — sent by our server, not your browser, so your address is not involved.

Open Library. Book details come from Open Library. Searches are sent by our server, so Open Library does not see who searched. Cover images, however, are loaded by your browser straight from their servers, so they receive your IP address and which covers you were shown.

If you sign in with Google, Google is involved in that sign-in in the usual way. Using email and password instead keeps them out of it entirely.

A log you make with no signal is kept in your browser’s storage on your own device and sent when the app next opens with a connection. Until then it exists nowhere else. The app also keeps a copy of its own code and one offline page so it can open without a connection; no page belonging to any account is ever stored that way, because a browser’s cache is shared by everyone who uses it.

Cookies are used only to keep you signed in. There are no advertising or tracking cookies, so there is no consent banner to dismiss.

You can erase your account whenever you like, from your profile. No email, no waiting, no one reviewing it. It removes your sign-in, your username, your home city and coarse home area, your badges, any sticker orders, and every note you have written.

What it deliberately leaves behind is the logs themselves. They stay on each book’s journey with no name attached and no link back to you — indistinguishable from a log somebody marked private. This is the one part that isn’t your choice, so here is the reason: a stop is the middle of somebody else’s book’s history. Deleting it would not leave a gap in that history, it would close the gap up, and the two stops either side would join into a journey the book never took. Removing you should not silently rewrite where other people’s books went.

For the same reason, locations you added stay on the map, along with any photo of the place, no longer connected to you. They are pictures of a public place that other people are now relying on.

After erasure there is no way to reconnect those records to you, by us or by anyone else. That is what makes it an erasure — and it is also why it cannot be undone.

Your profile already shows everything held about you in readable form. If you want something corrected, or want a copy of it, or have a question this page doesn’t answer, write to privacy@wherebooksgo.com.

This app isn’t intended for children under 13, and accounts aren’t knowingly created for them. If you believe a child has made an account, write to the address above and it will be removed.

If this policy changes in a way that affects what is collected or who sees it, the date at the top changes and the change is described here rather than quietly folded in.