Privacy

Shelf photos are read, then deleted

When you photograph a shelf, the picture is read for titles and formats and is then gone. It is never saved to our storage and never attached to the items it produced. The photo stays in your browser only while you are reviewing the list it produced, and disappears when you leave that screen.

A copy is sent to our reading provider for the seconds it takes to identify the titles. That provider is contractually barred from using it to train models. Nothing about the room, the people or anything else in frame is stored.

What we do store

Your email address and display name, the name and theme you gave your library, the items you catalogue and the details gathered about them, your collections, and the questions you ask about your collection so the conversation makes sense. Subscription state comes from Stripe: whether you are paying, on which plan, and until when.

What we never store

Card numbers — Stripe handles payment and we only receive the outcome. Shelf photos, as above. We do not run advertising trackers, we do not sell or rent your data, and we do not use your catalogue to advertise to you.

Cover art

Cover images are linked from the sources that publish them rather than re-hosted, with the source recorded alongside. A title with no cover we can verify simply shows no cover; we would rather show nothing than the wrong picture.

Who else is involved

A small number of providers make the service work: hosting and the database, Stripe for payments, email delivery for sign-in and account messages, and the reading and lookup providers used to identify titles and gather details. They act on our instructions only.

Your control

Export your whole catalogue at any time from your account page, on any plan. Delete your account there too: your library, profile and sign-in are removed permanently, and shared reference facts about released titles stay behind because they were never personal to you. You can correct any detail we filled in, and your corrections are never overwritten.

Keeping it safe

Your library is readable only by your own signed-in account, enforced in the database rather than only in the app. Traffic is encrypted in transit. If a breach ever affects your data, we will tell you.