Privacy Policy

Who is responsible

The controller of your personal data is Daniel Olsson, Bokvägen 6, 575 31 Eksjö, Sweden. Contact: dataaster@gmail.com.

What we process, and why

• Signing in with Google (optional). If you sign in, Google tells us your name, email address, whether the address is verified and your Google account ID. We store exactly those, plus a session (a random token with its creation, last-update and expiry times) so you stay signed in. We do not store your profile photo or any Google tokens. Your IP address is used briefly in memory to rate-limit sign-in and token requests (legitimate interest, Art. 6(1)(f)); neither it nor your browser details are stored. Legal basis for the account and session: providing the account you asked for (GDPR Art. 6(1)(b)). The session cookie is strictly necessary for signing in; we set it only when you sign in and it needs no separate consent.
• Your searches. The text you type (a mood, an interest, books you liked) is sent to our API and on to Anthropic, which writes the recommendations. We do not store your search text in our database. Legal basis: providing the recommendations you asked for (Art. 6(1)(b)). Please don't put sensitive personal information in a search.
• The daily search limit. Searching without an account is limited to 3 per day, and searching while signed in to 30 per day. To count them we store a keyed hash (HMAC): when you are not signed in, of your IP address combined with a random ID your browser keeps in local storage, and also of your IP address alone (for IPv6, the network prefix, the first 64 bits, rather than the full address), which caps all searches without an account from one network at 20 per day (so on a shared network, such as an office or school, the free searches can run out sooner; signing in avoids this); when you are signed in, of your Google account ID (or, if we can't read it at that moment, of your Bookworm account ID). The raw IP address, browser ID and account IDs are never stored in the counter. Counts older than yesterday (UTC) are deleted automatically. Legal basis: our legitimate interest in keeping a free service affordable and protected from abuse (Art. 6(1)(f)). You can object, see "Your rights" below. A signed-in count is tied to you through that hash, so it is personal data. Deleting your account does not remove it right away: the hash can outlive the deletion, and the count stays in effect until the end of that UTC day, so signing up again with the same Google account on the same day continues the same count rather than starting a fresh one. The stored row itself is deleted automatically within one to two days.
• Your reading list. Books you save are kept only in your browser's local storage on your device. We never receive them, unless you mark one as read or rate it while signed in (see the next item). The last search you ran (your query and the books it returned) is kept in your browser's session storage, for this tab only, so that going back to the page doesn't search again; it disappears when you close the tab and is never sent to us.
• Books you mark as read and rate (only when signed in). If you mark a book as read or give it 1 to 5 stars, on your list or on a search result, the book is also saved to your list (except in the "Books you've marked elsewhere" section of your list page, which only shows marks already stored), and we store, against your account, that book's ID, title and authors, the date you first marked it read, your rating, and the time of the last change. We store this so we can show it back to you the next time you open your list. When you are signed in and search, our API also reads up to 30 of these marks and ratings to tailor the picks and to leave out books you have already read. The titles and authors of those books, with your ratings, are sent to Anthropic as part of that search request; your name, email address and account ID are not. Legal basis: providing the feature you asked for (Art. 6(1)(b)). Without an account, nothing is sent: your list itself stays on your device.
• Your optional profile (only when signed in). After you sign in we ask whether you would like to share a gender (woman, man, non-binary or prefer not to say) and a birth year. We keep asking, at most once per browser tab session, until you answer or skip; closing the question without answering does not count. Both answers are optional, you can skip the question, and you can change or clear your answers at any time on your account page. If you answer or skip, we store those answers (or that you skipped), against your account, with the time you first answered or skipped and the time of the last change. When you are signed in and search, our API reads them and sends an age band (such as 30-39, never your exact birth year) and your gender, if you gave one other than "prefer not to say", to Anthropic as part of that search request. They are only a soft hint: your request always comes first. Your name, email address and account ID are not sent, and nothing is sent to anyone else. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw by clearing the answers.
• Hosting and logs. Our host, Vercel, handles each request and keeps technical logs (such as IP address, time and requested page) for security and operation. Legal basis: our legitimate interest in running a secure service (Art. 6(1)(f)).
• Visitor statistics. We use Vercel Web Analytics to see how many people visit which pages and where they come from (the referring site or a campaign tag in the link). It sets no cookies and does not follow you across websites or build a profile of you; it reports aggregated page views. Briefly, it uses your IP address and browser details to derive your country, device type and a daily visitor count; these are not stored with the page views. The text of a search (the part of the address after ?q=) is removed from the address before it is sent, so what you search for never reaches it. Legal basis: our legitimate interest in understanding how Bookworm is found and used (Art. 6(1)(f)). You can object, see "Your rights" below.

We do not use advertising cookies, and we do not sell personal data.

Who processes data for us

• Anthropic receives your search text to generate recommendations and, when you are signed in, the titles, authors and ratings of books you have marked and the age band and gender you have chosen to share.
• Google authenticates you when you choose "Continue with Google" and sends us your name, email address, verified flag and account ID.
• Vercel hosts the website and the API, and sees requests and technical logs. It also provides Vercel Web Analytics, which receives aggregated page views and referrers, with search text removed from addresses.
• Neon hosts our database: account and session records, your read marks and ratings, your optional profile, and the search counters.

These companies are based in or operate from the United States as well as the EU. Where personal data leaves the EU/EEA, the transfer relies on the European Commission's adequacy decision for companies certified under the EU-US Data Privacy Framework, or on the Standard Contractual Clauses in the provider's data processing terms. Book details and covers come from Open Library; those requests contain book titles, not you. The one exception is the "Add books you've already read" search on your reading list: the text you type there is sent from our server to Open Library to find matching books. We don't save it (our host's request logs may briefly include it), and Anthropic is not involved. The same goes for clicking a book's cover to read its description: only then does our server ask Open Library for it, and the request contains the book's Open Library work number, never your search text or anything about you.

How long we keep it

• Account data (name, email, verified flag, Google ID): until you delete your account. Sessions expire on their own, about a week after you last use Bookworm, and are deleted with the account.
• Read marks and ratings: until you un-mark the book, remove it from your list while signed in, remove it from the "Books you've marked elsewhere" section of your list page, or delete your account, which deletes them immediately. (Clearing only the rating keeps the read mark.)
• Optional profile (gender, birth year): the answers stay until you clear them or delete your account. Clearing removes the values, but the record that you have answered (with the time you first answered and the time of the last change) stays until you delete your account, which deletes everything immediately.
• Search counters (by IP address and browser ID, by IP address alone, or by Google account ID or account ID): for about one to two days; older ones are deleted automatically, also after you delete your account.
• Search text: not stored by us. Anthropic handles it under its own terms.
• Visitor statistics: aggregated page views are kept by Vercel under its terms; the visitor count is computed daily and not stored with them.
• Hosting logs: as long as Vercel keeps them under its terms.

Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict how we use it, or to receive a copy you can move elsewhere. You can object to processing based on our legitimate interest, and you can withdraw any consent you have given. You can delete your account and its data yourself at any time on the account page, or write to us at dataaster@gmail.com.

If you think we handle your data unlawfully, you can complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY): imy.se.

Changes

If we change what we collect, we update this page and its date. Signing in is optional: Bookworm works without an account.