Privacy Policy
This describes what BookOrbit stores, why, who else sees it, and how long it stays. It was written by reading the code rather than a template, so it also names the places where a column exists but nothing writes to it yet, and the places where a promise on the page is ahead of the implementation.
Who this is for, and who it is not for
This policy covers everyone who uses BookOrbit. BookOrbit is not intended for anyone under 16 — there is no age check in the product, so if a child has made an account, tell us and we will remove it. If you want to know who the data controller is, it is named at the foot of this page and in the Terms.
What we collect, and why
Your account: name, email, an optional pen name, the account type you chose at sign-up, the name and website of the imprint you publish under if you give them (visible to our staff, never shown on your profile), whether your address has been confirmed, the plan you picked before registering, your plan and trial dates, and whether you want reminders about adding a review link. Your activity: the books you shelve (title, description, genre, language, marketplaces, the ASIN, the PDF if you upload one and the number of pages counted from it), the feedback requests you open with the number of readers you asked for, the tasks you take with their timestamps, the feedback you write with its rating and text, and your bookmarks. Your points: a ledger of every point credited to your account or taken back, with what caused it — a book taken, a deadline missed, a request opened or closed, a moderator’s correction and the reason given. Your sessions: a session token, and the IP address and browser user-agent that our authentication library records with it. Staff actions: an append-only log of moderation decisions and of every book file download, recorded against the account that made it. If you write to us through a contact form, the message, its subject, your email address so somebody can reply, the language you were reading the site in, and a one-way hash of your connection. If you tell us that you also published your review in a shop — optional, and offered for a week after you send feedback — the link you paste or the screenshot you upload, and the moment you gave it. Both are deleted as soon as a member of staff has looked; what remains is a count of how many of your reviews have been confirmed. If you turn on two-step sign-in: a secret shared with your authenticator app and ten single-use backup codes, both stored encrypted, and whether you have proved the app works. We cannot read either of them back — not through any screen, and not on request.
The lawful basis for each kind
Your account, your books, your feedback requests, your tasks, your points and the feedback you write are processed to perform the contract you entered when you signed up — without them there is no service. Sessions and the download record rest on legitimate interest in keeping accounts secure and knowing that a manuscript was served to someone entitled to it. Moderation decisions, the staff action log and messages you send us rest on legitimate interest in running a platform that authors can trust with unpublished work and in answering the people who use it. One thing rests on your consent: the retailer link or the screenshot, if you choose to give one. You give it by choosing to, you can withdraw it yourself at any point before a person has looked, and refusing changes nothing — which is what makes it consent rather than a condition. Beyond that we rely on consent for nothing, because we do nothing else that would need it — no advertising, no profiling, no non-essential cookies. We do keep one tally — how many pages were opened each day, and from which country — and it needs no consent because it records nobody: there is nothing in it that could say two views were the same person.
Device records, and why we keep them
Authors put unpublished manuscripts on this site, and a PDF that leaks is a book that cannot be sold. Knowing which account a file went to is how we protect other people’s work, and we would rather say that plainly than file it under anti-fraud. So here is what it costs you. Every time you sign in or sign up, one row is written saying your account was seen from this device. It holds two keyed hashes — HMAC-SHA256, cut to thirty-two characters — one of the address your connection comes from, one of that address and your browser’s user-agent string together, plus a count of how many times that pair has been seen and the first and last time it was. The address itself is never stored, and neither is the user-agent. Signing in again from the same machine and the same connection does not add a row; it moves the counter by one. Change either and a new row appears, because the address is part of what is hashed. At sign-up the address hash is also stamped on your account. The key that makes these hashes is a secret held on our server, so they cannot be turned back into an address, and the table is worth nothing to anyone who takes a copy of it without that key. There is no script in your browser measuring your screen, your fonts or your canvas — this is built from two things every request already carries. The rows do one automatic thing: where another member’s account shares a device or a connection with yours, the two of you are refused each other’s tasks. That is the whole of it. Nobody is suspended by this, nothing is deleted, no account is closed. Tracing a leaked manuscript is done by the download record described above, which names the member, the book and the task the file was taken against; the device rows are what tie two accounts together when they turn out to be one person. The other automatic signal is unchanged: a count of the tasks you let expire raises a score staff can see, and that score lowers how many tasks you may hold. The basis for all of this is legitimate interest — ours in keeping the exchange honest, and every author’s in their own unpublished book. You can object to it, and the section on your rights says how. Closing your account deletes your device rows and clears the sign-up hash from your account, which is what that section promises. You should know that nothing else removes them: no job ages these rows out, so for as long as your account is open they stay.
No advertising, no profiling, no sale
We do not sell or share your data, we do not advertise, and we do not build profiles for advertising or run automated decisions with legal effects on you. There is no analytics SDK, no error-reporting SDK and no tracking pixel in this application — we checked, and there is nothing to remove. What we count instead is one number per day per country: how many pages were opened. There is no identifier in it, so it cannot tell one reader who opened ten pages from ten readers who opened one — finding that out would mean giving your browser a mark of its own, and we would rather have the vaguer number. Obvious crawlers are left out of it. Fonts are self-hosted at build time specifically so that loading a page does not send your IP to a font provider, and book cover images are fetched by our server rather than your browser, so retailers do not see your address either. Three cookies are set, all strictly necessary and none used for tracking: one keeps you signed in, one remembers the language you chose, and one holds a sign-in that is waiting for its second step — that third one lasts ten minutes and is set only while you are completing one. Your choice of light or dark theme is kept by your own browser and never reaches us.
Who else touches your data
Neon hosts the Postgres database, which means everything listed above. Vercel hosts the application and receives request and function logs. Vercel Blob stores book PDFs, and any review screenshot you choose to upload, in a private store, reachable only through links we sign per request that expire in sixty seconds. Resend (Resend, Inc., United States) delivers the mail this service sends, which means Resend handles the message and your address; three kinds of message exist — a link that confirms your address when you register, which stops working after an hour; a password-reset link, which you ask for and which also stops working after an hour; and a message you send us through a contact form. We send no marketing mail. Paddle is our payment provider and the merchant of record for every paid plan: when you subscribe, Paddle — not BookOrbit — collects your card details, your billing address and whatever tax information your country requires, entered in Paddle’s own payment window and never reaching our servers, and we never see or store a card number. From Paddle we receive only your subscription status, the plan you bought, the renewal date and an identifier for the subscription, which is what tells this account it is paid up. Paddle is an independent controller of the payment data it holds, and its own privacy notice governs it. Google sign-in is connected. If you choose it, Google tells us the address on your Google account, your name and whether that address is verified, and Google learns that you signed in to this service; we send Google nothing else, and you can register with a password instead.
Where your data sits
The database is hosted by Neon in the United States (AWS us-east-1), and Vercel serves the application from its own global infrastructure. If you are in the EU, the EEA or the UK, that is a transfer of your personal data outside it, and it relies on the standard contractual clauses each provider offers. Moving the database to an EU region is the simpler alternative and is on the list; if it happens, this section changes and the change will be the first thing on this page.
How long we keep it
Sessions are set to expire after thirty days. Once a session has expired, the nightly job deletes the row — with the IP address and user-agent on it — along with any expired verification token. Uploaded files that no book row points at are deleted automatically a day after they are orphaned, and a book you remove from your shelf keeps its file for thirty days before it becomes one of those. Everything else — your books, feedback, tasks, points ledger, notifications and the staff action log — is kept until you ask us to remove it, and the staff action log is designed never to be erased, with your identifier removed. A retailer screenshot you give us is deleted the moment a member of staff has looked at it, and deleted unread after seven days if nobody does; a link is deleted when it has been looked at, or unread after thirty days — the retention periods on this page that the software enforces rather than a person. A two-step sign-in secret and its backup codes are kept until you turn two-step sign-in off or close your account, and go with the credentials either way. The daily tally of pages opened is kept for thirteen months, so that one October can be compared with the next, and then deleted by the nightly housekeeping.
Your rights, and how to use them
You have the right to access your data, correct it, have it erased, receive it in a portable form, object to processing based on legitimate interest, ask us to restrict processing, and complain to your data protection authority. You can correct your name and pen name yourself in Settings, and close your account there too — that removes your name, email address, pen name and the hashed signup address, and deletes your credentials, sessions and device records. One thing survives it on purpose: the record of separations you are part of, because a separation belongs to two people. For access, portability, restriction or objection, get in touch and a person will handle it by hand — those are not automated yet, and we would rather say so than imply otherwise. This page describes how the system actually works today; it is not legal advice.
How to reach us
Write to [email protected], or use the contact form.