Privacy

Everything you add stays in this browser.

Readers, books, what is finished, which badges were earned: all of it is written to a database inside this browser on this device, and none of it is sent anywhere. There is no account, so there is nothing about you to hold. There is no analytics, no tracking, no advertising, no error reporting service, no third-party script and no font fetched from someone else's server.

The one exception

When you scan a book, the number from its barcode (its ISBN) is sent to Open Library, the open book catalogue run by the non-profit Internet Archive. That is how the title, the author and the cover arrive without anybody typing them.

Being plain about what that means: it tells Open Library that somebody at your address looked up that book, at that moment. Nothing else goes with it. Not who is reading it, not what is already on your shelf, not a name and not an identifier. There is no identifier to send. But it is a request to someone else's server, and that is the honest description of it.

You can switch it off. There is a switch in Setup, and with it off no request is made at all. The app stays completely usable: you type the title, the author and the page count yourself, and a book added that way counts exactly the same as any other. It even earns a badge.

A second source helps with the books Open Library is thin on: Google Books. When Open Library does not know a book — or knows only half of it — the same number is also sent to Google to fill the gaps. Nothing else goes with it, but Google is a company, not a non-profit, which is why it has its own switch in Setup, separate from the first one.

One other moment sends the number, and you choose it: the “Look this book up again” button in a book’s own details asks the same catalogues the same question, for a book that arrived half empty. Nothing else goes with it either.

A cover is fetched once and then kept in the local database, so the shelf still draws itself with no connection and the same cover is never asked for twice. The image itself comes from the Internet Archive's servers, the same non-profit that runs Open Library.

Your backups are yours

Saving a copy of your shelf produces a file, and that file goes wherever you put it. It is not uploaded and there is no copy of it here. That is the other half of the deal: because nothing is on a server, nothing can be recovered from one. If you clear this browser's data, or the shelf lives in a private window that you close, it is gone. The backup file is the only thing that survives that, so make one.

Hosting, and how we know anyone uses this

The app's files are served by Cloudflare. Like any host, Cloudflare sees the requests that fetch those files (the page, the icons, an update) with the network address they came from, and shows us aggregate counts of them. That is our whole picture of usage: enough to know the app is alive and roughly how many people open it, and nothing more. There is no analytics script in the app, no cookie, no identifier. And nothing that happens inside it, what is on your shelf or who reads what, is ever part of any request. The app's own security policy would block a tracking script even if one were added by mistake.

Children

This was written for a child to use. Nothing she does in it is collected, nothing is shared outward, there is no feed, no profile, no way to publish anything and no way for anyone to contact her through it.