Book Ratings, by Obscura Logic — effective October 18, 2026
Book Ratings ("the App") is developed by Obscura Logic. This policy explains what information the App collects, how it's used, who it's shared with, and how you can request that your data be deleted. The App is not directed at children under 13, and we do not knowingly collect data from children.
Account information. When you create an account, we collect your email address, first name, and last name. Your password is never stored in plain text — it is hashed using PBKDF2 (HMAC-SHA256) with a unique random salt before it reaches our database, and it cannot be recovered by us.
Account emails. We use your email address to send you one-time codes: a code to verify your email address when you sign up, and a code to reset your password if you ask for one. These are the only emails the App sends — no newsletters or marketing. Each code expires after 15 minutes, and we store only a one-way hash of it, never the code itself.
Content you create. Content ratings you submit for books (violence, language, sexual content, substance use, horror, self-harm, religion, and abuse, each on a 0–5 scale), an overall rating, and any free-text review comments you write. Your reading status and progress for books (want to read / currently reading / read / did not finish, and page or percent progress), and any custom shelves you create.
Social information. If you use the friends feature, we store friend requests and friendships you create, and we show connected friends limited information about your reading activity (such as books you've rated or marked as read) and your name.
Ratings and reviews you submit are visible to other users as part of the App's community rating and review features (for example, aggregated content ratings and public review text shown alongside a book).
Camera. The App requests camera access solely to scan a book's ISBN barcode when you use the scan feature. The camera image itself is never stored or transmitted — only the decoded barcode number is used to look up the book.
Technical information. Our servers may log standard technical information (such as IP address and request timestamps) for security, abuse prevention, and operational troubleshooting. We do not use this information for advertising or profiling.
Crash and diagnostic data. The App uses Sentry to automatically capture crash reports and error logs so we can find and fix bugs. This can include your device model and OS version, app version, in-app diagnostic logs, and (for crashes) a snapshot of what was on screen in the moments before the crash, with text and inputs masked. If you submit feedback through the App's "Send feedback" option, the message you write (and, optionally, your name or email if you choose to include them) is also sent to Sentry.
Advertising. The App shows a small number of clearly labelled "Sponsored" ads, delivered by Google AdMob. We request non-personalized ads only, meaning ads are not targeted based on your interests or browsing history, and we limit ads to general-audience content. To serve, measure, frequency-cap, and prevent fraud on these ads, Google's advertising SDK may collect information from your device, such as your device's advertising ID, IP address (and approximate location derived from it), device and app information, and whether you viewed or tapped an ad. We do not share your account information, email, name, ratings, reviews, or reading activity with Google or any advertiser.
Book purchase links. Book pages may include a "Buy on Bookshop.org" link. These are affiliate links: if you buy a book after following one, Obscura Logic may earn a commission, at no extra cost to you. Following the link simply opens Bookshop.org; we do not send Bookshop.org any of your account information, and any purchase you make there is governed by Bookshop.org's own privacy policy.
We do not sell your personal data.
Book data providers (isbndb and Google Books). When you search for a book, we may query the isbndb API, and if needed the Google Books API, to look up book metadata (title, author, cover, etc.). These requests are made by our servers, and only the search terms you enter are sent — no account or personal information is shared with these providers.
AI content-rating estimates (Anthropic). For books without enough community ratings yet, the App may ask Anthropic's Claude API to generate an estimated content rating. Only the book's own metadata (such as title and author) is sent for this purpose — your account information, identity, or personal data is never included in these requests.
Crash and diagnostic reporting (Sentry). We use Sentry to receive the crash, diagnostic, and feedback data described above so we can diagnose and fix problems with the App. Sentry processes this data on our behalf under its own security and data-processing terms.
Email delivery (Resend). We use Resend to deliver the verification and password-reset emails described above. To send one, we give Resend your email address and the message itself (which contains the one-time code). Resend processes this on our behalf solely to deliver the email, under its own security and data-processing terms. No other account information, ratings, reviews, or reading activity is shared with Resend.
Advertising (Google AdMob). Google collects the device and ad-interaction information described above directly through its SDK in the App, and processes it under its own terms. You can learn more at How Google uses information from sites or apps that use its services.
Bookshop.org. When you follow a purchase link, you leave the App for Bookshop.org. Bookshop.org reports affiliate sales to us so commissions can be paid; we do not receive your name, contact details, or payment information from them.
Hosting infrastructure. The App's backend and database run on infrastructure operated by Obscura Logic. We do not share your data with any other third party beyond those named in this policy, and we never sell personal data.
We retain your account and content for as long as your account remains active.
Deleting your account. You can delete your account at any time in the App under Settings → Delete account. Deletion is immediate and cannot be undone. If you can't sign in, you can instead email [email protected] from the email address on your account, and we aim to complete the request within 30 days.
When your account is deleted, we permanently delete your account information (email address, name, and password hash), your content preferences, your reading status, progress, and shelves, your reading challenges, your friend connections and requests, and your sign-in sessions. Ratings and reviews you have submitted are kept, so that books' community content ratings stay accurate, but they are disconnected from you: they no longer link to any account and are shown publicly as from "Deleted user". Any review text you wrote remains visible in that anonymized form. If you want your reviews removed as well, delete them in the App before deleting your account, or ask us to remove them when you email us.
Server logs, which identify your account only by an internal ID (never your email address), are deleted on a rolling basis. We may retain information for longer only where required to comply with the law or resolve disputes.
If you sign up but never verify your email address, the unverified account is deleted automatically after 7 days.
Data is encrypted in transit using TLS. Passwords are hashed (never stored in plain text), and authentication uses short-lived tokens that are rotated on use. Email verification and password-reset codes expire after 15 minutes and stop working after a few incorrect attempts. While no system can guarantee absolute security, we take reasonable measures to protect your information.
You can edit your content preferences, ratings, and reviews at any time within the App. You may delete individual ratings, reviews, shelves, or friend connections from within the App. To delete your account entirely, use Settings → Delete account in the App, as described under "Data retention and deletion" above.
Ads. If you are in a region where consent is required (such as the EEA or UK), the App asks for your choice before showing ads, and you can change it later under Settings → Ad privacy choices. If you decline, you may still see a limited form of non-personalized ads. On Android, you can also reset or delete your device's advertising ID in your device settings (Settings → Privacy → Ads, or Settings → Google → Ads, depending on your device).
If we make material changes to this policy, we will update the effective date above and, where appropriate, notify you within the App.