Privacy Policy

Last updated: September 12, 2026 · Effective: September 12, 2026

Bookliz is a free personal reading tracker. It shows no ads, contains no advertising SDK, and runs no analytics, tracking or crash-reporting service of any kind. We collect only what is needed to store your library and sync it across your devices. We do not sell your personal data, and we do not share it with anyone for advertising.

1. Who we are

Bookliz is developed and operated by Mysto Dev ("we", "us", or "our"). If you have questions about this policy, contact us at enrique.padron853@gmail.com.

2. What data we collect

Bookliz works offline and stores your library on your device. If you create an account, that library is also synced to our server so you can restore it or use it on another device. In that case we hold:

Account identifiers — your email address and display name, provided when you sign up or supplied by Apple Sign In / Google Sign In.
User ID — a randomly generated UUID that links your rows to your account.
The reading data you create — books and authors in your library, reading sessions (pages, minutes, dates, notes), reviews and ratings, saved quotes, custom lists, series tracking and ownership or wishlist flags.
App preferences — interface language (English or Spanish), theme, and your annual reading goal.

We do not collect location data, payment information, health data, contacts, browsing history, advertising identifiers, or any usage or telemetry data. The app contains no analytics or crash-reporting SDK, so we cannot see how you use it.

If you never sign in, nothing leaves your device except the metadata lookups described in section 4.

3. Camera

Bookliz asks for camera access for one purpose: scanning the ISBN barcode on a book.

Scan ISBN stays on your device. The barcode is decoded locally and only the resulting ISBN — a number that identifies the edition, not you — is used for a metadata lookup. No image is captured, stored or sent anywhere.
Bookliz does not ask for photo library access and cannot read your photos. Covers come from the public book catalogues described in section 4, never from your own pictures.

4. Book metadata lookups

To fill in titles, authors, covers, page counts and synopses, Bookliz queries two public catalogues: the Google Books API and Open Library (Internet Archive). What we send is the search text, title, author or ISBN you are looking up. We never send your email, your user ID, or anything about the rest of your library.

These requests go directly from your device to those services, so they receive your device's IP address and can apply their own logging, as any website you visit would. Their handling of that is governed by their own policies, linked in section 8.

5. Affiliate links

When a book is on your wishlist, Bookliz can open it on Amazon. Those links carry our Amazon Associates tag (bookliz-20), which means we may earn a small commission if you buy something after following one. The price you pay is not affected.

Following such a link leaves the app and opens Amazon in your browser. From that point Amazon's own privacy policy applies and we receive nothing about you personally — only aggregate, anonymous commission reporting from Amazon.

6. Notifications

If you enable the daily reading reminder, it is scheduled locally by your device's operating system. Bookliz does not operate a push server, does not register a push token, and sends you nothing remotely.

7. How we use your data

To create and maintain your account.
To store your library and sync it to any device where you sign in with the same account.
To calculate your reading statistics, streaks and achievements, which happens on your device.
To restore your data if you reinstall the app or change devices.

We do not profile you, build an advertising audience, or use your reading data for any purpose other than running the features above.

8. Third-party services

Supabase (privacy policy) — our database and authentication provider. Your email, user ID and reading data are stored on Supabase infrastructure in the United States (AWS us-east-1).
Apple Sign In (privacy policy) — optional sign-in method. If you choose to hide your address, Apple gives us a private relay address instead of your real one, and that is all we ever see.
Google Sign In (privacy policy) — optional sign-in method. Google provides your name and email address to create the account.
Google Books API (privacy policy) — book metadata and cover images. Receives your lookup terms and your device's IP address.
Open Library / Internet Archive (terms) — book metadata and cover images. Receives your lookup terms and your device's IP address.
Amazon (privacy notice) — only when you follow a purchase link, as described in section 5.

There is no advertising network, no analytics provider and no crash-reporting provider in this list, because the app integrates none.

9. Data retention and deletion

Your data is kept for as long as your account exists. You can delete your account at any time from Settings → Delete account inside the app. This erases your profile, books, authors, reading sessions, reviews and lists from our servers, and removes your authentication record, so the account cannot be recovered. The copy stored on your device is cleared at the same time.

Deleting the app without deleting your account removes the local copy only; the synced copy remains until you delete the account or ask us to.

10. Data security

All traffic between the app and Supabase is encrypted with TLS. Every table enforces PostgreSQL row-level security, so a signed-in user can read and write only rows carrying their own user ID.

On your device, your library is stored unencrypted in the app's private storage area, which the operating system isolates from other apps. Your session token is held in the same private app storage; the credentials used for Google Sign In are kept in the system keychain via expo-secure-store. Anyone with your unlocked device and your passcode can therefore read your library, as with most apps of this kind.

11. Children's privacy

Bookliz is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

12. Your rights

Depending on where you live you may have the right to access, correct, export or delete the personal data we hold about you. The in-app account deletion covers the deletion right in full; for anything else, write to enrique.padron853@gmail.com and we will respond within 30 days.

If you are in the European Economic Area or the United Kingdom, you also have rights under the GDPR, including data portability and the right to complain to your local supervisory authority. If you are a California resident, note that we do not sell or share personal information as those terms are defined by the CCPA/CPRA.

13. Changes to this policy

If we make material changes we will update the "Last updated" date above, and for significant changes we will show an in-app notice on your next launch.

14. Contact

Questions or requests: enrique.padron853@gmail.com