Privacy Policy

Bookplate (bookplateapp.com) · Last updated October 14, 2026

Bookplate is a personal reading tracker and a Kettlewick Studio product. It is run by Kettlewick Studio LLC, a Massachusetts limited liability company, which is responsible for the personal data described here (the data “controller”); “we” and “us” in this policy mean Kettlewick Studio LLC. This policy says exactly what data the app handles, where it goes, and how to delete it. The short version: your reading data is yours, we use no ad networks and no analytics services, we never sell your data or share it for advertising, and you can delete your account and its data from inside the app. Bookplate is free; it is supported by optional cosmetic purchases, affiliate book links, and labeled sponsored book cards, none of which use your personal data for targeting (details below). We share data with the service providers listed below only as needed to run the app.

What we store

Your library: books, to-be-read entries, reading progress, start/finish dates, ratings, notes, and reading history.
Your shelf identity: the shelf name you choose, an optional username and friend code, and your cup/shelf designs (including painted cup art).
Your account: if you sign in, your email address, your display name (if your sign-in provider supplies one), a random account ID that Firebase assigns, and which sign-in method you used (Google, Sign in with Apple, or email and password), managed by Firebase Authentication (Google). With Sign in with Apple you can choose “Hide My Email”, in which case we only ever receive Apple's private relay address. Passwords are handled by Firebase and are never visible to us. When you create an account we ask your birth date once to check eligibility — it's checked on your device and immediately discarded, never stored or sent to us. Signing back in never asks again, on any device.
Social data, only if you use those features: friend connections, blocked users, reviews and comments you publish, and notifications (including a “Bookplate Support replied” notice when we answer a support message — the notice itself carries no message text).
Sync bookkeeping: timestamps on your items so your devices can agree which edit is newest.
Support & safety records: messages you send through Help & feedback and our replies to them, and reports you file about content or readers (your account id, what you reported, and the reason). If you're signed in, a support message is stored with your account id and our replies are stored alongside it and shown to you in the app — we don't ask for your email. If you're signed out, you can choose to leave an email so we can reply; it is only collected if you type it in. These are operational records kept separately from your shelf.

We do not collect analytics about you, advertising identifiers, contacts, photos, or a device fingerprint, and we don't collect your location — the one exception is the Reading Room's optional live weather, which uses an approximate location only if you turn it on, and keeps it on your device (see below). (Once affiliate links or sponsored cards are live, Bookplate keeps only anonymous monthly totals of how often they're shown and tapped — see below.) Apart from what you type or choose in the app, the only device feature Bookplate uses is the camera, and only for the barcode scanner (below).

The camera (barcode & cover scanner)

The camera is used only while the Scan window is open, and only after you grant permission. Closing the scanner turns the camera off.
Camera frames, and any photo you take with Snap, are processed entirely on your device — by your browser's or phone's built-in barcode/text reader, or by the open-source decoders (zbar and Tesseract) that ship with Bookplate itself. Images are never uploaded, never stored, and never sent to us or anyone else.
What leaves your device is only the result: the ISBN read from a barcode, or a few words of title/author text read from a cover, sent to Open Library as a book search (see below).
You can decline camera access and type titles in instead; nothing else changes.

What's kept on your device

The app keeps your shelf, settings, and designs in your browser's (or the iOS app's) local storage so it works offline and loads instantly. Signed in, this is a working copy of your synced data, plus small sync records (which items are in sync, and deletions waiting to upload).
A short device-only diagnostic log (Support → Data history) and any local recovery copies stay on that device; they are never uploaded unless you choose to copy or send them to us yourself.
If you turn on the Reading Room's live weather, your approximate location (rounded to about 10 km) and the latest weather are kept on your device so the window outside your room can match it. “Stop using my location” in Make it yours → Window deletes them, and signing out clears them.
Bookplate sets no advertising or tracking cookies. (A store or payment page you choose to open is a separate website and may set its own; see below.)

Where it lives

Signed out (guest mode): your shelf data — books, designs, notes — stays in your browser's local storage on your device and is not synced or uploaded to Bookplate's database. Features that look things up (search, barcode scan, covers, discovery) still make network requests to the services below, which, like any web request, see your IP address and the query.
Signed in: your data syncs to Cloud Firestore (Google Cloud), tied to your account, so it follows you across devices.

Services the app talks to

Firebase / Google Cloud — sign-in (Firebase Authentication) and the synced database (Cloud Firestore). Signing in with Google also involves Google's own sign-in service.
Apple — if you choose Sign in with Apple, Apple confirms your identity and shares your name (first time only) and email or relay address with the app.
Open Library (openlibrary.org, covers.openlibrary.org) — when you search for a book, scan a barcode, or the app fetches cover art and ratings, the book's title/author/ISBN is sent as a query. The discovery features (mood search, taste test, “For you”) also send subject, genre, and author queries derived from your mood picks, quiz answers, and highly-rated authors/genres — for example subject:"fantasy" or a favorite author's name. Bookplate attaches no account identifier to any of these queries, but like any web request the provider sees your IP address, and the queries themselves can reflect your tastes.
Apple iTunes Search API — same idea, for additional book ratings. Query only, no account identifier.
Booksellers you choose to visit — the “Get this book” links go straight to the retailer (some through its affiliate network, which credits the commission). The link carries the book's title/author or ISBN and, for affiliate links, Bookplate's affiliate ID — never your account or any identifier for you. Nothing is sent until you tap a link; after that the retailer's own privacy policy applies. Your store-region choice is kept only on your device.
Render — hosts the bookplateapp.com website (Cloudflare provides its DNS). Like any web host it sees your IP address and the pages requested, in standard server logs.
Google reCAPTCHA (through Firebase App Check) — to keep automated abuse away from the database, the app runs Google's invisible reCAPTCHA check, which sends Google information about your browser and how the page is used so it can tell a real visitor from a script. No Bookplate account data is sent with it. Google's Privacy Policy and Terms of Service apply to it.
Open-Meteo (api.open-meteo.com) — only if you turn on the Reading Room's live weather (“Show my real weather”). Your approximate location, rounded to about 10 km, is sent to fetch the current weather and sunrise/sunset, about every half hour while the room is open. No account identifier is sent; like any web request, Open-Meteo sees your IP address. Your browser asks your permission first, and “Stop using my location” turns it off.
Script hosting (CDNs): the app loads open-source libraries from Google, Cloudflare (cdnjs), and jsDelivr. When you import a spreadsheet (.xlsx/.xls), it loads the open-source SheetJS reader from cdnjs — your file itself is read on your device and is not uploaded. Like any web request, those servers see your IP address in standard server logs; no app data is sent to them.

That is the complete list of services the app talks to today. No ad networks, no analytics services, no data brokers. The stores and payment partners described next are involved only when you choose to follow a link or make a purchase.

Purchases, affiliate links & sponsored content

As of the date above, real-money purchases and sponsored cards are not yet live — the in-app shop shows paid items as “coming soon” and takes no payment. The “Get this book” store links work, but stay plain links (no affiliate tag) until each store's affiliate program approves Bookplate. This section says how each feature handles your data.

Affiliate book links (“Get this book”): tapping one takes you to the store's own website or app — for example Bookshop.org, Amazon (including Kindle and Audible), Libro.fm, Kobo, Barnes & Noble, or a UK or international bookseller. The link contains the book (its ISBN or title) and may carry Bookplate's affiliate tag so the store can credit Bookplate if you buy. Bookplate sends the store no personal data — no account id, email, or reading history. Once you're on the store's site, it sees your IP address like any website, may set its own cookies (including the affiliate network's), and handles your data under its own privacy policy.
Payment processors: cosmetic purchases are handled by Apple (In-App Purchase, in the iOS app) or, on the website, by a merchant of record — RevenueCat with Stripe, or Paddle. You give your payment details directly to them; Bookplate never sees or stores card numbers. To connect a purchase to your account, Bookplate shares your random account ID with RevenueCat (and the web checkout), and receives back which items you own and basic receipt data (product, date, store, refund status) — not your card or billing address. On the web, the merchant of record collects your email, payment and billing country to process the payment, calculate tax, send your receipt and handle refunds, under its own privacy policy. Apple shares no personal payment details with Bookplate.
Sponsored content: sponsored book cards are chosen by what you're browsing at that moment (for example the genre or mood you picked), worked out on your device — never from your reading history, and nothing about you is sent to the sponsor. Bookplate counts aggregate impressions and clicks (and, for affiliate links, taps per store) as monthly totals with no account id, book, or device identifier attached, so it can report results to sponsors and know what's working.
Ad networks: no ad network is active in Bookplate. If one is ever enabled, it will show only non-personalized (contextual) ads, it will run only after you consent in regions that require consent (such as the EU and UK), it will not be shown to signed-out guests, and this policy will be updated before it starts.
We never sell your personal data, and we never share it with sponsors, stores, or advertisers.

What other people can see

When you sign in, the app keeps a profile card for you — your shelf name, optional username and friend code, and your cup and shelf designs. Other signed-in readers who look you up (for example from a review you published, or to send a friend request) can see that card.
Your finished books (with ratings and favorites) and your TBR are private by default. If you turn those sharing switches on, only readers you have added as friends can see them; removing or blocking someone ends their access right away.
You appear in the Find readers directory (shelf name and username) only if you turn Discoverable on. Someone who already knows your exact username or friend code can use it to send you a friend request.
Reviews and comments you publish are visible to other Bookplate readers under your shelf name.
Your email address, private notes, and reading progress are never shown to other readers.

Data retention

Your shelf and account data are kept for as long as your account exists, so your shelf is there when you come back, and are deleted when you delete your account (see below).
Support messages and reports are operational records, kept as long as they're needed to handle support and keep the community safe. Support messages you sent while signed in (with our replies) and reports you filed are deleted when you delete your account; support messages sent while signed out are deleted on request (see below).
Messages from the retired messaging feature: Bookplate no longer offers direct messages. Conversations from that feature are no longer accessible in the app but remain stored in shared conversation records. Ask us to delete yours via Help & feedback — best done while your account still exists, since those records are found by account id; after account deletion we can investigate but may not be able to locate yours.
Local guest data stays on your device until you clear it, sign in (see the in-app explanation of what happens then), or sign out (signing out wipes the device's local copy for privacy on shared devices).

Deleting your data

In-app account deletion: Account sheet → “Delete my account…” (in both the website and the iOS app). After you confirm (twice) and re-verify your sign-in with the same method you signed in with (Google, Apple, or email), the app immediately deletes from Bookplate's servers, and from the device you're on:

your library, TBR, reading history, and painted cup art;
your profile, directory listing, username, and friend code;
your friend requests (sent and received) and notifications;
every review and comment you published;
support messages you sent while signed in, together with our replies, and reports you filed;
your sign-in account itself, and the local copy on this device.

The honest fine print:

Other devices: a device that was signed in keeps its local copy. Its session stops working when its sign-in token expires — within about an hour — after which it can no longer sync; signing out there wipes that local copy. We cannot reach into an offline device to erase it remotely.
If something fails: the app deletes your sign-in account only after every server-side purge above has succeeded. If any step fails, it stops, tells you, and leaves your sign-in intact so you can retry — it never deletes your account while data remains behind.
If your account is deleted from another device while this device is still signed in, this device ends its session and keeps a local recovery copy of whatever was on it (never uploaded), so nothing is silently destroyed. You can download or delete that copy yourself under Support → Data history → Recovery copies; if it can't be saved (storage full), nothing is erased and the app tells you to export instead.
Support messages sent while signed out carry no account id, so account deletion can't find them. To have them deleted, ask through Help & feedback or email us, mentioning the email you left (if any) so we can find them.
Friends' copies: your profile and shared shelf disappear for your friends because the data behind them is gone. The entry naming you in a friend's own list may linger on their side until they remove it, but it leads nowhere.
Messages you sent through the retired messaging feature live in shared conversation records and are not removed by account deletion. Ask us to delete them before deleting your account (they're found by account id); after deletion we can investigate but may not be able to locate yours.
Backups you exported yourself are files on your device and are yours to keep or delete. Residual copies in the database provider's infrastructure backups expire on Google Cloud's standard deletion timelines.

Children

Bookplate is not directed at children under 13, and we do not knowingly collect personal information from them. Purchases require an account, which requires being at least 13, and Bookplate never shows personalized or behavioral ads to anyone.

Changes and contact

If this policy changes, the date above changes with it — check this page for the current version. Questions or requests: use Help & feedback inside the app, or email support@bookplateapp.com — the developer reads every message. By mail: Kettlewick Studio LLC, 82 Wendell Ave., Ste 100, Pittsfield, MA 01201.