bestbooksPrivacy Policy
1. Controller
The controller within the meaning of Art. 4(7) GDPR is the provider named in the Imprint, where you find the contact details for all privacy matters. A data protection officer has not been appointed; the statutory conditions requiring one are not met.
2. Scope
This notice applies to the BestBooks iOS app and to this website. It does not apply to third-party services reached from either.
3. What stays on your iPhone
Without an account, the app stores your library, reading statuses, ratings, reviews, notes, reading times, goals, streaks and reminders only on your iPhone. Notes, individual reading sessions and books you mark as private always stay on the device, also with an account. What you share with friends is described in section 7. When you scan a barcode or a cover with the camera, the app analyses the image on the device; the image does not leave your iPhone. Reminders are local iOS notifications, without a server.
4. Book search and covers
When you search for a book, scan a barcode or load a cover, the app sends the search term or ISBN to Open Library (Internet Archive, USA), Google Books (Google) and the German National Library and loads book data and covers from there. For technical reasons these services receive your IP address. The legal basis is Art. 6(1)(b) GDPR, as you start the search yourself. Processing by these services is governed by their own privacy policies.
5. Account (optional)
You don't need an account to use BestBooks. If you create one, you sign in with your Apple Account (“Sign in with Apple”). We then process:
- the identifier Apple assigns for BestBooks,
- your email address, or Apple's anonymous relay address if you hide your address,
- your name if you share it when signing in, and the display name and username you choose,
- the times of signing up and of the last change.
Other signed-in readers see your display name and username so you can find each other. The purpose is your profile and reading with friends. The legal basis is Art. 6(1)(b) GDPR.
6. Finding friends
If you allow access to your contacts, the app turns the phone numbers and email addresses of your contacts into non-reversible hashes (SHA-256) on your iPhone and sends only these hashes to our server, which answers with the readers who match. We store neither your contacts nor their hashes; we only count how often you search per day, so nobody can try out numbers. So that friends can find you, we store a hash of your confirmed email address (not of Apple's relay address) and, if you confirm it, of your phone number. You switch this off under Profile → Settings → Findable through contacts. We store whom you follow; that person sees that you follow them. The legal basis is Art. 6(1)(b) GDPR.
7. Sharing with friends
Friends are readers who follow each other. With an account, the app sends our server what your friends may see, and only they see it: your books with title, author, cover, status (reading, finished, want to read), page and date, your stars and the text of reviews you make visible to friends, your three recommendations, your reader type, your streak, your yearly goal, your favourite topics, your bookmarks and the pages of the current month. Private books and anything you switch off under Profile → Settings → Privacy are not transmitted. Books you send to a friend are stored with your message until that person deletes them or one of you deletes their account. The legal basis is Art. 6(1)(b) GDPR.
8. Recipients
For accounts we use Supabase (Supabase Inc., USA) as a processor under Art. 28 GDPR for the database and sign-in. The data is hosted on servers in Frankfurt am Main (EU). Apple (Apple Inc. and Apple Distribution International Ltd.) takes part in Sign in with Apple and distributes the app. Beyond this, data is disclosed only where we are legally obliged to do so.
9. Transfers to third countries
Supabase Inc. is established in the USA. Transfers are made on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) and, where the recipient is certified, the EU–US Data Privacy Framework (Art. 45 GDPR). Book searches (section 4) go to services in the USA.
10. No ads, no tracking
BestBooks shows no ads and uses no advertising identifier, no analytics tools and no tracking across apps or websites. We do not sell data and do not use it to train AI models.
11. Retention and deletion
Account data is kept until you delete your account, which you do in the app under Profile → Settings → Delete account. This deletes your account, your profile, the hashes of your email address and phone number, whom you follow and who follows you, everything shared with friends and the books you sent or received, and revokes Sign in with Apple. Data on your iPhone is deleted by deleting the app.
12. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Use the contact details in the Imprint. You may also lodge a complaint with a supervisory authority (Art. 77 GDPR).
13. Right to object
Where processing is based on Art. 6(1)(f) GDPR, you may object to it at any time on grounds relating to your particular situation (Art. 21(1) GDPR).
14. This website
This website sets no cookies, uses no analytics and loads nothing from third-party domains. The hosting provider processes server log data (IP address, time, requested page, browser) to deliver and secure the site, on the basis of Art. 6(1)(f) GDPR. The logs are deleted after a short period.
15. Children
Accounts are intended for people aged 16 and over. We do not knowingly process account data of people under 16.
16. Changes
We update this notice when the app or the law changes. The version published here applies.