Privacy Policy

The data controller is the individual operator of BeBook (www.be-book.org), based in the United Kingdom. All privacy requests and questions go to the webmaster through Contact BeBook on this page — choose “Privacy & data rights”. BeBook is a small community project and has not appointed a Data Protection Officer; the operator answers requests personally, normally within one calendar month as required by the UK GDPR.

• Account data: first and last name, display name, email address, password (stored hashed by our authentication provider), acceptance of the Terms.
• Approximate location: a coarse area or postcode district you type yourself (for example "Shoreditch" or "EC1"), plus approximate coordinates used to place listings on the marketplace map. We never ask for or display a street address. Your browser's precise location (GPS) is requested only when you tap a button such as "Locate me" or "Directions" to be guided to a station, after your browser asks your permission — never when a page opens. It is used on your device to centre the map or open directions; if you refuse, station information and manual directions still work.
• Scan data: the one to four photos you take of a book (front cover, back cover, copyright/ISBN page, title page), the technical quality measurements computed on your device (sharpness, glare, brightness, resolution) and the text extracted from those photos.
• Book metadata: title, subtitle, authors, publisher, edition, publication year, language, ISBN, subjects, cover image, plus the candidate records returned by external bibliographic sources and their match scores.
• Inventory and marketplace data: the copies you own, their condition, BeBook credits value, availability status and the coarse zone attached to a listing.
• Exchange and wallet data: exchange requests, their status, BeBook credits movements (earned, spent, locked, bonus).
• Messages: the content of chat messages you send to other members inside an exchange thread, and who sent them.
• Operational logs: technical and audit events such as scan processing outcomes, errors and moderation decisions.
• Visit statistics and browser storage: BeBook uses no advertising or third-party analytics cookies. Your browser stores what the site needs to work: your sign-in session, your language, your privacy choice, and preferences such as map layers or a search scope; a station QR you scanned is remembered to suggest that station when you join, and an invitation code to credit the invitation. Visit statistics are optional and off until you allow them in "Privacy choices" (in the footer): only then does your browser create two random identifiers (one kept on this device, one for the current visit) and send the page path, a coarse traffic source and, within 24 hours of a station QR scan, that station's public id, so that we can count visits. No account id, IP address or browser details are stored with them. You can withdraw at any time in Privacy choices; the identifiers are then deleted from your browser and nothing further is sent. Separately, each station-sticker scan is counted as an anonymous total with no identifier.

Photos should show the book. Please avoid capturing people, handwritten notes, bookplates or anything else you do not want processed.

• Providing the service — creating your account, recognising books, building your library, running the marketplace, chat and exchanges. Basis: performance of the contract you enter into by using BeBook.
• Security, abuse prevention and moderation — detecting and investigating fraud, abuse, harmful activity, account or service attacks, moderation cases, failed scans and catalogue conflicts, and protecting members and the service. Basis: BeBook's legitimate interests in keeping the service safe and reliable, only where those interests are proportionate and do not override member rights; legal obligations may also apply.
• Internal BeBook analytics and product improvement — understanding adoption and feature use; analysing scans, searches, wishlists, favourites, recommendation interactions, exchanges and station or QR interactions; measuring matching and recommendation quality; and debugging, improving performance and developing BeBook. We use account-linked or pseudonymous data only for BeBook's own operation and improvement, proportionately, with data minimisation and limited access. Raw private contact details, exact addresses and private message content are excluded unless strictly necessary for a specific operational or security purpose. Basis: BeBook's legitimate interests in operating, measuring and improving the service, only where proportionate and not overridden by member rights; contract where processing is necessary to deliver a feature you request. This internal use does not depend on the separate commercial consent. You may object through the protected webmaster contact; BeBook will assess and act on the objection as required.
• Commercial data use outside BeBook — optional future use of your personal or behavioural data, or member-linked insights derived from it, to generate revenue outside the BeBook service and ecosystem. Basis: your explicit consent, which is off by default and is never required to use BeBook. Each activation includes a minimum active period of 30 calendar days, after which the consent may be withdrawn. BeBook does not claim that it currently sells member data. Private contact details, exact postal addresses, phone numbers, email addresses and private message contents are excluded. This consent does not cover internal BeBook analytics or processors acting only on BeBook's instructions.
• Legal obligations — where applicable law requires us to keep or disclose records.

Other signed-in members can see: your display name, your coarse area, and the books you have explicitly marked as available, with their condition and BeBook credits value. They cannot see your email, your exact location, your unavailable books or your message history with anyone else.

Internal BeBook analytics are not sold, licensed or disclosed to third parties for their own commercial purposes. Service providers acting as processors may receive only the data needed to provide their services to BeBook and must act on BeBook's instructions. A separate “Commercial data use outside BeBook” opt-in would permit only the future external commercial use described in section 3; it does not include your exact address, email, phone number, private contact details or private message content.

• Hosting, database, authentication and file storage — our managed cloud backend stores your account, your data and your scan photos in a private bucket that is not publicly readable.
• Automated recognition provider — when advanced recognition is enabled on this deployment, your scan photos are transmitted to an external automated recognition service solely to extract bibliographic text. They are not used by us to train third-party models.
• Bibliographic sources — Google Books API and Open Library receive search terms (ISBN, title, author, publisher) to return catalogue records. We do not send them your identity or your photos.
• Map tiles — OpenStreetMap tile servers serve the map background; your browser therefore contacts them when you open the marketplace map.
• Service emails — sign-in, confirmation and exchange notifications are sent through the email service of our cloud platform, from notify.be-book.org.
• Sign-up robot check — Cloudflare Turnstile checks that a sign-up is made by a person; your browser contacts Cloudflare during that check.
• Walking directions — when you ask for directions, the OpenStreetMap routing service receives the start and end points of the route.

These providers act only to deliver services to BeBook under BeBook's instructions and receive only what is needed for their task. Some of them may process data outside the United Kingdom. The specific transfer safeguards for each provider are still being confirmed and will be listed here once verified.

• Account, library, wallet and exchange records: for as long as your account exists.
• Scan photos and raw recognition text: kept with the scan so it can be reviewed, corrected and audited; deleted when you delete the scan or your account.
• Chat messages: kept for the life of the exchange thread. When a member deletes their account, their messages are replaced by a placeholder.
• Canonical book records (title, ISBN, publisher and similar edition-level facts) are shared catalogue data and remain in the catalogue after your copy is removed. They do not identify you.
• Operational and audit logs: kept for security and troubleshooting. Moderation evidence is deleted automatically after a case is closed; other logs have no automatic deletion period yet.
• Contact and report requests: kept so the request and any follow-up can be handled. There is no automatic deletion period yet. If you delete your account, the reply address and the link to your account are removed.
• Record of your acceptance of the Terms and of your age declaration: kept as evidence, including after account deletion, until a retention period is set.

Subject to applicable law you can request access to your data, correction, deletion, restriction of processing, objection to processing based on legitimate interest, and portability of the data you provided. You can also lodge a complaint with your local data protection authority.

Send requests through Contact BeBook on this page (“Privacy & data rights”). In the UK you may complain to the Information Commissioner's Office (ico.org.uk). Much of this is also self-service: you can edit book metadata, hide a copy from the marketplace, and delete copies from your library at any time.

You can delete your account yourself at any time from Settings → Account details. Deletion is immediate and permanent. We erase your sign-in record (including your email), name, phone, postcode and coordinates, verification phone and postal addresses, bio, reading preferences, scan photos and extracted text, exchange photos, voice notes, wish list, book alerts and recommendations, private copy notes, feedback threads and meeting-point preferences.

Some records are kept without your identity. Your profile row becomes an anonymous “Deleted member” tombstone; your messages are replaced by a placeholder so the other member keeps a coherent conversation; reviews, ratings and book discussion posts stay without any link to you; your library copies are hidden and kept for exchange history; completed or cancelled exchanges, trusted loans and BeBook credits entries are kept as accounting records; safety reports and contact requests keep the case without your contact detail; and the record of your acceptance of the Terms and your age declaration is kept as evidence. A profile picture or personal cover photo file you uploaded may remain in storage until a clean-up is completed. Our reliance on legal exceptions for these records is subject to legal review.

Deletion is refused only while you have an exchange in progress or a book lent out — finishing or cancelling it first protects the person on the other side. If you leave us a reason for going, it is stored with no link to you or your account.

The operator may also suspend an account for breaches of the Terms. A suspended account cannot sign in; its data is unchanged and it can be reactivated.

Automated safety checks run on new and edited messages in private conversations, on book discussions and on public reviews. They look only for abuse, threats, exposure of personal details, scams and spam. Content that clearly threatens someone is refused; anything else is delivered normally and may be flagged for limited human review by the webmaster.

Access to flagged content is restricted to the webmaster, requires a stated reason, and every access is recorded in an audit trail. It is never used for advertising, profiling or any purpose other than safety and platform integrity. Evidence kept for a case is deleted automatically after the retention period, leaving only anonymous statistics.

If your message is refused, you can ask a human to look at it. Repeated confirmed violations may lead to the usual account measures, decided by a person and never by the automatic check alone.

Star ratings, written reviews and book discussion messages belong to the book, not to a copy or a listing, so they survive when a copy is given away, sold or removed. If you delete your account, these public literary contributions are kept but irreversibly detached from you: your identifier and profile link are removed, any contact details are stripped, and the contribution is shown as written by a former BeBook member. Private conversations, personal notes and private data are deleted as described above and are never published.

BeBook does not send marketing email and keeps no marketing list. When you recommend BeBook or a book to a friend, the message is composed in your own email application and sent by you, from your address — we never store or transmit your friend's address, so no unsolicited electronic mail is sent under the Privacy and Electronic Communications Regulations 2003. Emails we do send are service messages tied to your account: sign-in codes, exchange notifications and calendar invitations.

“Commercial data use outside BeBook” is optional, separate from the Terms and off unless you turn it on in Privacy settings. It is not required to use BeBook and does not control BeBook's proportionate internal analytics for operating, securing and improving the service. Before the first activation we ask for one private location detail: a postcode for members based in London, a postal address for members elsewhere. It is used only to confirm where the consent applies and eligibility for the balance bonus; it stays private and is never published. Each activation opens a minimum active period of 30 calendar days: during it the programme cannot be switched off, and the exact date from which it can be is displayed on that screen. From that date participation continues until you withdraw, and a later reactivation opens a new 30-day minimum period. Withdrawal stops future processing based on that consent but does not invalidate processing already carried out lawfully. Each activation may credit a one-shot balance-match bonus equal to your balance excluding every other bonus at that moment; it is not recalculated afterwards, withdrawal removes exactly that bonus with no further penalty, and a later activation credits a freshly calculated bonus. Withdrawal does not delete your account or library. This consent causes no solely automated decision with legal or similarly significant effect.

Access to data is enforced at the database level with row-level security: you can only read and write your own records, marketplace listings are limited to copies members explicitly made available, and scan photos live in a private bucket reachable only through short-lived signed links. Administrators can access scans placed in the moderation queue in order to review recognition quality; those accesses are limited to operational needs. No system is perfectly secure, and we cannot guarantee absolute security.

BeBook accounts are for adults aged 18 and over. Registration asks you to confirm this; we do not ask for a date of birth or identity documents, so this is a self-declaration, and we do not knowingly collect data from children. A minor may take part in a physical exchange only with their parent or legal guardian present, through the adult's own account. BeBook records nothing about the child, and the adult's presence is not consent to BeBook collecting the child's data. If you think a child has an account, report it through Contact BeBook (Safety or safeguarding concern).

BeBook carries user-to-user messaging, so the operator keeps an illegal-content risk assessment and a children's access assessment under the Online Safety Act 2023, reviews reports of harmful content, and can suspend or erase accounts that break the rules. Report anything concerning to Contact BeBook / Report a concern.

We may update this policy as the product evolves. Material changes to how we use your data will be announced in the app before they take effect.

To prevent and resolve disputes between members, BeBook may place an account at an internal verification level and ask for a phone number and, where a stronger check is needed, a postal address to which a one-time 6-digit code is posted. This is necessary for the legitimate interest of keeping exchanges safe and for handling claims. BeBook has no text-message service, so a phone number you provide is recorded as provided, not verified. Codes are stored hashed, expire (15 days for a letter code), and are never shown again once issued. The verification level, phone number, postal address and verification status are visible only to you and to the BeBook operator — never to other members. They are kept while your account exists and for as long as needed for dispute and accounting records, then deleted. To exercise your rights or contest a decision, use the protected webmaster contact on this page.