Privacy Policy
Last updated 21 September 2026 · Bookcairn is run independently from India · karankumar@gmail.com
We collect as little as possible: your email (for sign-in), your username and profile fields, and the books you log. Nothing is sold, there is no ad tracking, and there are no tracking cookies. Everything is private by default, and you can delete all of it from your Account page in one click.
1. Who is responsible
The data controller is Bookcairn, run independently from India. Contact: karankumar@gmail.com. If you are in the European Economic Area or the United Kingdom, see section 9 for your rights and how we handle requests.
2. What we collect and why
| Data | Where it comes from | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Email address and a user ID | Clerk, when you sign in | To identify your account and contact you about it (receipts, security, policy changes) | Contract |
| Username, bio, tagline, link, profile theme, public/private setting | You | To build your profile and, if you choose, show it publicly | Contract; consent for making it public |
| Books you log: title, author, cover URL, pages, rating, categories, one-liner, notes, dates, status, visibility | You, with book details from Open Library | To run your shelf, cards, wrap, and (only for public books) Discover and book pages | Contract |
| Subscription status, plan, renewal date, a Dodo customer and subscription ID | Dodo Payments | To know which features you have paid for and to let you cancel | Contract |
| Server logs: IP address, browser type, requested page, timestamp, retained up to 30 days | Cloudflare, automatically | Security, abuse prevention, and keeping the site running | Legitimate interest |
| Aggregate, cookieless analytics (page views by path and country) | Cloudflare Web Analytics, if enabled | To see which pages are used. It does not identify you. | Legitimate interest |
| Messages you send us | You, by email | To answer you | Legitimate interest |
We never see your card number. Payment details go directly to Dodo Payments. We never see your password. Authentication is handled by Clerk.
3. Using Bookcairn without an account
You can log books and make cards without signing in. In that case your books are stored only in your browser's local storage and never reach our servers. Book searches are sent to Open Library (see section 5). Clearing your browser data removes the books. When you later sign in, the books in that browser are imported into your account once and then removed from local storage.
4. What is public
Your profile is private by default. If you make it public, these become visible to anyone, including search engines: your username, bio, tagline, link, profile theme, and the books you have not hidden, with their ratings, categories, one-liner, notes, and status. Public books also count toward community statistics on book pages and Discover, shown with your username. Your email address is never public. You can switch back to private or hide individual books at any time, and the change takes effect immediately, though search engines may keep a cached copy for a while.
5. Who we share data with
We do not sell personal data and we do not share it with advertisers. We use these providers, each of which processes data only to provide its service to us:
- Clerk (United States) for sign-in. Clerk receives your email and login activity.
- Cloudflare (global network) for hosting, the database, and optional cookieless analytics.
- Dodo Payments (merchant of record) for the paid plan. Dodo receives your email and payment details and is an independent controller for the payment itself; see its privacy policy at checkout.
- Open Library (Internet Archive, United States) for book search and covers. When you search, your search text and IP address go to Open Library. When a cover is displayed, your browser fetches it from Open Library.
We may also disclose data if the law requires it, to protect someone's safety, or to enforce our Terms, and in a sale or transfer of the service, in which case this policy continues to apply.
6. International transfers
We are based in India, and our providers store data in the United States and on Cloudflare's global network. Where the GDPR or UK GDPR applies, transfers rely on the providers' standard contractual clauses or an adequacy decision. You can ask us for details.
7. How long we keep data
- Account and book data: until you delete it or your account. Deletion from the Account page is immediate in our database; backups roll off within 30 days.
- Subscription records: until deletion, except that Dodo Payments keeps transaction records for as long as tax and accounting law requires.
- Server logs: up to 30 days.
- Email correspondence: up to 2 years.
8. Security
Data is encrypted in transit. Sign-in is handled by Clerk with industry-standard protections. Access to the database is limited to the operator. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and any regulator we are required to notify without undue delay.
9. Your rights
Wherever you live, you can see, change, export, and delete your data yourself: edit any book, change your profile, toggle visibility, and use Delete my account on the Account page. If you are in the EEA, UK, or another place with data-protection rights, you also have the right to access, rectify, erase, restrict, or object to processing, to data portability, and to withdraw consent, and you can complain to your local supervisory authority. In India, the Digital Personal Data Protection Act 2023 gives you similar rights of access, correction, erasure, and grievance redressal. To exercise any right, email karankumar@gmail.com from the address on your account; we answer within 30 days. Residents of California and other US states with privacy laws: we do not sell or share personal data for advertising, and the rights above apply to you too.
10. Children
Bookcairn is not for anyone under 16. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will delete it.
11. Cookies
We use only strictly necessary cookies (Clerk's session cookie when you sign in, and a dev-only cookie in local testing). There are no advertising or tracking cookies, so there is no cookie banner. Details are on the Cookies page.
12. Changes
If we change this policy in a way that affects you, we will post a notice or email account holders before it takes effect. The date at the top shows the current version.