BookFeed

Privacy

Last updated: 5 November 2026

BookFeed shows you short passages from books and learns what you like to read. To do that it keeps some information about your reading. This page says what, why, who else touches it, and how to take it back.

Who we are

BookFeed is run by HOOTCODES LTD, the controller of your personal data. Questions or requests about your data: [email protected].

What we keep

You can read without an account. Then you are a reader with a random id, kept in a cookie on your device. We know nothing else about who you are.

  • Your reading: which passages you were shown and how long you stayed, what you liked, saved, read on from or marked "not for me", and the words you looked up.
  • What you write and choose: your shelf and ratings, notes, highlights and answers in the margins, and what you tell us when you start (the books you love, the languages you read, and anything you write or dictate about your taste).
  • Your taste profile: a summary of the feelings, themes and kinds of prose you seem to enjoy, calculated from the above. It powers your feed and your map.
  • Settings: app language, the mix of languages you read, sound on or off.

If you save your map with an account, we also keep your email address. If you sign in with Google or Apple, we receive your email address, your name if the provider shares it, and an account id from them. No password: you sign in with a code we email you, or with Google or Apple. For each signed-in device we keep the session and the type of browser, so you can sign out everywhere.

If you support BookFeed, Polar handles the payment as the seller (see below). We receive whether you are a supporter, never your card details.

Why we use it

  • To run the app: show your feed, your shelf and your map, and keep them across your devices once you sign in.
  • To recommend what to read next. This is automated profiling of your reading taste. It only decides which passages and books you see first. It has no legal or similar effects on you, and you can reset it by deleting your data.
  • To email you sign-in codes. We don't send newsletters or marketing email.
  • To keep BookFeed working and safe: limit abuse of sign-in, find errors, and see which features help (for example, whether the "add to home screen" sheet was shown or dismissed). These usage events are linked to a random id for your browser tab, never to your reader, and aren't used for recommendations.

Our legal bases: providing the service you asked for (contract), and our legitimate interest in improving and protecting it. Where we rely on legitimate interest, you can object (see Your rights).

AI and your words

We use AI models to describe books and passages, to define words you look up, and to understand your taste. For this, parts of your reading may be sent to these models: the books you love and their titles, your shelf notes and imported reviews, what you write when you start, the lines you highlight with your notes on them, and the word you look up with the passage around it. We never send your name, email address or reader id. The models are reached through OpenRouter, which passes requests to AI providers (such as DeepSeek, Z.ai, OpenAI and Google). We instruct our AI gateway to use only providers that do not retain or train on the text.

Dictation uses your browser's own speech recognition. Your browser may send the audio to its maker to turn it into text (Google in Chrome, Apple in Safari); BookFeed only receives the text.

Who else handles it

Service providers that work for us under contract, only to run BookFeed:

  • Hetzner: hosts our servers and database in the European Union (Finland and Germany).
  • Cloudflare: delivers the site and protects it from attacks; it sees your IP address in passing.
  • OpenRouter and the AI providers it uses: the AI work described above.
  • Postmark: sends sign-in emails.
  • Polar: takes payments for supporters as merchant of record. Polar is responsible for your payment data under its own privacy policy.
  • Google and Apple, only if you choose to sign in with them.

Book covers and fonts come from our own servers: we fetch covers from their sources (such as Open Library, Project Gutenberg, Google Books and Goodreads) ourselves, so those sites never see your IP address.

Some providers, such as several AI providers, are outside the European Union. Where your data goes outside it, the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision.

Your IP address

We use your IP address in the moment to work out your country (for the right bookshops and prices). We don't store it. To limit abuse of sign-in we keep a scrambled (hashed) form of it for at most a day.

Cookies and storage

We only use what the app needs to work, so we don't ask for cookie consent. There are no advertising or cross-site tracking cookies.

  • ss_uid: your random reader id, so the app remembers your reading (1 year).
  • bk_session: keeps you signed in (1 year, renewed while you use it).
  • bk_lang: the app's language (1 year).
  • bk_goauth / bk_aoauth: protects a Google or Apple sign-in while it happens (10 minutes).
  • Your browser's local storage keeps small preferences on your device only (for example sound, whether you dismissed a prompt), and the offline copy of a few passages if you installed the app.

How long we keep it

Your reading data stays as long as you use BookFeed, until you delete it. If you read without an account and don't come back for 24 months, we delete your reader and its data. Usage events are deleted after 180 days. Sign-in codes expire after 15 minutes and sessions after a year without use. Our providers may keep short technical logs, which can include IP addresses, for security.

Your rights

You can see, download, correct and delete your data, object to how we use it, and ask us to limit it. Two of these are one tap away in Settings (the gear on your map): Download your data gives you everything we hold about your reading in one file, and Delete account and data (Delete your reading data, without an account) removes your reader, your account and all your reading data right away. Payment records that the law requires stay with Polar.

For anything else, write to [email protected]. You can also complain to your data protection authority (in Greece, the Hellenic Data Protection Authority).

Children

BookFeed is for readers aged 16 and over. Younger readers need a parent's or guardian's consent.

Changes

If we change how we use your data, we will update this page and its date, and tell you in the app when the change matters.

HOOTCODES LTD · [email protected] · Terms