Last updated 28 October 2026

Privacy policy

Bookbunch is a small, independent book club app for the website at bookbunch.app and the Android and iOS apps. It's run by Luke Taylor in the UK, who is the data controller for the information below. Questions go to [email protected].

The short version: we keep what's needed to run your bunches, we don't sell it, we don't show ads, and you can have it deleted.

What we collect

• Your account: username, display name, email address, a hashed password (never the password itself), your timezone, and the avatar, colour, bio and profile photo you choose.
• What you add in a bunch: the bunches you join, reading progress, margin notes and any pictures on them, ratings, hearts, votes, picks, presentations, prompt answers and reading goals.
• Notifications: if you turn them on, a push token for your device or browser so we can send reminders and bunch updates.
• Usage analytics: which pages and screens are visited, plus the device type, operating system, browser, country and referring site. We use a self-hosted copy of Umami, which doesn't use cookies or follow you across other sites.
• Technical data: your IP address is used briefly to limit abuse such as repeated sign-in attempts, and appears in short-lived server logs.

Pictures you upload are re-encoded on our server, which strips hidden data such as a photo's GPS location.

Why we use it

• To run the service you asked for: your account, your bunches, and showing your notes and progress to the people in them. (Legal basis: contract.)
• To send the emails the service needs, like confirming your address and resetting your password, and the notifications you've turned on. (Contract.)
• To understand which parts of Bookbunch get used so we can improve it, and to keep it secure. (Legitimate interests.)

We don't sell your data, use it for advertising, or share it with data brokers.

Who can see it

Your display name, avatar, profile and what you post in a bunch are visible to the other members of that bunch. Bunch owners can manage their bunch's members. Nothing you post is public on the open web.

Services that help run Bookbunch

These process data on our behalf, only to provide their part of the service:

• Our hosting server, which stores the database and uploaded pictures and runs the analytics.
• Resend, which sends our emails, so it handles your email address and the message.
• Expo, Google Firebase Cloud Messaging and Apple Push Notification service, which deliver push notifications to your device.
• Open Library, which we search for book details and covers. Our server sends it the search terms, not who you are.

Some of these providers are outside the UK. Where they are, they protect the data with the safeguards UK law requires, such as standard contractual clauses.

Links to Patreon or Buy Me a Coffee take you to those sites, which have their own privacy policies.

Security

All traffic to and from Bookbunch is encrypted with HTTPS, and passwords are stored only as salted hashes.

How long we keep it

We keep your account and content for as long as you have an account. When an account is deleted, we remove its profile, email, push tokens and personal data, and delete or anonymise what it posted in bunches. Server logs and backups roll over and are gone within 30 days.

Deleting your account

To delete your account and its data, email [email protected] from the address on your account, or tell us your username. We'll confirm and delete it within 30 days. You can also leave any bunch at any time from inside the app.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask to take it elsewhere. Email us and we'll respond within a month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

Bookbunch isn't meant for children under 13, and we don't knowingly collect their data. If you think a child has made an account, let us know and we'll remove it.

Changes

If this policy changes, we'll update the date at the top. For a significant change, we'll let you know in the app or by email.