Privacy Policy

Information we collect

Account information

When you create an account, we collect your email address, display name, and password. You may also add a profile photo.

Reading activity

We collect data about your reading sessions, including books you add, time spent reading, pages read, and reading streaks.

Content you create

This includes highlights, reflections, notes, and any other content you enter in the App.

Book search queries

When you search for a book to add, your search terms (title, author, or ISBN) are sent to Google Books and Open Library so we can look up book details and cover images. These queries are handled by those providers under their own privacy policies and are not tied to your account.

Book club data

When you create or join book clubs, we collect club details, meeting information, and the reflections and highlights you choose to share with a club. Shared reflections and highlights are used only to generate AI discussion questions for that club (see “How we use your information” below); they are not shown directly to other club members. If you set a location for a club meeting, the place text you type is sent to OpenStreetMap (Nominatim) for address autocomplete. We do not collect your device's GPS location.

Invites and referrals

Nookclub uses usernames as invite codes. When you invite someone, share your invite link, or join through another member's code, we record the connection so we can link your accounts and, where applicable, grant a referral free trial. Invitations are always entered manually (a typed username or email address); the App does not read or upload your device's contact list.

Device and usage data

We use PostHog to collect product analytics and crash reports, including feature usage, screen views, and your device type and operating system version (to improve compatibility). This data is tied to a random, app-generated identifier rather than your name or email, and is stored on PostHog's servers in the United States. You can turn analytics and crash reporting off at any time in the App's settings.

Photos

If you set a profile photo or a custom book cover, we access your photo library only to let you pick that image. Nookclub does not use your camera and does not scan or upload other photos.

Waitlist

If you joined our waitlist before the App launched, we collected your email, name (optional), preferred device, and IP address (for rate limiting). We do not use cookies or tracking pixels on this website.

How we use your information

• Provide the service: store your reading data, display your highlights and reflections, and power book club features.
• Generate reflection questions: your highlights, notes, and reading context are sent to our AI provider (Anthropic) to generate personalized reflection questions. This data is used solely for generation and is not used to train AI models.
• Generate book club questions: when a club host generates discussion questions, the highlights and reflections that members have shared with that club are aggregated and sent to Anthropic to produce group discussion questions. Only content already shared within the club is used, and it is not used to train AI models. Members do not see each other's raw highlights or reflections; only the resulting AI-generated questions are shown to the club.
• Send notifications: book club updates and account notifications you have opted into. Reading reminders are scheduled as local notifications on your device; nothing is sent to our servers to trigger them.
• Process payments: subscription management through RevenueCat and the app store you purchased from (Apple's App Store on iOS or Google Play on Android). We do not store your payment card details.
• Improve the App: product analytics and crash reports help us understand how features are used and identify issues. You can opt out at any time in the App's settings.
• Communicate with you: service updates, account notifications, and responses to your inquiries.

We will not send unsolicited marketing emails, share your information with advertisers, or sell your data.

Legal basis for processing (EU/UK users)

If you are in the European Union or United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR to process your personal data:

• Performance of a contract: to create and maintain your account and provide core App features, such as reading tracking, highlights, reflections, and book club functionality.
• Consent: for optional processing such as analytics, crash reporting, and push notifications, which you can withdraw at any time in the App's settings.
• Legitimate interests: to secure the App, prevent fraud and abuse, and maintain and improve our features, balanced against your rights and interests.
• Legal obligation: where we must retain or disclose information to comply with applicable law.

Third-party services

We use the following services to operate Nookclub:

• Supabase for data storage and authentication
• Anthropic for AI-generated reflection and book club discussion questions
• Google Books and Open Library for book search and cover lookups (they receive your search terms)
• OpenStreetMap (Nominatim) for club meeting location autocomplete (it receives the place text you type)
• Expo (EAS Update) for delivering over-the-air app updates (your device checks in for the latest version)
• RevenueCat for subscription management
• PostHog for product analytics and crash reporting (tied to a random identifier, stored in the United States)
• Apple Push Notification service (iOS) and Firebase Cloud Messaging (Android) for server-sent notifications such as book club updates (reading reminders are local to your device and do not use these services)
• Apple App Store and Google Play for processing subscription purchases on iOS and Android
• Resend for transactional email delivery
• Upstash for rate limiting
• Vercel for website hosting

Each service processes data only as needed to provide its function and is subject to its own privacy policy. Your data may be transferred to and stored on servers located outside your country of residence, including in the United States. Where we transfer personal data of users in the European Union or United Kingdom to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) as the safeguard for that transfer. You can request a copy of these safeguards using the contact details below.

Data sharing

We do not sell, rent, or share your personal information with third parties for their marketing purposes. We share data only with the service providers listed above, and only to the extent necessary to operate Nookclub. We may disclose your information if required by law or to protect our rights, safety, or property.

Meeting details and AI-generated discussion questions are visible to other members of a club. Your original reflections and highlights are not shown directly to other club members; they are used only to generate those questions.

Data retention

We retain your account and reading data for as long as your account is active. If you delete your account, we permanently delete all your personal data, including reading history, highlights, reflections, and profile information. Content shared in book clubs may remain visible in anonymized form. Analytics and crash-reporting data, tied only to a random identifier, may be retained indefinitely.

On-device storage

To support offline use, Nookclub stores a limited amount of your reading content (the book you are currently reading, the highlights you capture, and an in-progress or not-yet-synced reading session) in your device's local app storage. This data is unencrypted, stays on your device, syncs to our servers when you reconnect, and is removed when you sign out or delete the app. Your login credentials are stored separately in your device's secure storage (the iOS Keychain or the Android Keystore).

Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate information in your account
• Delete your account and all associated data from within the App
• Restrict or object to certain processing of your data
• Withdraw consent for optional data processing (e.g. push notifications, analytics)
• Request a copy of your data (data portability)

You can delete your account directly in the App. To request a copy of your data (a machine-readable export of your account, books, sessions, highlights, and reflections), email nookclub@outlook.com and we will send it to you. We will respond within 30 days.

Depending on where you live (for example the European Union, the United Kingdom, or California), you may have additional rights over your personal data, such as access, correction, deletion, portability, and the right to object to certain processing. We do not sell your personal information or share it for cross-context behavioral advertising, so there is no “do not sell” request to make. If you are in the EU or UK, we rely on your consent and on our legitimate interest in operating the App as the legal bases for processing, and you can withdraw consent at any time. You can exercise any of these rights by emailing nookclub@outlook.com.

Regional privacy rights

California notice at collection

In the past 12 months, we have collected the following categories of personal information, as defined by the California Consumer Privacy Act (CCPA):

• Identifiers: email address, display name, device identifiers
• Customer records information: profile photo, app preferences
• Internet or other electronic network activity: app usage, feature interactions, crash reports
• Geolocation data: approximate location text you type for club meetings (we do not collect precise GPS location)
• Commercial information: subscription status and purchase history via the app store
• Sensitive personal information: account log-in credentials (email and password). We use this only to authenticate you and secure your account, a use permitted under the CCPA, so we do not offer a separate right to limit its use.

We collect this information directly from you, from your device, and from the service providers listed in “Third-party services” above, and we use it for the purposes described in “How we use your information” above. We do not sell or share (as defined by the CCPA) any personal information, and have not done so in the past 12 months. We retain each category as described in “Data retention” above.

If you are a resident of a U.S. state with a comprehensive privacy law (such as California, Colorado, Connecticut, Virginia, or Utah), you have rights similar to those described above: the right to know what personal information we collect, to access and delete that information, to correct inaccuracies, and to opt out of the sale or sharing of personal information for cross-context behavioral advertising. As noted above, we do not sell or share your personal information in that way, and we do not use automated decision-making that produces legal or similarly significant effects about you. We will not discriminate against you for exercising any of these rights. California residents may also designate an authorized agent to make a request on their behalf.

If you are in the United Kingdom or the European Union, you have the right to lodge a complaint with your local data protection supervisory authority, such as the UK Information Commissioner's Office (ICO) or the data protection authority in your EU member state, if you believe we have not adequately addressed your concerns.

If you are in Canada, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada or, if you are a Quebec resident, the Commission d'accès à l'information du Québec.

If you are located elsewhere, you may have similar rights and a similar right to complain to a data protection or consumer protection authority under the law of your country of residence.

This policy is intended to comply with the major data protection frameworks that apply to our users, including the GDPR and UK GDPR, Quebec's Law 25, Canada's PIPEDA, and U.S. state privacy laws. If any provision of this policy conflicts with a mandatory protection you are entitled to under the data protection law of your country of residence, that mandatory local law will govern to the extent of the conflict.

Children's privacy

Nookclub is not directed at children under 13, or under the higher minimum age required to consent to online services in your country (for example, 16 in some parts of the European Union). We do not knowingly collect personal information from children below that age. If you believe a child below the applicable age has provided us with personal information, please contact us at nookclub@outlook.com and we will delete the account promptly.

Security

We use industry-standard security measures to protect your data, including encryption in transit and at rest. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Breach notification

In the event of a data breach that poses a real risk of significant harm, we will notify affected users by email and through the App within 72 hours of becoming aware of the breach. We will also notify the Office of the Privacy Commissioner of Canada and the Commission d'accès à l'information du Québec as required by law. Our notification will describe the nature of the breach, the data involved, the steps we are taking, and what you can do to protect yourself.

If you are in the European Union or United Kingdom and the breach is likely to result in a risk to your rights and freedoms, we will also notify the competent supervisory authority (such as the ICO in the UK, or the relevant EU data protection authority) within 72 hours of becoming aware of the breach, and will notify you directly without undue delay if the breach is likely to result in a high risk to you.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the App or by email. Your continued use of Nookclub after changes take effect constitutes acceptance of the updated policy.

Contact

Nookclub is operated from Montreal, Quebec, Canada, and the operator of Nookclub is the data controller responsible for your personal data. For questions about personal information protection under Quebec law, contact us at the email below.

If you are in the European Union or the United Kingdom, you can reach us about your data at the same email, and we will designate a local representative under Article 27 of the GDPR (and the UK GDPR) where we are legally required to do so.

Questions about this policy? Reach us at nookclub@outlook.com.

Your use of Nookclub is also governed by our Terms of Service.