Privacy
What we hold
- Your account: email address, display name, and a hash of your password — never the password itself.
- Your books: the files you upload, kept exactly as you sent them, plus any format we convert them into so they can be read in a browser.
- What we read out of your books: title, authors, series, publisher, description, cover.
- How you read: your position in each book, how far you have reached, and your reader settings.
- How you organise: your shelves and tags.
- What you write: your highlights, bookmarks and notes — including the passage each one marks and any note you attach to it. This is the only thing here you author rather than upload.
- If you subscribe: which plan you are on, whether the subscription is active, when the current period ends, and the identifiers our payment processor uses for you. Your card details never reach Bookary — payment happens on the processor's own pages.
Where your books are served from
The contents of your books are never served from this site. Pages and text are delivered from a separate books origin that receives no cookie and cannot read your session, so nothing inside a book can act on your account while you read it. That separation is deliberate and is the strictest rule in how Bookary is built. Cover images are the one exception: they are served from here, because a cover is a picture rather than a document that can run.
Cookies
Bookary sets no advertising or analytics cookies. It sets:
- a sign-in cookie, so you stay signed in between pages. On the live service it is marked
Secure, so your browser only ever sends it over HTTPS; - an antiforgery cookie, which stops another site submitting forms as you.
Signing out clears the sign-in cookie. So does deleting your account.
We email you to confirm your address, to reset your password, and to tell you if somebody tries to register an account with your address. Those messages go through a delivery provider, which necessarily sees the address they are sent to. We do not send marketing email.
Payment
If you subscribe, payment is handled by Stripe. You enter your card on Stripe's own pages, not ours: no card number, expiry or security code ever reaches a Bookary server, which is why we can say we could not leak one. What we store is the identifier Stripe gives us for you and for your subscription, the plan, its status and its renewal date — enough to know what you are entitled to and nothing more. Stripe is a processor acting for us and holds your payment details under its own terms.
Taking your data with you
Your account page — or
GET /api/v1/account/me/export — returns everything we hold about
you as a single file: your profile, every book with its checksum, your
shelves, tags, series, reading positions, settings, and your highlights and
notes with the passages they mark. The checksums let you verify that a file
you download is byte-for-byte the one we held.
Deleting your account
You can delete your account yourself, from your account page. We ask for the password because deletion cannot be undone — a stolen browser session is not enough to erase your library.
Deletion removes your account, your books, the uploaded files themselves, every format we derived from them, your covers, shelves, tags, series, reading positions and settings. Books you had already deleted are removed too — nothing of yours is kept back for a grace period, and there is no thirty-day window. Your account and its records are removed before the request returns. File removal is requested immediately and runs in the background; a daily cleanup catches files left by interrupted or failed attempts. The response does not mean the files are already gone. This describes the live service; see Backups below for the part it is not true of.
Two things deliberately survive, and neither identifies you to anyone reading them: internal records that some event happened, which carry identifiers and no personal detail; and the shared catalogue of author names, which is not yours to remove and is not linked to you once your books are gone.
Backups
Everything above is about the live service. It is not the whole story, and the difference is worth stating plainly rather than leaving you to assume the better version.
Copies of your data can persist in our backups for up to 30 days after you delete it. Backups exist so that a mistake on our side — a bad deployment, a faulty purge — cannot take your library with it, and a backup that erased everything the instant the live service did would not survive the one failure it is for. So a deleted file and an erased account remain in the offsite copy for that window, and are then removed permanently.
Thirty days is a deliberate figure rather than a description of whatever happens. It is long enough for a fault on our side to be noticed and undone, and short enough to be a real limit on how long we keep something you asked us to destroy. Nothing is exempt from it: the same window applies to your files, your annotations and your account record alike.
Backups are not part of the running service. Nothing in them is served to anyone, searched, or used for any purpose other than restoring the service after a failure — and if a restore ever brought back data you had deleted, deleting it again is the remedy.
Asking us something
Write to ops@example.com. See also our terms.