Privacy Policy

1. Introduction

Mybrary ("we", "us", "our") respects your privacy. This policy explains what data we collect, why we collect it, and how we handle it. We are committed to transparency and minimal data collection.

2. Data Controller

The data controller for your personal data is Aivaton AB, a company registered in Sweden. You can reach us at [email protected].

3. Data We Collect

3.1 Account Information

When you register, we collect:

• Name — to personalize your experience
• Email address — for authentication and communication
• Password — stored securely using one-way hashing (we never store plain-text passwords)

3.2 Google Sign-In

If you sign in with Google, we receive your name, email address, Google user ID, and profile picture URL from Google. We use this solely for authentication and displaying your profile.

3.3 User Content

We store the content you create: reviews, ratings, tags, lists, and saved items. This data is necessary to provide the Service.

3.4 Technical Data

We collect minimal technical data necessary to operate the Service:

• IP address — for security, rate limiting, and session management
• User agent — to identify your active sessions
• Session cookies — to keep you logged in

3.5 Two-Factor Authentication

If you enable two-factor authentication, we store an encrypted TOTP secret and recovery codes on our servers.

3.6 What We Do NOT Collect

We do not use any third-party analytics, tracking pixels, or advertising networks. No ads, no tracking, no noise.

4. How We Use Your Data

We use your data exclusively to:

• Provide and maintain the Service
• Authenticate your identity
• Display your content to you and to others when you choose to share it
• Send essential service communications (password resets, security alerts)
• Protect against abuse and unauthorized access

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Third-Party Services

When you search for content, your search queries are sent to the relevant third-party API:

• Google Books API — governed by Google's Privacy Policy
• TMDB API — governed by TMDB's Privacy Policy
• Spotify API — governed by Spotify's Privacy Policy

Search results are cached on our servers for up to one hour to improve performance. No personal data is sent to these services — only your search query text.

6. Sharing and Public Data

When you generate a share link for an item or list, the content behind that link is publicly accessible to anyone with the URL. Shared content includes the item details and your review/rating, but does not expose your account email or other personal information.

7. Data Storage and Security

Your data is stored on servers located in the EU. We use industry-standard security measures including encrypted connections (HTTPS), hashed passwords, and encrypted two-factor secrets. While we strive to protect your data, no system is 100% secure.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will permanently delete your personal data and user content within 30 days. Some data may be retained in encrypted backups for up to 90 days.

9. Your Rights (GDPR)

As we are based in the EU, you have the following rights under the General Data Protection Regulation (GDPR):

• Access — request a copy of your personal data
• Rectification — correct inaccurate data via your account settings
• Erasure — delete your account and all associated data
• Portability — receive your data in a machine-readable format
• Restriction — request that we limit how we process your data
• Objection — object to processing of your data

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Cookies

We use only essential cookies required for the Service to function:

• Session cookie — keeps you logged in
• CSRF token — protects against cross-site request forgery
• Appearance preference — stored in localStorage (not a cookie), remembers your dark/light mode choice

We do not use any tracking or analytics cookies.

11. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. We will notify registered users of significant changes via email. The "last updated" date at the top reflects the most recent revision.

13. Contact

For privacy-related questions or requests, contact us at [email protected].