Privacy policy

The short version

• We keep what the app needs to work: your account, your books, your spins and your settings.
• We do not sell your information and we do not show ads.
• Analytics (if this site has turned it on) is optional, and you can switch it off at any time.
• Your location, if you share it for the bookshelf’s sunrise and sunset, and your camera, if you scan a barcode, never leave your device.
• Accounts are created by the site’s administrator. To get a copy of your data or have your account deleted, ask us (see Contact).

What we keep on the server

• Your account: username, email address (if you have one on file), a salted hash of your password (never the password itself), your roles (for example, administrator), and when the account was created.
• Your library: the books you add, with their title, author, ISBN, book type, cover image and whether they were added with the barcode scanner. Books you remove are kept as removed so they can be restored if you import them again; they are deleted for good when your account is deleted.
• Your spins: which book the wheel picked and when. This powers your statistics.
• Your settings: theme, language, wheel colors, bookshelf scene and your analytics choice, so they follow you to other devices.
• Security records: a count of recent failed sign-in attempts for a username (cleared after a successful sign-in and removed within a day), and one-time links for password reset, account setup and email changes, which expire and cannot be reused.
• Server logs: technical logs used to keep the site running and secure. Security events (such as too many requests or failed sign-ins) record the IP address and browser type that made the request. Logs are deleted automatically after 14 days.
• Administrator activity log: when an administrator manages user accounts, book types, book information sources, wheel colors or site settings, the action is recorded: who did it, when, what changed and a before-and-after summary. It never stores passwords, password hashes, reset links, tokens or full email addresses (email changes keep masked addresses only, like n***@example.com). Only administrators can see it. Entries are deleted automatically after 90 days unless the administrator chooses a different period. It exists for security and accountability, not to track ordinary use.

What stays on your device

• Sign-in cookie (BookWheel.Auth): keeps you signed in. It is required for the app to work and is not used for tracking. Without “Remember me” it ends after 8 hours without activity (24 hours at most); with “Remember me” it lasts up to 30 days, or 7 days without use.
• Local storage: your theme, language, wheel colors, bookshelf scene, library search and sort choices, whether you have seen the analytics notice and the latest “What’s new”, and your analytics choice. These are app settings, not tracking identifiers.
• Location (optional): if you turn on real sunrise and sunset for the bookshelf scene, your browser asks for your location. We round it and keep it in local storage on that device only; it is never sent to our server or to anyone else. You can clear it in Settings.
• Camera (optional): the barcode scanner reads the camera image in your browser to find an ISBN. Video is never uploaded or recorded.
• Offline copy: the app saves its own files and your book covers in the browser so it can open without a connection.

How we use it

Only to run the app for you: to sign you in, show and update your library, pick books, show your statistics, send the emails described below, keep the site secure and fix problems. We do not build advertising profiles, and we do not use your information for anything unrelated to Book Wheel.

Emails we send

Only messages about your account, and only if this site has email set up: an invitation to set up your account, a password reset link, a reminder of your username when you ask for it, a confirmation link when you change your email address, and a notice to your old address when it changes (showing the new address masked). We do not send marketing email.

Who else sees any of it

We do not sell or rent personal information. A few outside services are involved, each only for the purpose described:

• Book information services: when you look up a book, our server asks Open Library, Google Books or Hardcover (whichever the administrator has enabled) using only the ISBN or the search words. The request comes from our server, so these services do not see your IP address, your account or your library. Cover images are fetched by our server and stored with the book.
• Have I Been Pwned: when you set a new password, our server checks whether it appears in a known data breach using the Pwned Passwords service. Only the first 5 characters of a one-way hash of the password are sent, never the password, its full hash, your username or your email, so the service cannot tell which password was checked. If the service is unreachable, the check is skipped.
• Google Analytics (only if this site has turned it on): helps us see how the app is used so we can improve it. See Analytics below.
• Email delivery: the account emails above are sent through the email provider this site is configured with, which handles your email address and the message to deliver it.
• Hosting: the site runs on servers and network services chosen by the operator, which process traffic and store data on our behalf.
• Links to other sites: a book’s search links (for example to Amazon, Barnes & Noble, Bookshop.org, Goodreads or Google Books) open those sites only when you click them. We do not share anything with them; once you are there, their own privacy policies apply.
• The law: we may disclose information if we are legally required to, or to protect the safety of users or the site.

Analytics

If this site has Google Analytics turned on, you will see a notice on your first visit and an “Analytics & privacy” link in the footer. Analytics is on unless you opt out. You can opt out with one click in that notice, in the footer link, or in Settings; when you are signed in, your choice is saved to your account so it applies on every device. If your browser sends a Global Privacy Control signal, analytics stays off regardless of the setting. When you opt out, the analytics script is not loaded at all. Google’s use of this data is covered by Google’s privacy policy. If the footer has no “Analytics & privacy” link, this site does not use analytics.

How long we keep it

• Account, library, spins and settings: until your account is deleted. Deleting an account removes its books (including removed ones), covers, spin history, settings and pending links.
• Failed sign-in counters: up to a day. One-time links: until they expire or are used.
• Server logs: 14 days.
• Administrator activity log: 90 days unless the administrator chooses otherwise. If an administrator’s account is deleted, their entries keep the username as it was and are removed with the rest at the end of the period.
• Backups made by the operator may hold copies for a limited time after deletion.

Your choices

• See and correct: you can view and edit your books and settings in the app, and change your email address in Settings when this site has email set up. Otherwise, ask us.
• Export: you can export your library as a file from the app. For a copy of everything we hold about you, ask us.
• Delete: ask us to delete your account and everything in it.
• Analytics: opt out (or back in) at any time, as described above.
• Location and camera: both are optional and controlled by your browser’s permissions.

We will answer requests within 30 days. These choices are available to everyone, wherever you live.

Security

Passwords are stored only as salted hashes; sign-in is protected by rate limits and temporary lockouts; the sign-in cookie cannot be read by scripts; connections use HTTPS when the site is set up for it; and administrator actions are logged. No system is perfectly secure. If you find a security problem, please tell us (see Contact).

Children

Book Wheel is not for children under 13. We do not knowingly collect information from anyone under 13; if we learn that we have, we will delete it.

Changes to this policy

When we change this policy, we update the date at the top and add a line to the change log below. For significant changes, we will let users know in advance where we reasonably can.

Change log

• November 11, 2026: first version.

Contact

Email jasonkryst+legal@gmail.com.