Privacy

Last updated [date]

Buchmendel keeps only what it needs to give you your room and let your friends visit it. No ads, no tracking, no analytics, and nothing is sold or shared for marketing.

Who is responsible

The person named in the imprint is responsible for your data under the GDPR. Write to the address there with any question about it.

What we keep, and why

• Your account: email address, username, display name, an optional short bio, and your password, stored only as a one-way hash (bcrypt) that can't be turned back into the password. The email is used to sign in and is never shown to other people.
• Your library: the books and films you add with what you enter about them (ratings, dates, how far you've read, who you lent a book to), your notes on them and the entries in your notebook (your journal), where everything stands on your shelves, the names of your shelves and how your room looks.
• With your friends: friend requests and friendships, invite links you create, comments and reactions you leave on your friends' books and films, post-its you leave on a friend's desk, letters recommending a book or film (your message and the title, author, year and cover you sent), and the notifications these produce. A post-it or letter is kept until the friend it's for drops it or throws it away, or until either of your accounts is deleted.
• Signing in: a session record (when it started, when it ends, and your browser's name, so you could tell your devices apart), kept for 30 days or until you sign out.
• Keeping it safe: to slow down password guessing, the server counts recent sign-in attempts per IP address. These counts live only in memory for a few minutes and are never written down.

We use your data only to run Buchmendel for you: Art. 6 (1) (b) GDPR (the service you signed up for). The session record and the sign-in counts also protect your account and the service: Art. 6 (1) (f) GDPR (our legitimate interest in keeping it secure).

Who can see what

Your room, books and films are seen only by you and by people you have accepted as friends. Your notes on a book or film are seen by you alone; entries in your notebook are seen by your friends only if you mark them Friends. Anything you mark Only me is seen by you alone. A post-it or letter is seen only by the friend it's for. People who aren't your friends can find you by name to send a friend request, but can't look inside your room. Comments on a book are seen by those who can see the book.

Cookies and storage in your browser

Buchmendel sets one cookie: it keeps you signed in. It is strictly necessary, so no consent banner is needed, and it is never used to follow you anywhere else. Your browser also keeps a few small preferences on your device only: light or dark appearance, which tips you've already seen, and the welcome checklist. There are no tracking cookies, no analytics and no advertising tools.

Services we use

• Book and film details: when you look up a title, our server asks Open Library (Internet Archive, USA) or TMDB (USA) and fetches the covers. Only the words you searched for are sent, never who you are, and your browser never contacts them itself.
• Everything else (fonts, the 3D library, icons) is served by Buchmendel itself, so your browser doesn't talk to anyone else.
• Hosting: Buchmendel runs on a server rented from [hosting provider, country], which processes data only on our behalf under a data processing agreement (Art. 28 GDPR).

How long we keep it

As long as you have an account. When you delete your account (account menu → Delete account), your profile, books, films, notes, notebook, comments, reactions, post-its and letters (those you sent and those you received), friendships, invites and sessions are deleted at once. Copies in server backups are overwritten within [e.g. 30] days.

Your rights

• See and take your data: account menu → Backup downloads everything about your books and films as a file (Art. 15, 20 GDPR). For anything else, write to us.
• Correct it: edit your profile and your books at any time (Art. 16).
• Delete it: delete your account at any time (Art. 17).
• Restrict or object to how we use it (Art. 18, 21).
• Complain to a data protection authority, for example the one where you live or [the authority responsible for the operator's state] (Art. 77).

Changes

If this changes, we'll update this page and the date at the top. If a change matters for how your data is used, we'll tell you in the app first.