BookStashPrivacy Policy
We do not sell your data or share it with third parties for marketing. Your library is yours alone.
Overview
This policy explains what data BookStash collects, how we use it, and how we protect it.
BookStash is one of the FAMHQ apps (Lookboard, Roam, BookStash, Keyring, Mise). They share one account: you sign in to each of them with the same email address, and your name and profile photo are the same in all of them. Anyone can sign up and use BookStash for free, with limits.
To apply those limits and keep our costs in check, we count per account, per day and per month how often you use the parts that cost us money: sign-in emails, file uploads, AI features, maps and the book page reader. These counts are numbers only. For emails we count a one-way hash of the address, not the address. Counts are deleted after 90 days.
On the free plan the AI actions of the month are also counted per device, so that a new account on the same phone does not bring new ones. For this the app keeps a random identifier in the phone's keychain and sends it with its requests. It is not linked to advertising, is not shared with anyone and is not used to track you across apps or websites.
You sign in with a 6-digit one-time code we email to you. There are no passwords. Each app keeps its own data; deleting your account in BookStash deletes only your BookStash data (see Data retention).
Data we collect
- Account — email address; optional name and profile photo (shared across the FAMHQ apps).
- Reader profile — username, bio and whether your profile is public.
- Library — the books you add, their status (want to read, reading, read), ratings, notes, start and finish dates, and your collections.
- Friends — friend requests, friendships and blocks.
- Book links you submit — used once to fetch the book's details. The book (title, authors, cover, ISBN, source link) joins the shared catalog, without any link to you.
- Push notification token — for friend requests and app announcements.
- Last activity time — shown to your friends.
Who can see your data
Your friends can see your profile and library. If you make your profile public, any signed-in BookStash reader can see them. Other readers can find you by username to send a friend request.
How we use your data
- To provide and sync your library across devices.
- To show your reading statistics.
- To deliver friend requests and announcements as push notifications.
- To pass on your request to support a new bookstore: the store name, your name, username and email address are emailed to the developer.
We do not use advertising SDKs, behavioral analytics, or trackers of any kind.
Service providers
- Railway — hosts our application server.
- Supabase — hosts our database (PostgreSQL).
- Cloudflare R2 — stores the files and images you upload, and daily database backups.
- Resend — delivers sign-in and confirmation codes to your email address.
- Google Books API — fills in missing book details. Queries contain only book data and are not linked to your account.
- Expo (with Apple Push Notification service) — delivers push notifications. Receives your device's push token and the notification text.
When you add a book by link, our server fetches that page from the bookstore's website.
Data retention and deletion
Your data is kept for as long as your BookStash account exists. You can delete it at any time: open Profile, tap "Delete account" and enter the code we email you. This permanently removes your library, collections, reader profile, friendships and notifications from our servers immediately. Your FAMHQ account itself (email address and name) is removed when no FAMHQ app uses it any more.
Database backups are kept for 30 days, so deleted data disappears from backups within 30 days. If you no longer have the app, email support@famhq.org from the address you signed in with and we will delete your account for you.
Security
All data is transmitted over HTTPS. Files are stored privately and are reachable only through time-limited signed links. Sign-in uses one-time codes; we do not store passwords or payment information.
Children
BookStash is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.
Your rights
You may request a copy of your data, correction of inaccurate data, or deletion of your account and all associated data by contacting us or using the in-app deletion.
Changes to this policy
If we make material changes, we will update the date at the top of this page. Continued use of the app after changes constitutes acceptance.
Contact
Questions? Email us at support@famhq.org.