Book Box privacy policy
Last updated 29 September 2026
Who we are
Book Box is an app for cataloguing the physical books you own. This policy covers the iOS, Android, macOS and web versions, and the website at bookboxapp.ca.
What we collect
Your account. An email address, plus a display name and profile photo if your sign-in provider gives us one. Firebase Authentication handles signing in, or Apple or Google if you pick those. We never see or store your password. Your sign-in provider keeps it.
Your library. The books you add and everything you record about them. That means titles, authors, ISBNs, cover photos, shelf locations, reading status, ratings, your private notes, and lending records including any name you type for the person who has the book.
Cover photos. Photos you take or pick for a book, stored so your library keeps its artwork.
App preferences. Theme, layout, and how far through setup you are.
Usage and crash data. Firebase Analytics records which screens you open and a few events: a book added, the paywall shown, a shared library viewed. Firebase Crashlytics records crashes along with your device model and OS version so we can fix them.
We do not collect your contacts, your location, your browsing outside the app, or any advertising identifier.
Your camera and photos
The camera does two jobs. It reads barcodes, which happens entirely on your device, so that video never leaves your phone. And it photographs covers. We only touch your photo library for images you pick yourself. You can refuse or revoke either permission in your device settings, and the rest of the app keeps working.
AI cover scanning
When you use Scan Cover with AI, we send that one cover photo to OpenAI, which reads the title and author printed on it. Nothing else goes with the photo. Not your library, not your account, nothing else about you. We count how many scans you have used so we can enforce the monthly limit.
OpenAI may use these photos to train its models. Book Box takes part in OpenAI's data sharing program, which lets OpenAI keep the photo and what its model read from it and use them to improve its models. In return we get free usage, which is part of how we keep the price down.
If you would rather your photos were not shared this way, don't use Scan Cover with AI. Scanning a barcode, typing an ISBN or adding a book by hand never sends a photo anywhere, and a cover photo you add to a book yourself is stored in your library, not sent to OpenAI.
Looking up books
When you scan or type an ISBN, we send that number to public book catalogues: Open Library, K10plus and the Library of Congress. They get the ISBN and nothing else. No account details, nothing that identifies you. We cache what comes back on our servers so nobody has to look up the same book twice. That cache holds book information only, and we do not link it to any user.
Sharing
Your library stays private until you decide otherwise. There are two ways to share it.
With one person, by email. They can see your library, and if you give them editing rights they can add and change books. You can revoke access whenever you want.
With a public link. This makes a page anyone can open without signing in. It shows the display name you choose and the books in your library, plus your ratings and notes if you switch those on. Anyone holding the link can read it, links get forwarded, and search engines may index the page. Books you have marked private never appear on it. Turning the link off stops it working.
Purchases
RevenueCat, Apple and Google handle subscriptions. They tell us only whether your subscription is active. Your card details go to Apple or Google and never reach us.
Who else sees your data
We do not sell your data, and we do not share it for advertising. These companies process it on our behalf so the app can run:
- Google Firebase, for accounts, the database, file storage, analytics and crash reports
- OpenAI, for cover scanning, only when you use it, and who may use those photos to improve its models
- RevenueCat, for subscription status
- Open Library, K10plus and the Library of Congress, for book information by ISBN
We may also hand over information if the law requires it. Google Cloud stores your data, which can mean processing it in the United States and other countries.
How long we keep it
We keep your library until you delete it or close your account. Deleting your account from Settings removes your profile, your books, your cover images and your shares. Backups may hold copies for a short while before they get overwritten. Firebase keeps analytics and crash reports under Google's own schedules.
Your rights
You can read and edit everything in your library inside the app, and delete your account and all of its data from Settings, under Account. Depending on where you live, you may also have the right to ask for a copy of your data, ask us to correct or delete it, or object to how we process it. Email us and we will sort it out.
Children
Book Box is not aimed at children under 13, and we do not knowingly collect their information. If you think a child has made an account, tell us and we will remove it.
Security
We send data over encrypted connections and store it on Google Cloud. Access rules mean only you can read your library, along with anyone you have deliberately shared it with. No system is perfectly secure, but we take reasonable steps to protect your information.
Changes
If this policy changes in a way that matters, we will update the date at the top. When a change is significant, we will tell you in the app.
Contact
Questions, or a request about your data: hello@bookboxapp.ca