Your library is yours.

Last updated: 5 October 2026

This Privacy Policy explains how Rayand Software Limited (“we,” “us,” or “our”) collects, uses, and shares information when you use the BookWorm mobile application and related services (the “Service”). BookWorm is offline-first: the core library features run entirely on your device, and much of your data never leaves it.

1. Information we collect

You can catalogue your library without an account. We collect the categories below only as needed for the features you use.

Information you provide

Account details — if you create an account (needed for sync, backup and AI features), we collect your email address, your name, and a password. Passwords are stored only as a salted cryptographic hash; we never store them in plain text.
Profile information — an optional display name, bio, and profile photo. When you upload a photo, our server re-encodes it and removes its location and other metadata before storing it (see Third-party services).
Your book data — books you add, reading progress, ratings, reviews, notes, shelves, tags, loan details, and reading challenges. When sync is on for your account, this data is stored on our servers so it is available across your devices. Your ratings, reviews and notes are private to your account; BookWorm does not publish them to other users.
Launch and Book Club waitlists — if you join a waitlist from our website or the app, we store your email address, the interest you chose, when you agreed to be contacted, and which version of the consent wording you agreed to (website and app signups record different versions). App signups also send the app version; website signups do not. We use this to send TestFlight early-access invitations and the relevant launch news and, for app signups, to understand which app versions people join from.
Support communications — messages you send us, and their contents.

Information collected automatically

Usage and diagnostic data — when you use account-based features, our servers process basic technical data (such as request metadata, approximate error context, and app version) to keep the Service reliable and secure. Error reports are scrubbed to remove emails, tokens, and API keys before they are stored.
Account activity events — when you use account features, our servers record product events such as creating an account, signing in, verifying your email, adding a book to your synced library, and using an AI feature. Events carry details of the action (for example a book’s reading status, or which AI feature and model were used and how much processing it took) and are linked to your account’s random identifier, never to your name or email address. We use them to understand which features are used, so we can improve them. These events are consent-based: they are sent to our analytics provider only if you have turned on the Share usage statistics setting described below, the same setting that controls the in-app usage statistics. See Third-party services.

In-app usage statistics (only if you agree)

The app can send usage statistics — which features you use and whether they worked — so we can see where BookWorm helps and where it falls short. This is off until you turn it on.

What is sent — event names and coded values about onboarding, scanning, search, import, reading sessions, recaps, reminders, paywall views and purchase outcomes, sync, and AI results (for example, that a cover could not be found, or roughly how long an AI feature took). Counts are sent as ranges, not exact figures. Each event also carries a random event identifier and the time it happened.
What is never sent — book titles, authors, ISBNs, notes, quotes, scanned text, your email address, or any other text you type. Our server checks every event against a fixed list of allowed events and values and discards anything else.
Identifiers — a random identifier created for your installation of the app and kept in your device’s keychain. It is not Apple’s advertising identifier or vendor identifier. After you sign in, the app sends statistics with your sign-in, so our server sends them under your account’s internal user identifier and links the installation identifier to your account in PostHog, so events sent from that installation before you signed in can then be attributed to your account.
Your consent comes first — nothing is recorded until you agree. You can agree, or change your mind at any time, with the Share usage statistics switch in Settings → Data & Sync → Privacy, which is off by default. Switching it off stops collection, deletes any statistics still waiting on your device to be sent, and replaces the installation identifier with a new one, so anything sent after you switch it on again cannot be joined to what was sent before through the installation identifier. If you are signed in, statistics and account activity events associated with the same account remain linked to that account, through its internal user identifier, until that data is deleted. Switching the setting off does not delete statistics that were already sent; see Access and deletion below.
Where it goes — statistics wait on your device (at most 1,000 events, for no longer than 7 days) until they can be sent. The app sends them only to BookWorm’s own server, which forwards them to PostHog, Inc., our analytics provider, in the United States. Because our server relays them, PostHog does not receive your IP address from the app. We do not use these statistics for advertising, share them with advertisers, or use them to track you across other companies’ apps or websites.
How long we keep it — our server keeps each event’s random identifier for 30 days, so the same event is never forwarded twice, and the link between an installation identifier and an account for 30 days, so the link is made only once; neither record contains your user identifier. We also keep a daily total for each type of event, which contains no identifier of any kind. To prevent abuse, our server counts requests using a keyed hash of your network address and of the installation identifier, never the address itself, and deletes each count within 10 minutes. PostHog keeps statistics for the retention period set in our PostHog project.
Access and deletion — deleting your account does not yet delete statistics held by PostHog. To see, or have us delete, the statistics linked to your account, email support@bookwormapp.co.uk from the address on your account. If you plan to delete your account, ask us before you do: once the account is gone, we can no longer match your email address to its statistics. Statistics from an installation that was never signed in are linked only to its random installation identifier; the app does not show that identifier, so we cannot find those statistics from your email address.

We do not collect precise location, contacts, or advertising identifiers, and we do not sell your personal information.

2. Data stored on your device

Your catalogue is stored locally on your device using Apple’s on-device database. If you never sign in, your book data is not transmitted to us at all. Search features send only the text of your query (for example, a title or ISBN) to look up book information; they do not attach your identity.

3. How we use information

To provide the Service — cataloguing, syncing, search and AI features.
To authenticate you and keep your account secure, including rate-limiting and abuse prevention.
To send TestFlight invitations and launch news to people on our waitlists, and to tell Book Club waitlist members when it launches.
To process and validate subscriptions through Apple.
To fix bugs, monitor reliability, and improve features.
To communicate with you about your account, security, and support requests.
To comply with legal obligations.

Our legal bases for processing (where the GDPR applies) are performance of a contract, our legitimate interests in operating and securing the Service, your consent where required (including for in-app usage statistics), and compliance with legal obligations.

We share personal information only in these circumstances:

With service providers who process data on our behalf, and with the independent services the app relies on, only as needed to run the Service (see below).
For legal reasons, if required by law or to protect the rights, safety, and security of our users and the Service.
In a business transfer, such as a merger or acquisition, subject to this Policy.

5. Third-party services

We rely on the following providers. Each has its own privacy practices.

Apple — app distribution and In-App Purchases. Subscription purchases are processed by Apple; we receive a validated transaction record, not your payment details.
Google Books API and Open Library — to look up book metadata from your search text and scanned ISBNs. Only the query text or ISBN is sent.
Anthropic — AI features. When you use an AI feature, the content it needs is sent to Anthropic to generate the result: the titles and authors of the books involved, text you scan or capture, and, for personal features such as recaps, Year in Books, insights that reference your library and recommendations, the relevant parts of your reading data (for example, the books in your library, your progress, reading sessions and notes). Under Anthropic’s API terms this content is not used to train their models. Your email address and name are not sent.
Cloud hosting & database (Fly.io, in London, United Kingdom) — to run our servers and the MongoDB database we operate on Fly.io, which stores account data.
Profile photo storage (Tigris, Fly.io’s object storage) — stores your profile photo if you upload one: the re-encoded image, with its location and other metadata removed. We keep it until you replace it, delete your account, or ask us to remove it. The storage is private; the app loads the photo through our server from a web address that contains a long random code, not your name or account identifier, and anyone who has that address can view the photo.
Error monitoring (Sentry) — to capture scrubbed diagnostic reports so we can fix crashes.
Product analytics (PostHog, Inc., United States) — receives, through our server and only if you agree, the account activity events and in-app usage statistics described above. It does not receive your name or email address, and it receives no IP address from the app.

Fly.io, Tigris, Anthropic, Sentry and PostHog process data on our behalf, only as needed to run the Service. Apple, Google Books and Open Library are independent services that handle the requests described above under their own privacy policies.

6. Data retention

We keep account data for as long as your account is active, except for the shorter periods below.

Profile photo — kept until you replace it, delete your account, or ask us to remove it. When a photo is replaced or removed, our server deletes the old image from storage; if storage is briefly unavailable, it keeps retrying until the image is gone, and account deletion is not reported as complete while your photo remains.
Snapshot records — when you save a JSON snapshot export, our server records its sequence number, size and a fingerprint of its contents, not the snapshot itself, and deletes each record automatically 90 days after it was made. A running count of your snapshots is kept until you delete your account.
Usage statistics — our server keeps event identifiers and the links between installation identifiers and accounts for 30 days; neither contains your user identifier. PostHog keeps statistics for the retention period set in our PostHog project (see In-app usage statistics).
Rate-limit counters — hold a keyed hash of your network address, never the address itself, and are deleted within 10 minutes.

When you delete your account, we permanently remove your personal data from our systems, including your profile and profile photo, book collection, shelves, tags, reading progress, AI results and AI usage records, snapshot records, subscription records, any waitlist entry for your email address, and the moderation records you created. Copies can remain in our hosting provider’s routine storage snapshots until those snapshots expire. Deleting your account does not yet delete product analytics events held by PostHog; they remain linked to your deleted account’s random identifier until PostHog’s retention period ends. To have them deleted as well, ask us before you delete your account (see Your rights & choices). If you joined a waitlist without an account, email us and we will remove your entry. Local data on your device is removed when you delete the app or clear it in-app. We may retain limited records where required by law.

7. Your rights & choices

You can, at any time:

Access and export your data — request a machine-readable copy of your account data from within the app.
Delete your account — permanently erase your account and associated data from within the app.
Withdraw consent to usage statistics — switch off Share usage statistics in Settings → Data & Sync → Privacy. Collection stops, statistics still waiting on your device are deleted, and the installation identifier is replaced.
Ask for access to, or deletion of, analytics data — email support@bookwormapp.co.uk from the address on your account, and we will give you, or delete, the product analytics linked to your account, including events held by PostHog. Do this before deleting your account, while we can still match your email address to it.
Use BookWorm without an account — the core catalogue never requires one.
Manage or cancel your subscription — through your Apple account settings.

Depending on where you live, you may also have rights to correct your data, restrict or object to processing, or lodge a complaint with your local data protection authority. To exercise any right, use the in-app controls or contact us at support@bookwormapp.co.uk. We do not discriminate against you for exercising these rights.

8. Security

We protect your information with measures including encrypted connections (HTTPS), hashed passwords and session tokens, scrubbed logs, and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident.

9. Children

BookWorm is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

10. International data transfers

Our servers are hosted in the United Kingdom (London). Product analytics are forwarded to PostHog, Inc., a United States company; by default our server sends them to PostHog’s United States region. Where information is transferred outside the United Kingdom or the European Economic Area — for example, to a service provider in another region — we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses.

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and revise the “Last updated” date; material changes will be communicated as required by law.

12. Contact us

Questions about this Policy or your data? Email support@bookwormapp.co.uk or write to Rayand Software Limited (registered in England and Wales, company no. 11056834), 3rd Floor, 86–90 Paul Street, London EC2A 4NE, United Kingdom. If you are in the UK or EU and we cannot resolve your concern, you may also contact your local data protection authority.