BookWormsPrivacy policy
BookWorms is a personal reading app. Your library starts on your iPhone. This page explains syncing, taste matching, social features and optional reading analytics separately.
Without an account
Books, shelves, rankings, notes, feelings, reading sessions, progress, DNF details, formats, finished dates and cover images are stored on your iPhone. Deleting the app deletes them. Your normal device backup may include them. Nothing is uploaded to us, except a photo you choose to have drawn as your picture, which goes to our drawing service as described under Photos you add; if you create an account later, the books on your iPhone are uploaded to it straight away if you choose to bring them in.
Searching sends only the words or ISBN you enter to our own book service, which looks the book up at ISBNdb (isbndb.com) and returns the title, author, cover and description. ISBNdb is not told who asked. Books saved before September 2026 may still load their cover image from Open Library (openlibrary.org). Barcode reading and cover cropping happen on your iPhone; camera images are never sent to either service or to us.
With an account
Creating an account is optional. You can sign in with Sign in with Apple, with Google, or with a one-time code sent to your email address. Whichever you choose, we ask for your name and email address and nothing else — never your contacts, your calendar, your files or anything else in that account. Google tells us your email address, your name and your profile picture so the account can be made; we do not read your Google data and we do not sell or pass on anything Google tells us. Your email address is held by our authentication service so you can sign in; it is never shown to other readers and is not part of friend search. Email sign-in uses a short bot check (Cloudflare Turnstile) and sends the code through our email provider.
Your account holds a display name, a username and a profile picture or chosen character. These appear to readers who search by your name or username and to your accepted reading companions.
When you sign up with Apple or Google, they may tell us your first name and surname. We use them to suggest how friends see you, which is your first name and the first letter of your surname (for example “Jimmy R.”), and we keep your full name privately with your account for account recovery and support. Other readers see your full name only if you turn on Show my full name in Edit my room, and you can turn it off again. Your full name is deleted with your account.
When you set up BookWorms we ask what you want from it (for example ranking your reads or reading with friends), in the order you tap. With an account, your library syncs to your account, you can use friends and book clubs, and that answer and a record of your first steps (which setup pages you saw, skipped or finished, and when, and whether you were shown Reader Plus and what you chose) are kept with your account, so we can shape the app around you and see where new readers get stuck. This is separate from analytics and is kept whichever analytics setting you choose. It is never shown to other readers or sold. Without an account it stays on your iPhone.
If you delete your account, a copy of that record is kept without your name, your account or any way to link it back to you, with its dates rounded to the week, so we can still learn how setup works for people.
Your library in your account
With an account, your books, notes, feelings, reading history, progress, DNF reasons and private DNF notes, formats, dates and covers are stored in a private cloud copy tied to your account. We use it to sync and restore your library and, unless you turn it off, for taste matching. Syncing comes with an account. To stop it, sign out on that device or delete your account. Authorized service administrators can operate the service; this is not end-to-end encrypted storage. Signing out stops this device syncing; your account’s private cloud copy remains until you delete the books or account. Your personal reading stats are calculated from your local diary and never require analytics consent.
Taste matching
Taste matching is on unless you turn it off in Settings › Your data. It uses your shelves, rankings and ranking changes, scores, standard feelings, DNF percentages and reasons, formats, pace, genres, dates and how you found each book to suggest books, show how well a book fits you, find readers with similar taste and show each book's feelings and average score. A book's totals appear only when five or more readers count towards them, and never with names. It never uses your notes, private DNF notes, highlights, or feelings in your own words. Books you keep to yourself count only in each book's totals, without your name, and never show to friends or anyone else. Turning it off removes your signals and profile and takes you out of every book's totals; we keep your ranking history as part of your library. We do not sell this data, use it for advertising or share it with outside partners.
Your month in books
If you allow it, once a month a summary of your shelf is sent to Anthropic, whose AI model Claude writes your month in books. What's sent: Titles, authors, genres, scores, dates, why you set books down, and counts worked out from your shelf. It never includes your notes, chats or anyone else's books. You can turn it off in Settings › Your data.
Photos you add
If a book has no cover, or you would rather use your own, you can photograph it. The photo is cropped on your iPhone and, if you have an account, kept in a private folder in our cloud storage that only your account can open. Cover photos are not part of a shared shelf, so friends see the standard cover instead. They are deleted when you replace them, when you delete the book, or when you delete your account.
You can have your profile picture drawn from a photo. When you frame the photo, your iPhone finds the face to place it (Apple's on-device Vision); that never leaves your phone. The photo you frame is sent once to OpenAI’s image service, which draws the pen-and-watercolour picture and sends it back; BookWorms does not keep the photo, only the drawing you choose to keep. OpenAI does not use it to train its models and may hold the request for up to 30 days to guard against misuse, under its API data policy. The drawing is then your profile picture like any other, and you can change or remove it.
A Chapter Lead can give a club a picture. That one is visible to everyone in the club, and to anyone who sees the club’s public listing if the club has one. It goes when the club does.
Saying a title
When you add an audiobook you can say its title instead of typing it. The microphone is used only while you hold that moment open, and the words are turned into text by Apple’s speech recognition, on your iPhone where your language allows it. BookWorms receives only the text that lands in the search field, the same as if you had typed it, and never records or keeps your voice.
Sharing with friends and clubs
Shelf sharing is off until you turn it on. Accepted friends can then see your book titles, reading status and rankings, and your scores contribute to friends' averages. Friends see your feelings for a book only if you share them in What stayed with me. With taste matching on, your standard feelings and score also count, without your name, in that book's totals once five or more readers have them. You can turn that choice off; changes take effect after syncing. Notes, imported reviews and uploaded cover photos are excluded from shared shelves. Synced shared-shelf changes can appear in accepted friends’ feeds; cached screens refresh when the app reconnects.
Book clubs are private by default and joining is optional. Suggestions, votes and comments are shared with club members. Your personal notes are never copied into a club. If you explicitly link a personal book to a club, members can see its reading status and progress percentage until you unlink it. DNF percentage and reasons, notes and your score are excluded from the link. You can also mark a club book finished without linking a personal entry. Completion counts include only participating members, once per person. Club invitation links last seven days; people outside your circle still need friendship approval. Leaving a club removes your votes and comments; deleting a club removes its shared list and discussion.
Links you share can carry a preview. When you send a friend invitation or your reader link, the receiving app may show your first name and the profile picture or character you already show to friends; a club invitation shows the club's name, how many read in it and the Chapter Lead's first name. Only what the link itself points to is shown, only while the link is live, and never your username or email. You can turn this off in Profile → Privacy ("Show my name and photo on links I share"); the link then previews as plain BookWorms.
Clubs with a public listing have a chat. You join it yourself — it stays closed until you accept — and what you write there is visible to the other people in that club and to nobody else. Messages are kept so the conversation is still there tomorrow; you can delete your own at any time, and they all go when the club goes or when you delete your account. Chat is not scanned for advertising and is not part of reading analytics.
You can react to things with an emoji: to a message in club chat, to a book the club is reading, and to a friend’s reading moment in your feed. A reaction carries your first name and picture to the people already allowed to see the thing you reacted to — the club, or that friend and the friends you share. Readers you have blocked never see yours and you never see theirs.
Comments you leave on a club’s book are visible to that club’s members. They are removed if you leave the club, and when the book or the club is removed.
You can paste a link from Audible, Apple Books, Libby or Spotify to add the audiobook it points to. The link goes to our book lookup once: we read that page’s public title, author, narrator and length, match it to a book, and do not keep the link. No cookies, no sign-in and nothing from your listening library are involved — only the link you share.
You can block readers and report content. Reports are reviewed by us and are not visible to other readers.
Nearby clubs and optional local news
A host can make a club discoverable within ten miles of a chosen town or city, sharing its name, area, description, genres and member count. We store the area's name and a grid cell about 5 km across, never an exact point. Only approved members can see its reading list and discussion. Join requests share your name and username with the host; approval does not automatically create a friendship. Hosts can remove the public listing, which clears pending join requests.
You can choose a town manually or optionally allow location access while using the app. Apple identifies your town; BookWorms sends only your neighbourhood's name and its grid cell; we never receive your position. To stop the search being misused we keep a scrambled code of the places you searched from for one day. We do not collect a location trail or use background location tracking. Search coordinates are not saved to your profile or a search-history table. Apple and our service providers process requests to deliver this feature.
“Keep me updated about new clubs that open up near me” is a separate, default-off choice for new-club emails in your chosen area. This choice covers new clubs only. Older app versions offer a broader “Keep me posted about BookWorms near me” choice for local news and events; we record which wording you accepted. If enabled, we save your chosen town or region and consent date/version linked to your account, so we can email the updates covered by your chosen consent. It is not required for club discovery. Turn it off in the nearby-club card or Account → New clubs near me (Local BookWorms news in older versions) to remove the preference, or ask us through support. Any future local-news email will include an unsubscribe option. We do not sell this information or share it with advertising networks. It is retained until you withdraw this choice or delete your account, and included in Download my data.
The Android list
BookWorms is on iPhone for now. If you open a friend’s letter on another phone you can leave an email address or a phone number so we can tell you when BookWorms is on Android. We keep that contact, the letter it came from, a short code for your own share link and, if you came through someone’s share link, whose it was — so early access can go first to people whose friends joined. We send one message when it’s ready (email, or a text once we can send them), then delete your details. We never show a list size or a position, and we don’t use the contact for anything else.
Optional notifications
Notifications are off until you enable them in Account → Notifications and allow them on your iPhone. We store an app installation identifier and Apple push token linked to your account to deliver generic alerts through Apple for the notification categories you enable. Friend requests, direct club invitations and reactions to your feed posts have separate choices in supported app versions; club and reaction alerts start off. We save these choices with your device registration. Alerts contain no book titles or private thoughts. Turning all notifications off removes the device registration. Signing out stops notifications on this device and attempts to remove its server registration; if offline, the server record may remain until it expires or the device registers again. Turning a category off cancels its queued alerts; a notification already sent to Apple may still arrive. Inactive registrations expire after 90 days; delivery jobs expire within seven days, and unsent requests stop retrying after 24 hours. Delivery is best effort. These identifiers are not used for advertising or reading analytics.
Support reports you choose to send
Error messages include a support code and a unique report reference. If you choose Send report while signed in, we store that reference, the error code, app version/build, iOS version and time, linked to your account, to troubleshoot the problem. Reports do not include your search text, book details, notes, photos, usernames, raw server responses or access tokens. They are separate from optional reading analytics, are included in Download my data and are removed with your account. Reports expire after 30 days and are cleared by the daily cleanup. If sending fails or you are signed out, you can copy the technical details and share them with support yourself.
App usage analytics
BookWorms records which screens you open, how long you spend on them, and actions such as adding a book or joining a club, so we can see what helps readers and what doesn’t. It is on by default; in the EU, the EEA and Switzerland it is off until you turn it on. You can turn it off at any time in Settings › Your data › App usage. It is sent to PostHog (EU Cloud) and kept for 12 months. It never includes your notes, messages, posts, photos, contacts, names, usernames, email address or the books you read, and it is not used for advertising or tracking across apps.
Optional reading analytics
“Help improve BookWorms” is a separate, default-off choice. After a completed reading or DNF flow, we may offer it once; you can also change it in your profile. Your existing basic-count preference does not grant this expanded permission. Personal reading stats work with the choice on or off.
If you opt in, our Supabase service receives book/work and edition identifiers, status changes and progress, completion-score snapshots, selected standard feeling tags and pace, optional DNF percentages and selected reasons, a source category such as a book club, club-link and finish actions using a pseudonymous club key, event times and your App Store storefront region. Region describes your storefront, not your physical location. Records are linked to your internal account ID for deletion and corrections; they are not anonymous.
We use this activity to understand product use and seasonal reading patterns. We do not include your name, email, private notes, free-text responses, custom feelings, photos, contacts, device identifiers or raw friend/club IDs in this analytics payload. We do not sell it, share it for advertising, or send aggregates to outside partners. No advertising or attribution SDK is used.
Raw reading analytics is retained for at most 12 months. Opting out deletes your individual analytics and prevents old queued uploads from returning. Book and history deletions are reflected after reconnecting. Minimal deletion references prevent retries from restoring removed records and expire within 12 months. Older basic-count events expire after 90 days. We do not keep aggregates of reading analytics beyond the raw-data period. Taste matching's per-book totals are separate: they come from synced libraries and are shown only at five or more readers.
Challenges and badges
Joining a reading challenge is your choice. If you are signed in we record which challenge you joined, the year, when you joined or left, how far along you are and any badge you earned, so your folio is still yours on a new phone. Challenge progress is counted from your own diary; the books themselves are not copied anywhere new and joining a challenge does not share your library with anyone. Your folio and badges are shown only to you unless you choose to show someone. Leaving a challenge clears its entry, and everything goes with your account.
Your controls
- Export your local or cloud library, or use Download my data to export a copy of your account: your contact details and profile, your library, reading diary, reading story, goals and challenge entries, your privacy and email choices, your reading analytics, your friendships, invitations, blocks and the reports you sent, your club memberships and what you did in your clubs (chat messages and their reactions, comments, votes, polls and poll comments, books you suggested, finish marks and reading places), your reactions in the feed, and the notifications we sent you and the devices they go to. Download my data doesn’t yet include your lines and replies in the feed, recommendations you sent or received, your replies to club meetups, club topics and photos, reactions on lines, or the ideas, problems and notes you sent us; ask us through support for a copy of any of these.
- Change shelf sharing and optional reading analytics in your profile, or unlink a book from a club. Library syncing comes with an account; sign out or delete your account to stop it. Turn taste matching off in Settings › Your data.
- Delete your account in Account settings. This removes your account’s active cloud diary, social records and individual analytics, your taste-matching signals, ranking history and taste profile, and your part in every book’s totals, and clears this account’s local diary and recovery copies on that device. Other devices remove their own copies when you delete them or the app; they can no longer sync to a deleted account. Provider backups follow their retention schedule.
Requesting access
If you ask for a place through thegoodbookco.com, we keep your email address, first name and the answers you give until invitations have gone out, or sooner if you ask us to remove them. They are stored in our Supabase database and used only to send your invitation and a short confirmation email.
Services we use
ISBNdb for book lookups; Open Library for cover images on books saved before September 2026; Supabase for accounts and cloud storage; Google for Sign in with Google; Resend for sign-in emails; Cloudflare Turnstile for bot protection; PostHog (EU Cloud) for app usage analytics; Apple for Sign in with Apple, area lookup, push notifications and TestFlight. Each processes only what is needed for its part of the service.
Contact
Questions about this policy or your data: use the contact form. Messages sent through it are checked by Cloudflare Turnstile and delivered to us by email through Resend; we keep them only as long as needed to reply.