Privacy Policy

NoBookEnds — Last updated: 21 October 2026

NoBookEnds ("we", "our", or "us") is a peer-to-peer book sharing app. This policy explains what personal data we collect, why we collect it, who we share it with, and what happens to it when you delete your account. We've tried to write it plainly, including the parts that are less comfortable to say.

1. Who we are

NoBookEnds is operated by Icarus Apps Limited, a company registered in England and Wales (company number: 16149839). If you have any questions about this policy, or want to exercise any of the rights described below, contact us at hello@nobookends.app. We're a very small team, so a real person reads every email and replies personally.

2. Why we collect it

Most of this rests on it being necessary to provide the service you've signed up for — matching you with nearby books and readers, and letting exchanges happen. Keeping the app working (fixing bugs, understanding usage) rests on our legitimate interest in running a working product. Notifications rely on the permission you give your device. We don't currently offer a separate way to opt out of analytics or crash reporting while continuing to use the app — section 7 says more about what that means.

The newsletter is the one thing here that rests on nothing but your consent: the box you tick when you join, or the form on our website. Nothing else on this list depends on it, and you can take that consent back at any time, from any email we send or by writing to us, without it changing anything about your account.

3. What we collect when you join

We don't collect your phone number.

If someone invited you. If you join NoBookEnds through another reader's invite link, or tell us during onboarding who invited you, we record that connection — which reader invited you, and when. This is a record we keep ourselves, in our own database. No third-party service is involved in making that match — we don't use any outside link-tracking or device-fingerprinting company to connect you to whoever invited you. The reader who invited you can see, in their own account, the readers who've joined through their invite — the same public information described in section 4 (username, display name, and general area). If you weren't invited, or you skip the question, no such record is created. What happens to this record if either of you deletes your account is described in section 10.

Whether you'd like our newsletter. When you set up your account there's an unticked box asking if we may email you now and then about books, readers and what we're building. It's optional, and your account works exactly the same if you leave it alone. We record your answer either way, with the time, the wording you saw and the email address it was given for, so we can always show what you agreed to and to which address. Nothing is sent unless you ticked it, and section 14 says how to stop it.

4. Your profile

You give us a username, and you may add a display name, a short bio, a profile photo, the book you're currently reading, and genres you like.

You also tell us a general area — a town or postcode — which we turn into a set of coordinates using Google Places. Those coordinates are the centre point of that area, not your address, and we don't apply any further adjustment to them because they're already just an area centre.

These profile coordinates, your notification token, and any payment-related identifier aren't part of what other readers can see about you — our database restricts them to your own account. What other readers do see, when they look at your profile, is your username, display name, bio, profile photo, currently-reading book, genres, and the general area label you gave us as text — the town or postcode name itself, not the coordinates behind it. We call this your public profile.

Blocking someone is immediate and needs no review from us. The moment you block another reader they are gone from your app: search, the book feed, comments, followers and your inbox. From that moment our database refuses anything they try to send you, a follow, a request or a message, so nothing of theirs reaches you, even in the short gap before their own app catches up. On their side, you disappear the next time they open a profile or come back to the app. We don't announce it: there is no notification, and nothing on any screen tells a reader they have been blocked. If the two of you had a book in hand, arranging a hand-over or waiting for one, that exchange alone stays in both inboxes with the other person's details removed and marked "On hold", because cancelling it from that thread is the only way to release the book. Blocking doesn't delete anything and doesn't cancel an exchange by itself. It takes effect whether or not you also send a report.

5. Your books, and where they are

When you add a book, we store its title, author, description, genres, any note you write about it, and a location for that book.

Please read this part carefully — it's the part we hold with the most care.

That location usually starts from the area you typed when adding the book. If you've allowed the app to use your device's location, and what you typed matches where your phone thinks you are, we use your phone's GPS position instead as the starting point — accurate to roughly 100 metres. If neither of those is available, we fall back to the general area on your profile (section 4), or to a geocoded version of whatever location label we do have.

Location permission is requested through your phone's normal permission prompt. You can decline it, or turn it off later in your device settings — the app still works, it just relies on typed locations and your profile's general area instead of GPS.

Before that point is ever stored, we move it. A fixed, private offset of roughly 250 metres — generated once for your account and reused for every book you list — is applied to it, in a direction that isn't recoverable from the stored data alone by another reader, or by anyone without direct access to our database. So the location we store for any book isn't your real position; it's a point about 250 metres away from it. This is deliberate protection, not cosmetic rounding, and it applies whether the starting point came from your typed address or your device's GPS.

One trade-off is worth naming plainly rather than glossing over. Because this offset is generated once per account and reused for every book, rather than freshly generated for each one, it isn't independent from book to book. If your real location were ever learned some other way — at an in-person handover, say, or from a photo with identifiable surroundings — that same offset could in principle be worked out for every other book you have listed or will list, not just the one involved. We chose a per-account offset because it's what makes distance-based search work consistently; a fresh offset for every book would break that. We think this is still meaningfully better than showing your real position, but it isn't a guarantee that a location learned once stays hidden for your other books too.

Even so, a 250-metre offset is still a fairly precise point — closer to street-level than to a town or postcode area. We're precise about that distinction because proximity, showing you books that are genuinely close by, is central to how the app works, and it's more precise than the postcode-area point your profile uses (section 4).

Books on your library or looking-for shelf, including this displaced location, are visible to any signed-in reader on NoBookEnds. An account is required — this is not visible to anyone who hasn't signed in.

Your phone also keeps a copy of its last known location in the app's own local storage on the device, until you uninstall the app.

6. Messages, exchanges, and the Book Journey

Can we read your messages? Technically, yes: message content sits in our database in the same way as the rest of your account data, and anyone with direct database access (in practice, the founder, sometimes working through an AI assistant, as section 8 describes) could look at it. Nobody reads your messages routinely. There's no moderation team, no automated scanning, and no monitoring of conversations nobody has reported. In practice we'd only look at message content when a report makes that necessary, and section 12 sets out what happens when a report is made.

Is message content encrypted? Supabase, our database provider, encrypts all data at rest by default, including your messages, using AES-256, as a standard part of their infrastructure. That's Supabase's own published security practice, not a setting we chose or configured, and it applies to everything in our database, not just messages. It protects against someone getting hold of the physical storage or a backup. It doesn't change the answer above: because our own access goes through Supabase the same way any normal database query does, that encryption doesn't stop us, or anyone with direct database access, from reading message content in the ordinary course of using the database. We haven't added any encryption of our own on top of that: there's no additional scrambling of message text that only the two people in a conversation could undo.

Exchange records are kept indefinitely, on purpose. The messages in an exchange are kept too, until the reader who sent them deletes their account: then the text of their messages is removed (section 10). The Book Journey, the record of every reader a book has reached, is the point of NoBookEnds, and it wouldn't survive if we erased the exchanges behind it. The Book Journey is shown on a book's own page, and is visible to the same people who can see that book at all: any signed-in reader, the same as the rest of the book's listing (section 5). Once someone deletes their account, they appear in it as "A reader" rather than by name. What happens to this when you delete your account is described in section 10.

7. How we learn what's working

Product analytics, through PostHog (servers in the EU). We record a small number of named actions: joining, adding a book, sending a request, accepting one, completing a handoff, and passing a book on again. PostHog is also configured to record which screens you visit (the screen's name only — never which book or message) and when the app is installed, updated, opened, or put in the background, along with technical details about your device — its type and model, operating system, app version, language, and time zone.

Until 16 September 2026, PostHog also worked out an approximate location from your device's IP address each time you used the app: city and postcode level, plus a latitude and longitude for that area. We switched that off on 16 September 2026, so nothing recorded since carries it. Events recorded before then still do, linked to your account, and if you first used the app before then, so does your PostHog profile. They stay while your account is open, subject to PostHog's retention described below, and when you delete your account we ask PostHog to delete them (section 10). PostHog doesn't store your IP address. That's separate from the sign-in IP addresses we store ourselves (section 3). None of this is the location you enter yourself, described in sections 4 and 5.

We also use PostHog's AI features to help us find and fix problems in the app. When we do, some of this analytics data, including your account id, can go to the AI companies PostHog works with, including companies in the United States. PostHog's agreement with them doesn't let them use your data to train their AI, and how long they keep it is set by each company, not by us.

Crash and error reporting, through Sentry (servers in Germany). When something goes wrong we receive the error, your device and app details, and a trail of the recent network requests the app made — these can include your account's internal id, but not the content of your messages or what was on your screen. We also sample a portion of app performance data (around one event in five) to spot slow screens. Our app is configured not to attach your IP address to any of this; Sentry's own servers may still see the connecting IP as a normal part of receiving the request, the way any server does.

Both are linked to your account. When you're signed in, your account id is attached to your analytics and crash reports, so this isn't anonymous data — it's tied to you specifically, which is why we're telling you plainly. We stop sending new events the moment you sign out. We don't currently offer a separate way to opt out of analytics or crash reporting while continuing to use the app — using NoBookEnds means this data is collected in the ways described above.

Where we know the retention period, we'll say so rather than pointing you elsewhere. PostHog's plan currently sets analytics retention at around 12 months, though that's their setting rather than something we control, and it isn't strictly enforced as an automatic deletion — data older than that may move into a form of cold storage rather than being deleted outright. Sentry's retention period for crash and error reports is something we haven't verified yet; check Sentry's own policy, or contact us and we'll find out.

We don't track you across other companies' apps or websites, we don't run advertising, and we don't sell your data to anyone.

8. What leaves your phone, and who receives it

Our database, authentication, and file storage are run by Supabase, hosted in Stockholm, Sweden.

Emails the app sends go out through Resend. That covers the note we get when you report something or send us feedback, which carries what you wrote, and any email the app sends to you, which goes to the address on your account. Our sending domain is set up in Resend's European region.

Email you send us at hello@nobookends.app passes through ImprovMX, a United States company that forwards it to our inbox, which is a Google (Gmail) mailbox. ImprovMX receives the email in France and doesn't keep the message once it has delivered it. It keeps a record of each email it forwards, including the sender's address, our address, the subject line and the sending server's details, for up to 7 days, then deletes it. We keep the email in our inbox until we delete it.

We use AI assistants, including Claude, made by Anthropic, to help us build, run and support NoBookEnds. Most of that work is on our own code and documents, with no one's personal data in it. But when we fix a problem, look into a report or answer an email, an assistant can query our database, so it can reach anything we store about you there: your profile and account, your books, your exchanges, messages between you and other readers, and reports and feedback. It can also read emails you send us, and screenshots of the app taken on our own test accounts, which can show other readers' profiles and books, because our test accounts use the live app alongside everyone else. Anthropic is a United States company. We use Claude on Anthropic's standard consumer terms, so we don't have a data processing agreement with Anthropic, and how long Anthropic keeps what it receives is set by its own terms and privacy policy, not by us. We have turned off the setting that lets Anthropic use our Claude chats to train its AI models. Deleting your account doesn't remove anything an AI assistant already holds. You can object to this using your rights in section 11. If you do, we'll look at what we can change for you and tell you plainly what we can't. One thing we can't promise is that an assistant will never see your data while we fix a problem in our database.

Your data goes to the United States. We run NoBookEnds with the help of other companies, and many of them are based in the United States. Our database is in Sweden, but your data also goes to the United States and is stored there, through those companies and through the AI assistant that can reach our database (above). These companies do these jobs for us: running our database and website, including spam checks on its forms; sign-in; analytics; crash reporting; email; push notifications and app updates; recognising and looking up books, maps and places; payments; and AI assistants that help us build, run and support NoBookEnds. Our providers page names each company, the job it does, where it is, and whether we have a processing agreement with it. Where we do, the company handles your data for us on our instructions. Where we don't, its own terms apply, and Anthropic is one of those (above). We haven't yet checked which legal safeguard each company relies on for sending data outside the UK and EEA, and the page doesn't cover that. If you want to know, or the page doesn't answer your question, ask us.

9. How we share your data — a summary

Putting the sections above together, in one place:

We don't sell your personal data, and we don't run advertising.

10. How long we keep things, and what happens when you delete your account

The data described above is kept for as long as your account is open; we don't delete any of it on a schedule. The one deletion step that runs on its own starts after you delete your account: the requests to PostHog and Sentry described below.

Membership is separate. If you are a member, the record of that is described in section 14 and is kept for six years for tax reasons, whether or not you have an app account and whether or not you delete one.

You can delete your account from within the app. If you no longer have the app, nobookends.app/delete-account says how to ask by email. If you have an exchange in progress, you'll need to finish or cancel it first — deletion doesn't currently work around an open exchange. Once you confirm, deletion happens immediately — it isn't queued or delayed.

We know that requirement is a real problem if you need to leave quickly because you feel unsafe about an exchange — you shouldn't have to finish arranging a meetup with someone before you're able to delete your account. If that's your situation: you can block the other reader straight away, regardless of the exchange's status, and you can contact us directly at hello@nobookends.app for anything urgent — don't wait on the in-app flow. We think this gap in the deletion flow needs fixing, and we're not pretending otherwise by staying quiet about it here.

What's removed entirely: your login and password, your linked Apple or Google sign-in, the IP addresses and device details recorded with your sign-in sessions, your profile (including its coordinates and notification token), any book you listed that nobody has since received from you, your comments, hearts, follows, blocks, saved and wishlisted books, direct messages, notifications, and your profile photo — including the copy held in our file storage. If you joined through another reader's invite, the record connecting you to them (section 3) is removed at the same time.

What's kept, under "A reader" instead of your name: exchange records, notes you left on other readers' books, feedback you sent us, and gift records. In each of these, the text of the record stays, but your username and account id are replaced with a marker, and other readers see you referred to as "A reader" rather than by name. The wording of your exchange request and any reason you gave for a reported issue are part of the exchange record and are kept in this form. Where a book did change hands, your general area at the time, such as a town and postcode district, stays on that handover as a stop on the book's journey (section 6); the meeting place and time are removed. If you invited other readers to join, the record that they joined through your invite survives the same way — it still counts, but it's no longer linked to you.

Chat messages inside an exchange are different: the message text itself is removed, not just your name. When you delete your account, the content of any message you sent is replaced entirely — only the fact that a message existed remains, not what it said. (System messages generated by the app itself, like "handover confirmed," keep their content but lose your name.)

Books connected to a completed exchange: if a book you gave away, or a book you received and haven't since passed on, has a completed handover on record, the book's row stays rather than being deleted outright — it's part of that book's shared history with whoever else touched it, and of any comments or hearts other people added to it — but it's disconnected from your account entirely: no owner, no shelf location, and it can't be exchanged again from your side. A book you listed that was never received by anyone else is deleted outright, along with your comments, hearts, and other data on it.

Analytics and crash reports: what we can and can't remove. Your history at PostHog (analytics) and Sentry (crash and error reports) carries your account id. When your account is deleted, we ask both companies to delete it: once straight away, and again each night until each request has gone through. If a request keeps failing, our system emails us.

PostHog: we ask it to delete your analytics profile together with every event recorded under it. PostHog accepts the request and removes the events afterwards, in its own time. It doesn't confirm when they're gone, so what we can say is that the request was accepted, not that the deletion has finished.

Sentry: Sentry can't delete one person's data on its own. It groups crash and error reports by the error, so one report can hold several readers' crashes. Where Sentry's search finds a report that holds only your crashes, we delete it. A report shared with other readers we leave alone, because deleting it would delete their records too. Your account id stays in those, and in any report the search doesn't find, until Sentry's own retention removes it, a period we haven't verified yet (section 7).

AI assistants, and the AI companies PostHog's AI features use: deleting your account doesn't remove anything already sent to the AI assistants we use, such as Claude (section 8), or to the AI companies PostHog works with (section 7). We can't make them remove one person's data, and deleting your account doesn't send them a request. How long they keep it is set by each company, not by us.

We keep a record of each request: your former account id, and whether each company accepted it. We haven't yet set how long we keep that record.

The newsletter. Deleting your account takes your email address off the newsletter as well, because the record of your yes is part of your account and goes with it. You won't need to unsubscribe separately. Section 14 says how to stop the newsletter: every newsletter email carries an unsubscribe link, and using it, including any confirmation it asks you for, stops the emails for good. You can also write to the address in section 14 and we'll take you off the list by hand. Neither route needs an account, which matters here, because by then you won't have one, and section 14 says what we keep afterwards.

11. Your rights

If you're in the UK or the EU, you have rights over your personal information, including the right to access it, correct it, ask us to erase it, and object to how we use it. Deleting your account (section 10) is the most direct way to exercise the right to erase what we hold, though, as section 10 explains, it doesn't reach everything. PostHog accepts our request to remove your analytics events but doesn't tell us when it has. A crash report at Sentry that also holds other readers' crashes can't be deleted without deleting theirs. And deleting your account doesn't remove anything already sent to the AI assistants we use, or to the AI companies PostHog works with (section 10). If you have a question about any of this, contact us. Deleting your account also takes your email address off the newsletter (section 10).

If you're outside the UK or EU, these specific rights may not apply to you in the same legal form, but we'll still do what we can with any request about your data, regardless of where you're writing from.

You also have the right to complain to a data protection regulator. In the UK, that's the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, or if you have a question about this policy, contact us at hello@nobookends.app.

12. Age

NoBookEnds is for readers aged 13 and over. We don't currently verify age: this is a stated minimum, not something we check. If you're under 13, please don't create an account.

If you're 13 to 17, please read this part. It's about you specifically. NoBookEnds puts you in direct contact with people you don't know: they can message you freely, and exchanging a book usually means agreeing to meet in person. That's true for every reader on NoBookEnds, but it matters more if you're a teenager arranging to meet an adult you've only spoken to in an app.

We're going to be honest rather than reassuring: there's no safety team behind the report button. We're a very small company, and this is what happens when you report something. Every report you make saves a record in our database and sends an email to our inbox. Reports about someone's safety, or about a reader who says they are under 18 being approached in a romantic or sexual way, are handled first, ahead of everything else. Everything else is read within two days of arriving. Looking into a report can mean reading the messages it is about. When a report has been dealt with, what was decided is written down beside it, so there is a record of the decision and not only of the complaint. Where action is needed we can take content down or remove an account.

The limits, plainly. Nobody is on duty around the clock, so a report that arrives in the night is read in the morning. We don't scan messages, profiles or books, so we don't go looking: something reaches us because someone reported it. We can't yet tell you what was decided about a report you made. There's no appeal process yet if you think a decision about you was wrong. Blocking doesn't wait for any of this: it takes effect straight away for you, it needs nobody, and you can block someone whether or not you report them. If something is happening now and anyone is in danger, contact the police or your local emergency number first, and tell us afterwards.

If you're a parent or guardian with a concern about a young person's use of the app, email us directly at hello@nobookends.app. You don't need an account to do that, and it is read on the same clock: a concern about a young person's safety is treated the same as a safety report made inside the app. Because you've written by email, we can reply to you by email.

If we learn that an account belongs to someone under 13, we'll remove it. That follows the same account-deletion process described in section 10, including its current limits. Concretely: the account, profile, books and messages are removed, or kept under "A reader", as section 10 describes, and the same requests go to PostHog and Sentry, with the same limits (section 10, "Analytics and crash reports: what we can and can't remove").

13. Security

We use encrypted connections (HTTPS) throughout, and Supabase's authentication to protect your login. Our database applies access rules that restrict what each account can see from other accounts — for example, your profile's coordinates, notification token, and saved books aren't visible to other users under those rules. Content you choose to share, like the books on your public shelf, is visible to other signed-in readers, because that visibility is how the app works; sections 4 and 5 describe exactly what that includes. As with anything stored in our database, direct database access (in practice, the founder, sometimes working through an AI assistant, as section 8 describes) sits outside those per-account rules — section 6 says more about what that means for messages specifically.

If we ever have a personal data breach that's likely to put your rights or freedoms at risk, we'll tell you and the Information Commissioner's Office without undue delay, as UK data protection law requires.

14. Our website, nobookends.app

Everything above is about the app. What a visit to the website involves is described here, and only here. Who we are (section 1), your rights (section 11) and how to reach us (section 16) apply to the website too.

Our newsletter. If you type your email address into the form in our footer and press "Sign up", we add you to the NoBookEnds newsletter. It is an occasional email about books, readers, and what we're building. There is no set schedule and we aren't promising you one: we send it when there's something worth sending. Pressing that button is how you say yes to it, and sending you that newsletter is the only thing the form is for. Every email has an unsubscribe link at the bottom, and using it stops the newsletter for good. There's no account to log into, no password, nothing to pay and no reason to give: if the link asks you to confirm, that confirmation is the whole of it. You can also write to hello@nobookends.app at any time and we'll take you off the list by hand. Signing up doesn't create an account, doesn't give you anything in the app, and doesn't cost you anything.

Who's writing to you. The newsletter comes from NoBookEnds, which is a trading name of Icarus Apps Limited, the company in section 1. Every email says so at the bottom, with the company number and the address you can write to if you want it to stop.

Where your address is kept. The form is run by Netlify, the company that hosts our website. Your address is stored with Netlify along with the time you sent it and, if you arrived from one of our own social links, the short tag that says which one. That record is how we know when you said yes, which is why we keep it. Before we see a submission, Netlify runs it through Akismet, a spam-filtering service. A copy of each signup is also emailed to us, so your address sits in our inbox too. Netlify also keeps, with each submission, your IP address, your browser's description of itself (its user-agent string) and the address of the page the form was on, and those go when the submission does: if you ask us to erase your address, they are erased with it. The newsletter itself is sent by Resend, which holds your address so that it can send to it and so that it can act on your unsubscribe: the link at the bottom of every email is Resend's, and it is Resend that stops the sending. Netlify and Resend are both United States companies, so what section 8 says about companies outside the UK and EEA applies to both.

How long we keep it. While you're subscribed we keep your address for as long as you want the newsletter. There's no automatic clock on it. When you unsubscribe we stop sending, and your address stays on a do-not-contact list, because keeping it there is the only reliable way to be sure we never write to you again. That list holds your address and nothing else, it's used for one thing only, which is not writing to you, and it lasts as long as we send a newsletter at all. If you'd rather we erased your address completely instead, say so and we'll do that, including the copies held by Netlify and the one in our inbox. The honest trade there is that we'd then have no record telling us not to write to you, if your address ever reached us again some other way. And if we ever stop sending the newsletter, we delete the list, and the do-not-contact list with it, within 30 days.

What we don't do with it. We don't send you anything else. We don't put tracking pixels in the newsletter, so we don't record whether you opened it, when, or what you clicked. We don't sell the list, we don't share it, and your email address never goes to PostHog.

Counting visits. We use PostHog, the same EU-hosted analytics service described in section 7, to count visits to the website. For each page you view it records the page address, including a short tag on links from our own social posts that tells us which post you came from; the page your browser says referred you; and your browser, operating system, device type, screen size, language and time zone. If you send the email form, PostHog also records that a sign-up happened and which tag it carried. Your email address never goes to PostHog. Unlike in the app, PostHog is told not to work out a location from your connection when you visit the website. PostHog keeps this on the same terms as section 7, currently around 12 months, and we use it for one thing: to see which pages and channels are working.

We don't identify you. The website has no login, nothing ties a visit to an app account even if you have one, and we store nothing in your browser to recognise you next time, so each visit counts as a new one. That also means we can't single your visit out to delete it; nothing records which visit was yours.

If you'd rather not be counted. Use the "Don't count my visits" switch on this page. It turns counting off for this browser and stores one thing on your device: the fact that you switched it off, so the site remembers your choice. Nothing else is stored, and you can turn it back on from the same place.

Don't count my visits

If you become a member. Membership is bought on this website and is nothing to do with your app account, if you have one. When you become a member we keep: the email address you gave at the checkout, the name you gave if you gave one, the amount you chose, whether it is monthly or yearly, the identifiers Stripe gives us for you and for your membership, the dates payments were taken, and whether each one succeeded. We also keep the emails we send you about it.

We never see your card. Your card number, expiry and security code go straight to Stripe, who take the payment. They do not pass those details to us and we could not retrieve them if we wanted to. Stripe is our payment processor for this, which means they handle your payment information on our instructions for the purposes described here; they also use some of it for their own purposes, such as preventing fraud and meeting the legal obligations that apply to payment companies, and for those purposes they decide what happens to it rather than us. Stripe's own privacy policy covers that part. Our contract for UK businesses is with Stripe Payments Europe, Limited, in Dublin, and Stripe may pass information to Stripe, LLC in the United States and to its own suppliers elsewhere, under the transfer safeguards in its data processing agreement, so what section 8 says about companies outside the UK and EEA applies to Stripe too.

Where the member record sits, and what it is not attached to. We keep it in the same database as the rest of NoBookEnds, run by Supabase in Stockholm (section 9), but it is a separate record keyed on the email address you paid with. You do not need a NoBookEnds account to be a member, and most of what this policy describes will not apply to you if you never install the app. If you do have an account and used the same email address, we may connect the two so that we know who you are when you write to us. That connection is the only link between the two, and if you are a member without an account there is nothing to connect.

How long we keep it. We keep your membership record while your membership is active, and for six years after your last payment, because payment records are part of the company's accounting records and HMRC requires a limited company to keep those for six years from the end of the financial year they relate to. That is a legal obligation, so deleting your NoBookEnds app account does not delete your membership record, and we cannot delete it on request during that period; we are saying so plainly rather than implying an erasure we could not perform. What we can do at any time is cancel your membership so no further payment is taken, and stop emailing you about it. After six years the record is deleted.

What we do not do with it. We do not use your membership to change anything in the app, because membership does not unlock anything. We do not add you to a newsletter. We do not tell other readers you are a member. We do not sell or share the record with anyone other than Stripe and, where the law requires it, the people section 9 already describes.

15. Changes to this policy

If we make significant changes to this policy, we'll email you at the address on your account to tell you. The "last updated" date at the top of this page always reflects the current version. We'll keep a dated record of earlier versions — contact us if you'd like to see one.

If NoBookEnds is ever acquired, merged with another company, or shut down, your data would either transfer to whoever continues running the service, under a policy at least as protective as this one, or be deleted. We'd tell you which, and before it happened, not after.

16. Contact

Questions or requests: hello@nobookends.app