Privacy Policy

The short version: tabbd keeps your reading life (books, rankings, diary, co-reading chats) so it works on any phone, and shows the friends you add the parts you allow. There are no ads. We don't sell your data, and we don't track you across other apps.

Who we are

tabbd is an iOS app and this website, made by a small independent team ("tabbd", "we"). We are the controller of the personal data described here. Questions: gettabbd@gmail.com.

What we collect

When you sign in

You sign in with Apple or Google; we never see a password. Apple gives us your email (or a private relay address) and, on the first sign-in only, your name. Google gives us your email, name and a link to your profile photo, which becomes your tabbd photo until you change it. We keep an account ID and sign-in sessions.

What you add

• Profile: @username, display name, photo, status line, profile look, privacy settings, reading goals, reading languages, time zone (so your days and streaks start at your midnight), and your onboarding answers about how much you read.
• Books: shelves (want to read, reading, read, dropped), progress, edition length, books you add by hand, and photos of your own copies used as covers.
• Reading: start and finish dates of each read, timer sessions and page logs, and a photo you add to a session.
• Rankings: the group ("Liked it", "It was ok", "Not for me"), each book's place, and a log of your duels.
• Diary and lists: quotes, notes and reviews (text, page, the question a note answers, whether you typed, dictated or scanned it, marker colour, sticker layout, who may see it), a photo you add to a note, the page photo a quote came from (cropped by you), and your lists.
• Reading together: the co-readings you start or join (the book, dates, who is invited), your chat messages, photos, stickers, polls and votes, reactions and pins, how far into the book you were when you wrote each message, and how much each chat may notify you.
• Cards: the card printed for each finished read, and your weekly player card, which our server works out from your reading.
• Friends: requests, friendships, blocks, emoji reactions, NICE PULL stamps, and "reading now" while a reading timer runs (cleared when it stops, after four hours at most).
• Invites: your personal invite code, and anonymous counts of how far your invites get (opened, installed, accepted).
• Notifications, if you allow them: your phone's push address from Apple (a token), the app version, and which kinds you want (co-reading chats, co-reading news, friends). Each notification waits on our server with its text, which includes the sender's name and up to 180 characters of their message.

From your device

• Crash reports (Firebase Crashlytics), from TestFlight and App Store builds only: device model, iOS and app version, what failed, and a random installation ID. We don't attach your account ID.
• Usage analytics (Google Analytics for Firebase): automatic events such as app opens, sessions and screens. They come with device model, iOS and app version, language, approximate country (from your IP address) and a random app-instance ID. We send no names, emails, books or quotes.
• Server logs: our host records requests (IP address, time, what was called) for security and debugging, and keeps them for a limited time.

On this website

• The waitlist: if you join it, we keep your email address, your browser's language (so the invite comes in your language) and the date. We use them to send your beta invite and, once, to tell you tabbd is on the App Store. Nothing else: no newsletter, no sharing. So the form can't be flooded, the site counts tries from each IP address for a minute; the address isn't saved.
• Invite links: when someone opens an invite link here and taps to get the app, the site stores, for 24 hours, the inviter's username and code with the visitor's IP address (for IPv6, only its network part), iOS version and language. The app uses this after installing to finish the invite, then it's gone.
• The site has no cookies, analytics or ads.

What stays on your phone

A copy of your library for offline use, erased when you sign out or delete your account. Page text, ISBN barcodes and friends' QR codes are read on the phone by Apple Vision; the camera feed is never uploaded, only the page photo you save with a quote. The player-card cut-out of your photo is also made on the phone. Widgets, the Live Activity, reading reminders and recaps run from data on the phone; reminders and recaps are local notifications, not push. Dictation turns your voice into text on the phone, with Apple's on-device speech recognition: the audio never leaves the phone and isn't kept. Share images are drawn on the phone and leave it only when you send them through the share sheet.

What we don't collect

No contacts, location, health data, recordings of your voice or advertising ID: the app never asks to track you. We don't use your content to train AI models.

Why we use it

For people in the EU, EEA and UK, each purpose rests on a legal basis:

Purpose	Data	Legal basis
Run your account and sync it across devices	Account, everything you add	Contract
Show friends what you choose to share	Profile, shelves, scores, activity, diary entries you open to friends	Contract
Read a book together with friends	Co-readings, messages, your progress in that book	Contract
Send the notifications you allowed	Push token, notification settings, notification texts	Consent (iOS asks first)
Finish an invite after the app is installed	Invite code, the visitor's IP address for 24 hours	Legitimate interests
Send your beta invite, and one note when tabbd is on the App Store	Waitlist email, language	Consent (you join the list)
Book search and covers	Search text, ISBN, reading languages	Contract
A book's community score	Your group and place for catalog books	Legitimate interests
Player card and cards	Reading, quote counts, genres, onboarding answers	Contract
Fix crashes	Crash reports	Legitimate interests
See which features get used	Analytics events	Legitimate interests
Keep tabbd safe, enforce the Terms	Logs, blocks, reports you send	Legitimate interests; legal obligation
Answer your messages	Your emails	Legitimate interests

Who can see what

tabbd has no public feed and no way to search for strangers.

• Anyone signed in who types your exact @username, or scans your QR code, sees your display name and photo and can send a friend request.
• Friends (people you both accepted) see, as your settings allow: shelves, ranking and scores, Top 4, lists not marked private, diary entries you open to friends (on the book's page), status line, what you're reading, your reading days (pages, minutes, time of day), the past week's reading events (started, finished, ranked), and your player card.
• People in a co-reading see its chat, polls and pins, everyone's progress in that book, and diary entries shared there while they stay open to friends. They are the people invited and those who joined; a co-reading open to all friends is also visible to every friend of the person who started it, and they can join. Photos in the chat sit in private storage that only members can open.
• Only you see diary entries you keep private (the default), page photos, note photos and session photos.
• Everyone who opens a book sees its community score: an anonymous average of all users' scores, with the number of ratings.

Your profile photo and cover photos sit at links that are hard to guess but not protected: anyone holding a link can open the image.

To control this, tap your photo, then the gear icon, then Privacy. Who sees your profile offers Everyone, Friends or Only me. Only me leaves friends your name and photo: your books, places, scores, reading days, updates and diary entries stop reaching them anywhere in the app. In a co-reading you joined, its members still see your messages, the entries you share there and how far you are in that book. There are no public web profiles yet, so Everyone works like Friends, except that it adds a QR code to the profile picture you share. Switches: Share my updates, Show what I'm reading, Show scores as numbers (off: friends see a place and a word, not the number), Show my stats, Show books I dropped (off by default), Show my quotes, Friends may share my cards. The visibility and the switches for books, scores, stats and updates are applied on our server, so what you hide never reaches a friend's phone.

Notifications show on your lock screen with the sender's name and the start of their message; a message sent as a spoiler arrives only as "… wrote something that might spoil the book". Turn kinds on or off in Settings → Notifications (photo → gear), and set each co-reading chat to Everything, Important or Off in its details.

Blocking someone ends the friendship. They can then no longer find you or send you requests.

Service providers

They process data on our behalf, only to run tabbd.

Provider	What for	Data
Supabase, Inc.	Database, sign-in, file storage, server functions	Your account and everything you add; the waitlist
Apple	Sign in with Apple, App Store, TestFlight, push notifications	Sign-in token, name, email; beta feedback; push token and notification text
Cloudflare, Inc.	This website, its invite links and the waitlist form	Visitor IP address; invite details for 24 hours
Google (Sign-In)	Sign in with Google	Sign-in token, name, email, photo link
Google (Firebase Crashlytics)	Crash reports	Crash data
Google (Analytics for Firebase)	Usage analytics	Usage events, device info, app-instance ID
Google Books API	Book search, genres	Search text or ISBN, sent by our server, not linked to you
Open Library (Internet Archive)	Book search, covers, genres	Search text, sent by our server
Apple iTunes Search	Missing covers	Title and author, sent by our server

Your phone loads covers directly from Google Books, Open Library and Apple, and Google profile photos from Google. Like any website, those servers see your IP address.

International transfers

Some providers process data outside your country, including in the United States. For EU, EEA and UK data, we rely on the EU–US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses.

How long we keep it

• Account and content: until you delete them or your account.
• Deleted items: hidden at once and removed from your other devices. During the beta they stay on the server, marked as deleted, until we clear them out.
• Friend activity: friends see the past week.
• Co-readings: as long as the co-reading exists, also after it ends, so its members can look back.
• Notifications: a notification's text up to 7 days; your push token until you sign out, Apple says it's no longer valid, or you delete your account.
• Invite-link matches on this website: 24 hours.
• Waitlist: until tabbd is on the App Store and we've sent that one note; then we delete the list. Sooner if you ask.
• Search cache: up to 2 days, not linked to you.
• Crash reports: 90 days. Analytics, server logs and backups: for a limited time, as our providers keep them. Support emails: as long as we need them to help you.

When you delete your account, it is deleted straight away, together with every shelf, ranking, session, diary entry, list, card, friendship, reaction and push token, and everything you wrote in co-reading chats (messages, photos, polls). A co-reading you run passes to the member who joined first and goes on for the others; one with nobody else in it is deleted. The next nightly recount takes your scores out of community averages. Photos you uploaded (profile, covers, pages, sessions, notes, chats) are removed from storage within two days. If you used Sign in with Apple, you can remove tabbd's access to your Apple ID in iOS Settings → your name → Sign-In & Security → Sign in with Apple.

Your rights

EU, EEA and UK: you can access, correct, delete or port your data, object to or restrict processing, and withdraw consent. We answer within one month. You may also complain to your data protection authority.

California and other US states: you can ask what we hold, and ask us to correct or delete it. We don't sell personal information or share it for cross-context behavioural advertising, and using your rights won't change how we treat you.

Delete your account in the app: tap your photo at the top of Home, Library or Friends. Then tap the gear icon (Settings), go to Account → Delete account, and confirm. Signing out is different: it keeps your account.

By email: write to gettabbd@gmail.com from the address linked to your account. We may ask you to confirm it's you.

Leave the waitlist: write to gettabbd@gmail.com from that address, and we'll remove it.

A copy of your data: there is no export button yet. Email us and we'll send you a machine-readable copy within 30 days.

Children

tabbd is not for children under 13. Where the law sets a higher age for agreeing to the use of personal data (up to 16 in parts of the EU), younger users need a parent's or guardian's consent. If we learn we hold a child's data, we delete it.

Security

Traffic is encrypted in transit, and our host encrypts data at rest. Database rules let each account read only its own rows. Friends' views are put together on the server, after it checks the friendship and your settings. Page, note, session and chat photos sit in private storage. If a breach affects you, we'll tell you and the authorities as the law requires.

Beta

tabbd is in beta and comes through Apple's TestFlight; we invite people from the waitlist a few at a time. Apple passes us the feedback, screenshots and crash logs you send through TestFlight. These come with device details and, depending on how you joined, your name or email address.

Changes

When we change this policy, we update the date at the top. If a change is significant, we'll tell you in the app first. Questions: gettabbd@gmail.com.