Privacy Policy

Last updated: 3 September 2026

OhMyReads is a book tracking and reading community site. This policy describes what we actually collect, which services process it, and the controls you have. It is written from how the site works today and is updated whenever that changes.

1. Information We Collect

Account

• Credentials: Email address and a password, or the email and name from your Google account if you sign in with Google. Passwords are stored hashed by our authentication provider; we never see them.
• Profile: Username, display name, avatar URL, bio, website and social links, favourite genres and reading preferences (your taste profile).

Reading activity

• Books on your shelves, their status (want to read, reading, read), start and finish dates, page progress, ratings, custom shelves and reading lists, reading challenges and goals, and computed statistics such as pages read and streaks.
• Reviews, comments, likes, check-ins, book and place submissions, and any photos you upload for a literary place.
• Social graph: who you follow, friend requests, club memberships, and direct messages you exchange with other readers. Messages are stored so both participants can read them; they are not end-to-end encrypted.

Location and presence (optional)

Location features are off by default. If you switch them on in Settings, we store:

• A coarsened location: your position is converted to a geohash at the precision you choose (city area, about 20 km; district, about 2.4 km; or neighbourhood, about 1.2 km). The exact coordinates from your browser are not stored. A text label for the place (for example a town name) is stored alongside it.
• A presence check-in, if you make one: the type (temporary or recommended), an optional short note, an expiry time, and the geohash of the place you checked in at, at the precision of that place.

Other readers only ever see the coarsened location. Turning location sharing off deletes the stored geohash and label. See section 6 for who can see this.

Collected automatically

• Request data: IP address, user agent, pages requested, and timestamps, in hosting logs and error reports.
• Rate-limit counters keyed by IP address or user ID, kept briefly in memory or in a Redis store to stop abuse.
• Audit records of security-relevant actions on your account (password change, account deletion, moderation decisions) with the acting user ID, the action, and the time. We do not record IP addresses in this log.

2. How We Use Your Information

• To run your account, shelves, statistics and challenges.
• To display your public profile, reviews and activity to other readers and, for public content, to search engines.
• To generate recommendations and other AI features (section 4).
• To show you on the reader map and in nearby-reader discovery, only when you have opted in (section 6).
• To send a welcome email and an optional weekly digest (section 5).
• To moderate reported content and keep the service secure.
• To find and fix errors. We do not run product analytics or advertising trackers.

3. Services That Process Your Data

We do not sell personal data. The following providers process it on our behalf. "Always" means the service is part of running the site; the rest are only contacted when you use the related feature.

We may also disclose information to comply with the law, to respond to a lawful request, or to protect the rights and safety of OhMyReads, its users or the public.

4. AI Features

Some features send text to a large language model provider (Google Gemini by default; OpenAI or Anthropic if the site is configured to use them). What is sent depends on the feature:

• Book search assistant: the messages you type in the chat.
• Curated picks: your taste profile (preferred genres, vibes, pace and length) and the titles, authors and ratings of your recent books, together with the candidate book being described. Your name and username are not included.
• Trending insights: short excerpts of public reviews for trending books, without reviewer names.
• Place search assistant: the messages you type and the coordinates you supply for the search.

Prompts are sent per request and we do not store them; the provider handles them under its own API terms. AI output is not stored against your profile except where it is shown on the page.

5. Email

We send one welcome email when you sign up and, if enabled, a weekly reading digest. The digest can be switched off in Settings, and every digest carries a one-click unsubscribe link that works without signing in. We do not send marketing email.

6. What Other People Can See

• Public: your username, display name, avatar, bio, website and social links, join date, follower counts, public reviews, comments, reading lists and reading activity. Signed-out visitors and search engines can read these.
• Only you: your email address, location settings and precision, presence check-in details, email preferences, and the full contents of your direct messages (shared with the other participant only). Database rules enforce this, not just the user interface.
• Discovery: the "visible in discovery" switch in Settings controls whether you appear on discovery pages, in nearby-reader results and in recommendations. Your coarsened location is shown on the reader map only while you have location sharing on, discovery on, and an active check-in.
• Administrators can see reported content, moderation queues and your profile fields to handle reports and abuse.

7. Cookies and Local Storage

We use cookies only to keep you signed in (session tokens set by our authentication provider). Your light or dark theme choice is kept in your browser local storage. There are no advertising or analytics cookies.

8. Retention and Deletion

• Your data is kept for as long as your account exists.
• You can delete your account at any time from Settings. Deletion removes your account, profile, shelves, reviews, comments, lists, messages, check-ins, uploaded place photos and email preferences. It is immediate and cannot be undone.
• A few records are kept without your identity after deletion: reports you filed and moderation decisions you made stay with the reporter or moderator reference cleared, and security audit entries remain so we can investigate abuse.
• Hosting logs and error reports are kept by Vercel and Sentry for the limited periods set by those providers, then discarded.
• Turning location sharing off deletes your stored location immediately, independent of account deletion.

9. Your Rights

Depending on where you live you may have the right to access, correct, export, delete or object to the processing of your personal data. Most of these are self-service:

• Access and correct: edit your profile and settings.
• Export: download your library, reviews, taste profile and challenges as a file from Settings.
• Delete: use the account deletion control in Settings.
• Object or ask questions: email us (section 12).

10. Data Security

Data is encrypted in transit, access to it is restricted by row-level rules in the database, and we log security-relevant actions. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. If we learn of a breach that affects you, we will tell you.

11. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will delete it.

12. Contact

Questions about this policy or your data: privacy@ohmyreads.com.

13. Changes to This Policy

When our data practices change we update this page and the "Last updated" date. Material changes are also announced on the site.