Privacy
MyBooks is a small, invite-only app. This page describes exactly what it stores, who else sees it, and what leaves the app — how the app actually behaves, not what a policy template would say.
Last updated
What the app knows about you
Signing in happens through Google. The app never sees your Google password; what it receives back is your email address, the name on your Google account, and an account identifier. Those are stored, along with the date you joined, whether your account has been approved, and how many times an incorrect access code has been entered for it.
If you ask for access without a code, the app stores the moment you asked and, if you wrote one, the short note you typed (at most 280 characters). It also records whether you ticked the box saying you wouldn’t mind an occasional email — nothing is sent because of it. These are visible only to the person who runs the app.
Your company
Everything you add lives in your company, and everyone in it can see and change it. When you invite someone, the app stores their email address, a link token and a six-digit code until the invite is used, revoked or expires.
Each company has a timezone, set when it is created, so that “today” means its today. The app does not read your location or your browser’s timezone.
Reports and the security log
If you use “Report a problem”, the app stores what you wrote, the screen you were on (with any link codes removed), and who sent it. The person who runs the app reads these.
To notice someone trying to break in, the app keeps a log of security-relevant events — a wrong access code, an operator action, a removed member — with account identifiers and counts only. It never records a code, a token or a password.
Who else handles it
Google handles sign-in. On the sign-in page only, your browser loads Google’s sign-in script directly from Google; no page inside the app loads any third-party script.
Supabase hosts the database and the sign-in session. Vercel hosts the app itself.
Cookies and browser storage
The app sets the cookies that keep you signed in (from Supabase), and one more only if you choose light or dark on the public pages while signed out: mybooks_theme, which remembers that choice for a year. Nothing is set for tracking or advertising, so there is no cookie banner.
Your browser’s own storage holds two small notes on this device only: which new-version notice you dismissed (mybooks.version-tip.dismissed) and whether you dismissed the “add to home screen” card (mybooks.install-card.dismissed, plus a per-tab marker, mybooks.install-card.shown). They never leave your device.
Removing your data
Ask whoever invited you to the app, and your account and what is stored about you will be removed.