Privacy Policy

Book Tanuk, by Tellwright Multimedia LLC. Effective date: [OWNER: the effective date, for example the day these pages go live].

This policy explains what Book Tanuk keeps about you and your family, why, who can see it, where it is stored, how long it is kept and how to delete it.

1. Who we are

Book Tanuk is made by Tellwright Multimedia LLC, a small company in the United States. In this policy, "we" and "us" mean Tellwright Multimedia LLC.

This policy covers the Book Tanuk app for iPhone, iPad and Android, the web pages that show lists families share, and our website, tellwrightmedia.com, where Book Tanuk has its pages.

Our privacy officer is the owner of Tellwright Multimedia LLC. They are responsible for how we handle personal information, and they answer privacy questions, requests and complaints at support.booktanuk@tellwrightmedia.com. See Contact us.

2. What we keep and why

We keep information for one reason: to run Book Tanuk for you and your family. That means signing you in, keeping your library the same on every phone, sharing it with the people you choose, keeping the service safe, and answering you when you write. We don't use it for anything else.

Your account

• Your email address, and an account ID that our server makes for you.
• How you sign in: with Apple, with Google, or with an email address and password. Our server provider keeps a password only in a scrambled form (a hash) that can't be turned back into the password. We never see it.
• A name, if you type one when you sign up. If you sign in with Apple, Apple may share your name the first time, and we save it. If you sign in with Google, Google shares your name, email address and the web address of your Google profile picture, and our server provider keeps them.
• With Apple, you can choose to hide your email address. We then get a private address from Apple that forwards to you.
• Each time you sign in or the app renews your sign-in, our server provider records the time, your IP address (the number that identifies your internet connection) and your phone or browser details, to keep your account secure. It keeps them with your current sign-ins, and in its logs for up to 7 days.

Your family and the people in it

• Your family's name.
• For each member: their account ID, their role (owner, co-parent, caregiver or viewer) and the name the family sees. That name is the one the person typed when they signed up or joined, or else the name from Apple or Google. Without one, the person who set up the family shows as "Family member", and someone who joined shows as the part of their email address before the @.
• Members don't see each other's email addresses, except an address that an owner or co-parent typed into an invitation (see below).

Your children

• A nickname, and if you choose, a first name and a birth year (the year only, never the date). You must give at least a nickname or a first name.
• A color and the order you put your children in.
• We ask for nothing else about children: no photos of them, no full birth dates, schools, or contact details. See Children.

Your books

• For each book: title, subtitle, authors, ISBN, publisher, year, number of pages and cover; which children it is for, and whether it is a child's favorite; the ages or reading level it suits; your tags; where it lives (a room, a shelf or a bin); your notes; whether you own it or want it (the wishlist); and which member added it.
• When you import a spreadsheet or a Goodreads export, we don't keep the file. The books in it become books in your library. On Android, the phone keeps its own copy of the file inside the app until the phone clears it or the app is deleted.

Cover photos

• If you photograph a book's cover or pick a photo of one, the app turns it upright, makes it smaller and removes its hidden details (such as where and when it was taken, and the camera used) before saving it.
• With an account, the photo is uploaded to private storage that only your family's members can open. It is never public, and shared lists never show it.
• Only photos you choose for a cover are saved. The camera view used to scan barcodes is never saved or sent.

Wishlists and gift claims

• When someone claims a wishlist book ("I'll get this one"), we keep that the book is claimed, when, and the name they typed, if any (up to 100 characters, such as "Grandma"). A claim made in the app also records which member made it.
• Our records of a claim hold nothing else about the person, such as their IP address or browser.

Shared links and invitations

• For each view-only link: its title, what it shows (the whole library, one child's shelf, one tag or the wishlist), whether it names children by nickname or first name, whether it shows the books' tags, whether it shows the wishlist and takes gift claims, when it ends, whether it was turned off, and who made it.
• The secret part of a link is kept on our server only in a scrambled form. The phone that made the link keeps the link itself until it is turned off, so you can share it again.
• For each invitation: the family, the role offered, who made it, when it ends (after 7 days), whether it was used and by whom, and the invited person's email address if the person inviting typed one. Then only someone signed in with that address can join.
• The invitation code is kept on our server only in a scrambled form. The phone that made an invitation keeps its code until the invitation is revoked, so you can send it again. Our server never emails invitations: you send them yourself from your phone.

Information about other people

Some of what we keep is about people other than you. Examples are a co-parent's email address you type into an invitation, your children's details, and the name a relative types when they claim a gift. We use it only for the reasons above. Only the people in section 5 see it. The people it is about have the same rights over it as you have over your own (section 12).

Crash reports

When the app or a shared list page hits an error, it sends a crash report to Sentry, a service we use to find and fix problems. A report holds where in the code it went wrong, a cleaned error message, the app's version, and the phone or browser model and system version. Before a report leaves your phone or browser, the app removes names, book titles, notes, email addresses, family details, link addresses and invitation codes. Reports are not linked to your account.

If the phone's own system code crashes, Sentry's tools on the phone make the report, and the app can't clean it first. It holds where the crash happened, the system's own error message, the phone's model, system, language and time zone, when the phone was last turned on, and a random number Sentry makes when the app is installed, which is not linked to your account. Sentry's servers clean these reports too.

Sentry sees the IP address of the phone or browser that sends a report, but it is set not to store it. Reports are stored in the United States and deleted after at most 90 days. We don't use them for ads or tracking.

Visits to our website and shared lists

Our website, tellwrightmedia.com, sets no cookies, runs no analytics and shows no ads. Its only script, on the page for getting the app, checks which kind of phone you use so it can send you to the right store, and keeps nothing.

When you open our website or a shared list, your browser sends the usual details: your IP address, the browser and device type, and the page's address. Cloudflare, which hosts our pages, receives these and handles each visit. For a shared list, the page's address includes the link's secret part, and our server provider also receives your IP address and browser details when the page loads the list. We don't use these details to find out who you are or to follow you.

Messages to us

If you email us, we keep your message and email address in our company mailbox to answer you, and to keep a record of what you asked us to do.

Records that keep the service safe

• When someone types an invitation code that doesn't exist, we note their account ID and the time, so nobody can guess codes. Notes more than an hour old are deleted each time a new wrong code is noted, and all of an account's notes are deleted with the account.
• Gift claims are limited to 20 an hour on each link, counted from the claims themselves.
• When someone deletes their account, we keep their account ID and the dates of the deletion, so we can finish it and show that it was done.

3. What stays on your phone

• Book Tanuk keeps a copy of your family's library on your phone, so it works without a signal. That includes everything described above for your family, your cover photos, books waiting to be looked up and photos waiting to upload. Every member's phone keeps a copy, whatever their role.
• It also keeps book details it found on Open Library by ISBN, so the same book isn't looked up again.
• Without an account, your library lives only on your phone and is never sent to our server. Book lookups still go to Open Library (see Outside services). If you later create an account or sign in, the library and its photos are saved to that account.
• Your sign-in is kept in the phone's secure storage: the Keychain on iPhone and iPad, and encrypted storage on Android.
• Small settings, such as list or grid view and the sort order.
• When you delete a book, a child, a tag, a place, a gift claim or a link, it disappears from the app at once. The phone keeps a hidden record of it until the family leaves the phone, you sign out or you remove everything from the phone, so that every phone in the family learns of the deletion. When the phone removes records, it overwrites them.
• Signing out, or Remove everything from this device (in Settings, without an account), deletes your families, photos and the saved book details from that phone. Your display settings stay. One exception: if the phone still holds another account's changes that never reached our server, signing out keeps that account's library on the phone for it.
• Backups. On Android, Book Tanuk keeps itself out of Google's cloud backups and phone-to-phone transfers. On iPhone and iPad, your library and cover photos are part of the device's iCloud or computer backup, like other apps' files, including a library you keep without an account.
• When you export a spreadsheet or share a PDF, the app makes a temporary file and deletes it after you finish sharing. On Android, the phone's share menu keeps its own copy inside the app until you next share something, or the phone clears it. Where the file goes next is up to you.
• When you take or pick a photo, the phone's camera or photo picker may keep its own temporary copy inside the app, with the photo's original details, such as where it was taken. It is not sent anywhere, and it goes when the app is deleted or the phone clears it.

4. What the app asks to use

• Camera: to scan the barcode on a book and to take a photo of its cover.
• Photos (iPhone and iPad): to pick a picture of a book cover. The app opens your photos only when you choose a picture, and reads only that picture. On Android, the system's photo picker needs no permission.
• Internet (Android): to sync, and to know whether the phone is online.

Book Tanuk doesn't ask for your location, contacts, microphone, calendar, notifications or Bluetooth, and it doesn't ask to track you. It doesn't use your fingerprint or face.

5. Who can see your family's information

• Everyone in your family, in every role, sees the whole library: books, notes, where books are kept, tags, cover photos, children's nicknames, first names and birth years, members' names, and gift claims with the names people typed. That includes caregivers and viewers, such as a grandparent or a teacher. Their phones keep a copy, as yours does, and any of them can print the library or export it as a spreadsheet. Invite only people you trust with this.
• Owners and co-parents also see and manage the family's links and invitations, including any email address typed into an invitation.
• People you send a view-only link see only the list that link shows. See Shared links and gift claims.
• Someone with a valid invitation code who is signed in sees a few things before joining: the family's name, the role offered, who invited them, when the code ends, and whether it is meant for one email address.
• Us. We can reach the information on our server to run the service, fix problems, keep it safe and do what you ask. We don't browse families' libraries.
• Our service providers, as described in Outside services.
• When the law requires it. We give out information when the law requires it, for example under a valid court order, or when it is needed to protect someone's safety. Where the law allows, we tell the person first.
• A new owner. If Tellwright Multimedia LLC or Book Tanuk is ever sold or merged, we would tell you first. Your information would pass to the new owner only under the promises in this policy.

6. Shared links and gift claims

What a link shows

• The link's title (or "Our books", "Our wishlist", or a child's name with "books").
• The books on that list: titles, authors, covers from Open Library, the ages they suit, which child each book is for, and, on a wishlist, whether a book is taken.
• The books' tags, only if you turn on the link's Show tags switch.
• Children by nickname. A child with no nickname appears as the first letter of their first name, such as "M.". A link shows first names only if you chose first names for that link.

A link never shows notes, where books are kept, ISBNs, your family's name, the names of family members or of people who claimed gifts, children's birth years, or your own cover photos.

Show tags is off for every new link. You can turn it on or off at any time in the link's settings.

Who can open a link

Anyone who has a link can open it and send it on. Each link holds 22 random letters and numbers, so it can't practically be guessed. You can give a link an end date, and you can turn it off at any time in Settings, then Sharing. It stops working as soon as your phone is online. Links also stop when the person who made them leaves the family or can no longer share, when the family is deleted, and, for a child's shelf, when that child is deleted.

We ask search engines not to list shared lists. Only search engines that follow that request will leave them out, so don't post a link anywhere public.

Gift claims

When a relative claims a gift on a shared wishlist, the name they type is seen by everyone in your family in the app, including caregivers and viewers such as a teacher. Other people with the link see only that the book is taken. If the relative taps "Changed your mind?", or you mark the book "We have it now", or you remove the claim, the claim ends, but the name they typed stays in the family's records. A relative who wants their name removed can email us.

What a visitor's browser shares

• The page loads the list from our server provider, which receives the visitor's IP address and browser details.
• Covers load from Open Library's cover server (often by way of archive.org), which sees the IP address and browser, but not the link's address.
• For letters the page's own font lacks, such as emoji, Chinese or Arabic, the page may fetch them from Google's font server, which also sees the IP address and browser, but not the link's address.
• The page sets no cookies. To remember the gifts claimed in that browser, it saves the claims' IDs in the browser's storage, under a code made from the link (not the link itself). It removes them when it next opens after the claim has ended. Otherwise they stay until the browser's data is cleared.
• The invitation page (what an invitation link opens) shows the code and a button to open the app. It sends nothing to our server; the code in its address reaches Cloudflare.
• If the page hits an error, it sends a crash report to Sentry (section 7), with no names, book titles or link codes. Sentry sees the visitor's IP address and browser, and is set not to store the IP address.
• The page's Get the app and Privacy links open our website in a new tab, without passing on the link's address.

7. Outside services

Book Tanuk uses these services. Each one gets only what it needs.

• Supabase (Supabase, Inc.): our server, sign-in and private photo storage, in the United States. It receives everything Book Tanuk saves to an account (section 2) and the IP address of each phone or browser that connects. It keeps logs of requests and sign-ins for up to 7 days, and backups of the database for up to 7 days.
• Cloudflare (Cloudflare, Inc.): hosts our website and the shared list pages, from servers around the world. It receives each visitor's IP address, browser details and the address requested, which for a shared list or an invitation includes its code.
• Google Workspace (Google LLC): our company email. When you write to us, your message and email address are kept in our mailbox there.
• Open Library, run by the Internet Archive, a non-profit library in the United States: book details and covers. When you scan, type or import an ISBN, or search for a book, the app sends the ISBN or your search words, with your phone's IP address. This happens without an account too. Phones in your family may also look up books added without details, for example after an import. Each request names the Book Tanuk app and can give our support address, never yours. No account, family or child details are sent. Covers come from covers.openlibrary.org and archive.org, which see the IP address of the phone or browser showing them.
• Apple: if you choose Sign in with Apple, Apple confirms who you are and gives us your email address (or a private Apple address) and, the first time, your name if you share it.
• Google: if you choose Sign in with Google, Google gives our server provider your name, your email address and the web address of your Google profile picture.
• Google's ML Kit (Android only): Book Tanuk for Android reads barcodes with ML Kit, which runs on the phone. Camera pictures are not sent. Google says ML Kit sends Google diagnostic and usage information, such as the device model, system and app versions, an ID for that install, performance measures and error codes. See Google's ML Kit data disclosure. On iPhone and iPad, barcodes are read by Apple's own tools on the device.
• Google's font server: only on shared list pages, and only for letters the page's font lacks (see section 6).
• Sign-up and password emails: Supabase sends these for now. Before launch they will be sent through Resend (Resend, Inc., in the United States), which receives your email address and the message, and keeps a record of each email for 30 days.
• Sentry (Functional Software, Inc.): crash reports from the app and the shared list pages (section 2), stored in the United States. It receives each report and the IP address of the phone or browser that sends it, and is set not to store the IP address. Reports are deleted after at most 90 days.
• Apps you choose. When you share an invitation, a link, a PDF or a spreadsheet, it goes through your phone's share menu to the app you pick, such as Messages or Mail. What happens next is up to that app and the people you send it to. A spreadsheet holds your books with their notes and places; a PDF holds your family's name and can include your cover photos. Printing sends the PDF to the printer or print service you choose. Copying puts a link or code on your phone's clipboard.

Our agreements with Supabase, Cloudflare, Google Workspace, Resend and Sentry let them use information only to provide their service to us, and require them to keep it secure. Open Library, Apple and Google's sign-in and ML Kit are independent services with their own privacy policies. We send them only what is described here.

Coming later: a paid family plan, sold through the App Store and Google Play with RevenueCat managing purchases, and shopping links to Bookshop.org on wishlist books. Neither is in Book Tanuk yet. We will update this policy before either arrives.

8. No ads, no tracking, nothing sold

• There are no ads in Book Tanuk.
• We don't track you. We add no analytics tools of our own, no advertising IDs and no tracking pixels. The one exception we know of is on Android: Google's ML Kit, which reads barcodes, sends Google its own usage and diagnostic statistics (section 7). We don't combine what we know about you with other companies' data for advertising. We don't use data brokers (companies that buy and sell people's information).
• We never sell your information, and we don't share it for advertising.
• Our website and the shared list pages set no cookies. If we ever turn on one of Cloudflare's security features, Cloudflare may set a strictly necessary security cookie of its own, which only helps it tell people apart from automated attacks.
• Do Not Track. Some browsers send a "Do Not Track" signal. We don't track anyone across sites, so Book Tanuk works the same either way. No advertising company collects information about your activity over time or across other sites and apps through Book Tanuk or our website. On Android, Google receives the ML Kit statistics described in section 7.
• California. We don't sell or share personal information, as California's privacy law defines those words.

9. Where your information is kept

Our server provider keeps your information in the United States. If you live in Canada, Australia or New Zealand, your information is sent to and stored in the United States. Cloudflare delivers our pages from its network around the world, so a visit may pass through servers in or near your country. Google may keep the emails you send us in its data centers in the United States and other countries.

• Canada: information stored in the United States is subject to US law. US courts, law enforcement and national security authorities may be able to get it.
• Australia: we are likely to disclose your information to service providers overseas, mainly in the United States, and to Cloudflare's and Google's servers in other countries.
• New Zealand: our service providers hold your information in the United States for us, to provide their service to us.

10. How long we keep things, and deleting

While you use Book Tanuk

Your account, families, books, children and photos stay until you delete them or your account.

Deleting single things

When you delete a book, a child, a tag, a place, a gift claim or a link, it disappears at once from the app and from shared lists. But a hidden record of it, with its details, stays on our server and on the family's phones for as long as the family exists. This is how every phone in the family learns of the deletion. It is removed for good only when the whole family is removed.

Editing is different: when you change or clear a detail, such as a child's first name or a book's notes, the old value is replaced on our server and on the family's phones (apart from backups, below). So to remove a detail everywhere, clear it before you delete the item. If you need something gone for good sooner, email us.

Deleting a family

Today a family is deleted in two cases. The first is when the person who set it up deletes their account. The second is when someone joins another family and chooses to move their own books into it. Their old library is then deleted. The family and everything in it is deleted for everyone in it at once. It leaves each phone when that phone next connects, and its links and invitations stop working.

Deleting your account

In the app, go to Settings, then Delete account. You can also ask us by email. The Delete your account page explains what is deleted at once and what is kept.

What stays for a while

• Deleted families stay hidden on our server, where no one can open their books, children or photos. We are adding an automatic step that removes them for good 30 days after they are deleted. Until it runs, they stay hidden.
• Your sign-in record at Supabase (your email address, name, password hash, Apple or Google details and current sign-ins) can no longer change anything, or open any family's books, children or photos, once you delete your account. We are adding an automatic step that removes it. Until it runs, the record stays.
• Cover photos stay in our private photo storage after their book, family or account is deleted, and when a cover is replaced. No one can open the photos of a deleted family. We are adding a step that removes photos no book uses.
• Things you added to someone else's family (books, children, tags, photos and claims made in the app, with any name you typed) belong to that family and stay with it.
• Invitations work for 7 days. Their records, including any email address typed in, stay with the family until the family is removed. If the person whose email it is deletes their account, the address is removed.
• Backups of our database are kept for up to 7 days, then replaced. Cover photos are not in these backups.
• Logs of requests and sign-ins, with IP addresses, are kept by Supabase for up to 7 days. Cloudflare keeps its own records under its privacy policy.
• Crash reports are deleted after at most 90 days.
• Email records at Resend, once it sends our emails, are kept for 30 days.
• Your emails to us are kept as long as we need them to help you and to show that we did what you asked.
• A deleted account's record (its account ID and the dates, with no email or name) is kept, so we can show the deletion was done.
• Notes of wrong invitation codes are deleted once they are more than an hour old, the next time anyone types a wrong code.
• Copies on phones go when each phone next connects, signs out, or removes everything.

11. Children

• Book Tanuk is made for parents and other adults. It is not directed to children. Children don't have accounts and don't sign in.
• We never contact children, and if we learn a child made an account, we delete it.
• A parent (an owner or co-parent of the family) adds each child: a nickname, and only if they want, a first name and a birth year. We keep children's details to that minimum, and we don't ask for photos of them.
• Shared links show children by nickname unless the parent chooses first names for that link, and never show birth years.
• Printouts and spreadsheet exports name each child by nickname, or by first name when a child has no nickname.
• If you join another family and choose to add your books to it, your children's details (nickname, first name, birth year and color) are copied into that family, where its members can see them.
• Children's details go only to our server provider. We never send them to Open Library or any other outside service. They leave the app only when someone in the family shares, prints or exports a list.
• We do not knowingly collect personal information from children under 13, and accounts are only for adults (see our Terms of Use).
• If you are worried about a child's information, or you want a child's details removed from our server for good, email support.booktanuk@tellwrightmedia.com.

12. Your choices and rights

Wherever you live, you can ask us to:

• See what we hold about you. Your family's information is all in the app. For a copy of anything else, such as your account details, email us.
• Copy your library: in the app, go to Settings, then Export as a spreadsheet. It holds your books, children's nicknames, notes, tags and places, but not photos.
• Correct it: edit books, children and your family's name in the app. For anything else, such as the name your family sees or your email address, email us.
• Delete it: delete things in the app, delete your account, or ask us to remove something for good.
• Change your mind about what you share: turn off a link, clear a child's first name or birth year, revoke an invitation, remove a member, leave a family, sign out, or delete your account.

The same goes for people whose details someone else gave us, such as an invited co-parent or a relative who claimed a gift. Email support.booktanuk@tellwrightmedia.com, if you can from the email address on your account, so we know it is you. We may send a message to that address to confirm. We don't charge for any of this.

Complaints

If you are unhappy with how we handle your information, please tell us first. We answer privacy requests and complaints within 20 working days, and usually much sooner. We tell you what we found and what we did. If a request needs longer, we tell you within those 20 working days how much longer and why, and that you can complain to the privacy regulator about the delay.

You can also complain to the privacy regulator where you live:

• Canada: the Office of the Privacy Commissioner of Canada. In Quebec, also the Commission d'accès à l'information du Québec.
• Australia: the Office of the Australian Information Commissioner.
• New Zealand: the Office of the Privacy Commissioner.

13. How we protect your information

• The app and the shared pages talk to our server only over encrypted connections (HTTPS), and our website works over HTTPS only.
• Our server checks every request against your role in each family, so people see only the families they belong to, and only do what their role allows.
• Cover photos are in private storage that only your family's members can open.
• Passwords, link codes and invitation codes are kept on our server only in scrambled (hashed) form.
• Guessing is limited: 10 wrong invitation codes an hour for each account, and 20 gift claims an hour on each link.
• On your phone, your sign-in is in the phone's secure storage, and photos lose their location details before they are saved. Book Tanuk doesn't add its own encryption to the library on your phone; it relies on the phone's own protection, so keep a passcode on your phone.

No system is perfectly secure. If a breach puts you at risk of serious harm, we will tell you, and the privacy regulators, as the law requires.

14. Changes to this policy

If we change this policy in a way that matters, we will tell you before the change starts, by email or in the app. We also change the date at the top. We keep earlier versions; ask us for one.

15. Contact us

Tellwright Multimedia LLC
Privacy officer: the owner of Tellwright Multimedia LLC
Email: support.booktanuk@tellwrightmedia.com