bestbooks
Deutsch Get the app

Privacy Policy

Last updated: 13 October 2026

1. Controller

The controller within the meaning of Art. 4(7) GDPR is the provider named in the Imprint, where you find the contact details for all privacy matters. A data protection officer has not been appointed; the statutory conditions requiring one are not met.

2. Scope

This notice applies to the BestBooks iOS app and to this website. It does not apply to third-party services reached from either.

3. What stays on your iPhone

Without an account, the app stores your library, reading statuses, ratings, reviews, notes, reading times, goals, streaks and reminders only on your iPhone. Notes, individual reading sessions and books you mark as private always stay on the device, also with an account. What you share with friends is described in section 7. When you scan a barcode or a cover with the camera, the app analyses the image on the device; the image does not leave your iPhone. Reminders are local iOS notifications, without a server.

4. Book search and covers

When you search for a book, scan a barcode or load a cover, the app sends the search term or ISBN to Open Library (Internet Archive, USA), Google Books (Google) and the German National Library and loads book data and covers from there. For technical reasons these services receive your IP address. The legal basis is Art. 6(1)(b) GDPR, as you start the search yourself. Processing by these services is governed by their own privacy policies.

Under every book, “View at Thalia” opens a search for that book at Thalia (Thalia Bücher GmbH). The app passes on only the ISBN or the title and author; the link opens in Safari. If it is marked “Ad”, it goes through the affiliate network Awin (AWIN AG) to Thalia. Awin and Thalia then store a cookie in your browser so that a purchase can be attributed to us. We receive a commission for it, but no personal data about you. Processing by Awin and Thalia is governed by their privacy policies.

5. Account (optional)

You don't need an account to use BestBooks. If you create one, you sign in with your Apple Account (“Sign in with Apple”) or your Google Account (“Continue with Google”). We then process:

  • the identifier Apple or Google assigns for BestBooks, and your account's identifier,
  • your email address, or Apple's anonymous relay address if you hide your address,
  • your name if you share it when signing in, and the display name and username you choose,
  • the times of signing up and of the last change, and details of your sessions (device, IP address) that protect the sign-in.

Other signed-in readers see your display name and username so you can find each other. The purpose is your profile and reading with friends. The legal basis is Art. 6(1)(b) GDPR.

6. Finding friends

If you allow access to your contacts, the app turns the phone numbers and email addresses of your contacts into non-reversible hashes (SHA-256) on your iPhone and sends only these hashes to our server, which answers with the readers who match. We store neither your contacts nor their hashes; we only count how often you search per day, so nobody can try out numbers. So that friends can find you, we store a hash of the email address you sign in with (not of Apple's relay address). You switch this off under Profile → Settings → Findable through contacts. We store whom you follow; that person sees that you follow them. The legal basis is Art. 6(1)(b) GDPR.

7. Sharing with friends

Friends are readers who follow each other. With an account, the app sends our server what your friends may see, and only they see it: your books with title, author, cover, status (reading, finished, want to read), page and date, your stars and the text of reviews you make visible to friends, your three recommendations, your reader type, your streak, your yearly goal, your favourite topics, your bookmarks and the pages of the current month. Private books and anything you switch off under Profile → Settings → Privacy are not transmitted. Books you send to a friend are stored with your message until that person deletes them or one of you deletes their account. The legal basis is Art. 6(1)(b) GDPR.

If you report a profile, a review or a message, we store the report with your identifier, the identifier of the reported person, the reported text, the reason and your note. We review it within 24 hours and keep it as long as we need it for that; the reported person isn't told who reported them. If you block someone, we store that so you no longer see each other. If you delete your account, we also delete your reports and blocks. The legal basis is Art. 6(1)(b) and (f) GDPR; our legitimate interest is a community without insults and harassment.

8. Recipients

For accounts we use two processors under Art. 28 GDPR: Clerk (Clerk, Inc., USA) for signing in, that is your identifier, email address, name and sessions; Supabase (Supabase Inc., USA) for the database with your profile, friends and what you share, on servers in Frankfurt am Main (EU). Apple (Apple Inc. and Apple Distribution International Ltd.) takes part in Sign in with Apple and distributes the app, Google (Google Ireland Ltd. and Google LLC) takes part in signing in with Google. Beyond this, data is disclosed only where we are legally obliged to do so.

9. Transfers to third countries

Clerk, Inc. and Supabase Inc. are established in the USA; Clerk also processes the sign-in data there. Transfers are made on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) and, where the recipient is certified, the EU–US Data Privacy Framework (Art. 45 GDPR). Book searches (section 4) go to services in the USA.

10. No ads, no tracking

BestBooks shows no ads and uses no advertising identifier, no analytics tools and no tracking across apps or websites. We do not sell data and do not use it to train AI models.

11. Retention and deletion

Account data is kept until you delete your account, which you do in the app under Profile → Settings → Delete account. This deletes your account, your profile, the hash of your email address, whom you follow and who follows you, everything shared with friends and the books you sent or received, and your account at Clerk with email address and sessions. Data on your iPhone is deleted by deleting the app.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Use the contact details in the Imprint. You may also lodge a complaint with a supervisory authority (Art. 77 GDPR).

13. Right to object

Where processing is based on Art. 6(1)(f) GDPR, you may object to it at any time on grounds relating to your particular situation (Art. 21(1) GDPR).

14. This website

This website sets no cookies, uses no analytics and loads nothing from third-party domains. The hosting provider processes server log data (IP address, time, requested page, browser) to deliver and secure the site, on the basis of Art. 6(1)(f) GDPR. The logs are deleted after a short period.

15. Children

Accounts are intended for people aged 16 and over. We do not knowingly process account data of people under 16.

16. Changes

We update this notice when the app or the law changes. The version published here applies.