Summary: Bookmarko collects only the data needed to run the app. We do not sell your personal information. You can request deletion of your account and data at any time by contacting us at [email protected].
1. Who We Are
Bookmarko Inc. ("Bookmarko", "we", "us", or "our") operates the Bookmarko mobile application (iOS, Android, macOS) and the website at bookmark-o.com (collectively, the "Service").
This Privacy Policy explains what personal information we collect, how we use it, when we share it, and what choices you have. By using the Service, you agree to the practices described here.
2. Information We Collect
2.1 Information You Provide Directly
- Account data: email address, display name, and optionally a phone number when you register.
- Social sign-in: if you sign in with Google or Apple, we receive a unique identifier and your email from those providers. We do not receive your password.
- Profile content: reading preferences (favorite genres, reading goals), bio, and a profile photo you optionally upload. You may choose an existing image from your device's photo library or take a new one with the camera; the app requests permission before accessing either, and we only receive the single image you select.
- Library data: books you add, reading status (Want to Read, Reading, Finished, Did Not Finish), reading progress, and favorite passages.
- Imported book files: e-book files (EPUB) you choose to import into the personal e-reader. These files are stored only on your device and are never uploaded to or accessible by Bookmarko (see Section 15).
- Collections: custom book lists, names, descriptions, icons, and colors you create.
- Community content: posts (quotes, captions), comments, likes, and book reviews/ratings you author.
- AI conversations: messages you send to our AI assistant, Ginnie, powered by Google Gemini.
- Waitlist/newsletter: email address and optional name submitted on our website.
2.2 Information We Collect Automatically
- Usage data: pages and features accessed, reading streak activity, timestamps, and session duration.
- Device information: device type, operating system version, app version, and language/locale settings.
- Analytics events: collected via Firebase Analytics to understand how the app is used in aggregate.
- Crash reports: anonymized error logs to diagnose and fix bugs.
- Purchase status: whether you have an active subscription; original transaction identifiers provided by Apple or Google. We do not process or store payment card data.
2.3 Information from Third Parties
- Book metadata: titles, authors, descriptions, cover images, and ISBNs retrieved from Google Books API, Open Library, and similar public catalogues.
- Authentication providers: Google and Apple supply a user identifier and email when you use social sign-in.
3. How We Use Your Information
| Purpose | Data Used | Legal Basis (GDPR) |
|---|
| Create and manage your account | Email, name, social ID | Contract performance |
| Provide reading library & community features | Library data, posts, reviews | Contract performance |
| Power the Ginnie AI assistant | AI chat history, library context | Contract performance / Consent |
| Process & verify subscriptions | Purchase status, transaction IDs | Contract performance |
| Send service emails (confirmations, notices) | Email address | Contract performance |
| Send newsletter (optional) | Email address | Consent (opt-in only) |
| Improve the Service (analytics) | Usage events, crash logs | Legitimate interest |
| Fraud prevention & security | Device info, session data | Legitimate interest / Legal obligation |
| Comply with legal obligations | As required by law | Legal obligation |
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
4. How We Share Your Information
We do not sell your personal information. We share data only as described below.
4.1 Service Providers
| Provider | Purpose | Data Shared |
|---|
| Supabase | Database hosting, authentication, file storage | All app data stored in your account |
| Google Cloud Platform (Cloud Run, Cloud Storage) | Backend API hosting and storage of images you upload, such as your profile photo | Images you upload and requests handled by our API |
| Google Firebase | Analytics, crash reporting, device integrity (App Check) | Usage events, device identifiers, crash logs |
| Google Gemini API | Powers Ginnie AI responses | Your messages + relevant library context (see Section 5) |
| Google Sign-In | OAuth authentication | Google user ID and email (received, not sent) |
| Apple Sign-In | OAuth authentication | Apple user ID and email (received, not sent) |
| Apple App Store / Google Play | In-app purchase processing | Purchase events and transaction IDs |
| Book data APIs (Google Books, Open Library, NLI) | Book search results | Search queries only; no personal data |
All service providers are contractually required to handle your data only as instructed by us and in compliance with applicable privacy laws.
4.2 Public Community Content
Posts, quotes, and book reviews you publish are visible to other Bookmarko users. Your display name and profile photo may appear alongside your public content. Because your profile photo is shown to other users, it is served from public cloud storage and can be viewed by anyone who has its link. You can change or remove your profile photo at any time from the app.
4.3 Legal Requirements
We may disclose your information if required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
4.4 Business Transfers
If Bookmarko is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.
5. AI Features (Ginnie)
Bookmarko's AI assistant "Ginnie" is powered by Google Gemini 2.0 Flash. When you chat with Ginnie:
- Your messages and relevant excerpts from your reading library are sent to Google's Gemini API to generate responses.
- We may cache AI responses temporarily on our servers to improve performance and reduce costs.
- Google processes this data under its own Privacy Policy and applicable AI usage policies.
- Do not share sensitive personal information (passwords, financial details, government IDs) in AI chats.
AI-generated responses are for informational purposes only and may contain errors. They do not constitute professional advice.
6. In-App Purchases & Subscriptions
Premium features are available via subscriptions processed entirely by Apple App Store (iOS/macOS) or Google Play Store (Android). We do not receive or store your payment card number or billing address.
We receive a transaction identifier and subscription status from Apple or Google to unlock premium features in your account. Subscription management, refunds, and cancellations are governed by the respective platform's terms.
7. Data Retention
We retain your account and library data for as long as your account is active. After account deletion:
- Personal data is deleted or anonymized within 30 days.
- Backups may retain your data for up to an additional 90 days before being purged.
- Aggregated, anonymized analytics data may be retained indefinitely.
- Data required by law (e.g., transaction records) is retained for the legally required period.
To delete your account, go to Settings → Account → Delete Account in the app, or email [email protected].
8. Security
We implement industry-standard security measures including:
- Encrypted connections (HTTPS/TLS) for all data in transit.
- Encrypted storage for authentication credentials on your device.
- JWT-based session tokens with expiration.
- Firebase App Check / Apple App Attest for device integrity verification.
- Access controls limiting who at Bookmarko can access your data.
No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately at [email protected].
9. Children's Privacy
The Service is not directed to children under 13 years of age (or 16 in the EEA/UK). We do not knowingly collect personal information from children. If we learn that we have inadvertently collected data from a child under the applicable age threshold, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected].
10. Your Privacy Rights
Regardless of where you live, you have the following rights:
- Access: request a copy of the personal data we hold about you.
- Correction: ask us to correct inaccurate or incomplete data.
- Deletion: request deletion of your personal data (subject to legal retention obligations).
- Portability: receive your data in a portable, machine-readable format.
- Opt-out of marketing: unsubscribe from promotional emails at any time via the link in the email.
To exercise any of these rights, email [email protected]. We will respond within 30 days (or as required by law).
11. European Users (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following applies:
Data Controller
Bookmarko Inc. is the data controller for personal data processed through the Service.
Additional Rights
- Restriction of processing: ask us to limit how we use your data while a dispute is resolved.
- Object to processing: object to processing based on legitimate interest.
- Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.
- Lodge a complaint: you have the right to lodge a complaint with your local data protection authority.
International Data Transfers
Your data may be transferred to and processed in countries outside the EEA, including the United States, where our service providers (Supabase, Google, Apple) operate. We rely on Standard Contractual Clauses or other approved transfer mechanisms to protect your data during such transfers.
12. California Users (CCPA / CPRA)
California residents have rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:
- Right to Know: the categories and specific pieces of personal information collected about you.
- Right to Delete: deletion of your personal information (with exceptions).
- Right to Correct: correction of inaccurate personal information.
- Right to Opt-Out of Sale/Sharing: we do not sell or share personal information for cross-context behavioral advertising.
- Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights.
To submit a verifiable consumer request, email [email protected].
13. Cookies & Tracking
Our website (bookmark-o.com) uses minimal cookies:
- Essential cookies: required for core website functionality (e.g., form submission state). Cannot be disabled.
- Analytics cookies: Firebase Analytics may place cookies to measure aggregate traffic. You can opt out via your browser settings or a browser extension that blocks Google Analytics.
Our mobile app does not use browser cookies. It uses device storage (secure storage, local preferences) for session management and cached settings.
14. Third-Party Links
The Service may contain links to third-party websites or services (e.g., book purchase links, author websites). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.
15. Imported Book Files (E-Reader)
Bookmarko's personal e-reader lets you open e-book files (EPUB) that you import from your own device. We designed this feature to be private by default:
- Local storage only: Imported files are saved in Bookmarko's private storage area on your device. They are never uploaded to our servers, Supabase, or any cloud service we operate.
- No access by us: We cannot read, scan, copy, analyze, or back up the contents of files you import. The text you read in the e-reader is not transmitted to Bookmarko.
- Reading data: Lightweight data you create while reading — such as reading progress, highlights, and saved passages — may be synced to your account so your library stays consistent across devices. This is the same library data described in Section 2 and does not include the underlying file itself.
- AI features: If you use the Ginnie assistant from within the reader (for example, to explain a passage), only the specific text you select or send is processed as described in Section 5. The full file is not sent.
- Deletion: Removing the book, or deleting the app, deletes the imported file from your device. Because we never held a copy, there is nothing for us to delete on our side.
16. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy in the app and/or by email (if we have your address). Your continued use of the Service after the effective date constitutes acceptance of the updated policy.