Privacy Policy

Last updated: 15 August 2026

This Privacy Policy explains how Laurel ("we", "us", "the app") collects, uses, and protects your information when you use the Laurel mobile application.

Laurel is operated by James Harte, based in the United Kingdom. If you have any questions about this policy or your data, you can contact us at jamesharte999@gmail.com.

1. What we collect

When you create an account and use Laurel, we collect the following:

Account information

• Email address
• Password (stored as a salted hash — we never see your plaintext password)
• Username
• Optional profile information: display name, avatar image, banner image, bio

Reading activity

• Books you log, including title, author, cover, rating, review, reading status, current page, difficulty rating, and reading notes
• Custom shelves and collections you create
• Favourite books and authors you mark

Social activity

• Who you follow and who follows you
• Likes and comments on book entries
• Notifications you receive
• Reports you submit and users you block

Technical data

• IP address (collected automatically by our backend provider for security and abuse prevention)
• Device type and operating system version
• App session timestamps
• A push notification token, if you enable notifications. This is an anonymous device identifier issued by Apple or Google that lets us deliver notifications to your device. You can revoke it at any time in your device settings.
• Crash reports and diagnostic data, including the state of the app at the time of an error
• Anonymised usage analytics — which screens are opened and which features are used. This is not linked to your reading activity or shared with advertisers.

We do not collect:

• Your location
• Your contacts
• Your photo library (except photos you explicitly choose to upload as an avatar or banner)
• Any data for advertising or cross-app tracking

2. How we use your data

We use your information to:

• Create and maintain your account
• Let you log books and track your reading
• Show your activity to people you choose to share it with (followers, public profile)
• Send you notifications about social activity (likes, comments, follows)
• Detect and prevent abuse, spam, and security issues
• Diagnose crashes and fix bugs
• Improve the app

We do not sell your data, share it with advertisers, or use it for behavioural advertising.

3. Who we share data with

Laurel uses the following third-party services to operate. These are "data processors" — they handle data on our behalf:

Supabase (Backend, authentication, database, file storage)

• Hosted in the European Union
• Stores your account, reading data, and profile images
• Privacy policy: supabase.com/privacy

Sentry (Crash and error reporting)

• Receives crash reports and error diagnostics, which may include your user identifier so we can tell whether a bug affects one person or many
• Privacy policy: sentry.io/privacy

PostHog (Product analytics)

• Receives anonymised usage events — which screens are visited and which features are used
• Privacy policy: posthog.com/privacy

Apple and Google (Push notification delivery)

• Apple Push Notification service and Firebase Cloud Messaging deliver notifications to your device. They receive the notification payload and your device token, not your reading data.

Book metadata and cover sources

• We send book search queries (titles, authors, ISBNs) to Hardcover, Google Books, Open Library, and the iTunes Search API to fetch book information and cover images
• We do not send your personal information to any of these services
• Hardcover: hardcover.app/privacy
• Google: policies.google.com/privacy
• Open Library / Internet Archive: archive.org/about/terms
• Apple: apple.com/legal/privacy

Wikipedia (Author biographies)

• We request author biography text from Wikipedia. Only the author's name is sent; no personal information about you is included.

Apple (App distribution)

• Apple may collect basic install and crash data per their own policies

We do not share your personal data with any other parties unless required by law.

4. Where your data is stored

Your account data, reading activity, and uploaded images are stored on Supabase servers located in the European Union. This means your data stays within UK/EU data protection law from the moment you sign up.

Some of our processors (Sentry, PostHog, Apple, Google) may process data outside the UK and EU. Where they do, transfers are covered by Standard Contractual Clauses or an equivalent safeguard.

5. How long we keep your data

We keep your data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are legally required to retain certain records (e.g. for fraud prevention or accounting).

Some anonymised or aggregated information (e.g. total app usage statistics) may be kept indefinitely.

6. Your rights

Under UK GDPR and EU GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (you can edit most of this yourself in the app)
• Delete your account and associated data
• Export your data in a portable format
• Object to certain uses of your data
• Withdraw consent at any time
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email jamesharte999@gmail.com. We will respond within 30 days.

You can delete your account directly in the app under Settings, or by emailing us.

7. Children's privacy

Laurel is not directed at children under 13 (or under 16 in some EU jurisdictions). We do not knowingly collect data from children under these ages. If you believe a child has provided us with personal data, contact us and we will delete it.

8. Security

We protect your data using industry-standard measures:

• All data is transmitted over HTTPS/TLS
• Passwords are hashed using bcrypt (handled by Supabase Auth) — we never store or see plaintext passwords
• Database access is restricted by Row-Level Security policies so users can only access their own private data
• Third-party API keys are held server-side and never shipped in the app
• Our backend provider (Supabase) maintains SOC 2 compliance

No system is perfectly secure. If we ever discover a breach affecting your data, we will notify you and the relevant authorities as required by law.

9. Changes to this policy

We may update this Privacy Policy as the app evolves. If we make material changes, we will notify you in the app or by email before the changes take effect. The "Last updated" date at the top of this policy will always reflect the most recent version.

10. Contact

For any questions, requests, or complaints about your data:

Email: jamesharte999@gmail.com
Operator: James Harte
Country: United Kingdom