Your privacy at BetweenBooks

This policy explains what BetweenBooks keeps about you, why we keep it, who else receives it, and how you can download it or delete it. It covers the website and the BetweenBooks iPhone app. It is written to be read by younger readers and their parents too.

Last updated 18 October 2026. Version 2.3.

The short version

This summary helps you find your way. The numbered sections below give the full detail.

Who we are. BetweenBooks is run by Louis Røislie in Norway. He is responsible for your information.
What we keep. Your account, your books and what you write about them, your settings, and anything you choose to share with other readers.
Why we keep it. To run BetweenBooks for you, to keep accounts safe, and to take payment if you buy Pro.
Who else receives it. The companies in section 7, which host the site, find book details, take payments and send email. We never sell your information. We show no adverts, and we never use what you write to train AI.
Your rights. You can download your library, correct it and delete your account at any time from Settings. For anything else, write to privacy@betweenbooks.net. We answer within one month.
Young readers. You must be 9 or older. If you are under 18, a parent or guardian must agree before you join. If you are under 13, the parent also agrees to how we use your information.
Worth knowing. Messages are not end-to-end encrypted. A message that is reported is copied so that a person can review it. After you delete your account, backups hold a copy for up to 30 days, and a few billing and staff records stay longer, as section 9 explains.

1. Words used in this policy

1.1 The Service is BetweenBooks. It is made up of the website at betweenbooks.net and the BetweenBooks iPhone App.

1.2 Your Account is your BetweenBooks account and everything stored under it.

1.3 Your information is any information about you that we keep. The law calls it personal data.

1.4 A Parent is a parent or legal guardian who has authority to act for a reader under 18.

1.5 Staff are the people who run the Service, answer support messages and review reports.

1.6 “We” and “us” mean the operator named in section 2.

2. Who is responsible

2.1 BetweenBooks is run by Betweenbooks, a Norwegian sole proprietorship in the name of Louis Røislie, Tordenskjolds gate 11, 2821 Gjøvik, Norway. The organisation number is 938524637. It decides how your information is used, so the law calls it the data controller.

2.2 Write to privacy@betweenbooks.net with any question or request about your information. Section 15 lists every way to reach us.

3. What we store

3.1 We keep what you enter, import or choose. We also keep the records we need to run your Account, payments and safety features. An optional feature stores nothing until you use it.

3.2 The table lists everything we store. It also covers information saved earlier by a feature that is now switched off.

What	Specifically	Why
Your account	Your username and email address. Your password is stored only as a salted hash, never as readable text. Your plan and the date Pro runs to, and the date you signed up. The year you were born. If that year shows you can be under 18, the time a Parent agreed. Accounts made before 4 October 2026 hold no year of birth.	To let you sign in, and to send the codes, username reminders and security emails your Account needs. To know which shelves are yours, and to keep the age rules in the Terms of Use.
Your library	Every book you add and everything you record about it. That means the title, author, ISBN, cover, page count and year. It also means the shelf it is on or whether it is on your wishlist, your tags, reading status, progress, star rating and the four aspect ratings. It includes the dates you started and finished, and the text of your review, your thoughts and your notes. A book found by search also keeps its edition details, which are the full title, authors, publisher, publication date, binding, language and synopsis. While an imported book is being looked up, it also has a matching status, a retry count and the editions it could match.	It is the Service. Without it there is nothing to show you.
How you like it to look	Your display name, accent colour and shelf defaults. If you set them, a profile picture, a background image and any custom CSS you wrote. Your start page, text size, theme, compact layout, reduced motion, recommendation explanations and reading goal.	So the Service looks the way you left it, on any device you sign in from.
Discovery and friends	The genres you marked as interests or muted, and the book length and age you prefer. The suggestions you dismissed and the books you left out of recommendations. Whether Friends is switched on, which shelves you share, and your friends and blocks. Any reader you reported, with the reason you chose and when.	To make recommendations from your own shelves, to run Friends if you switch it on, and so that staff can review a report about a reader.
Messages	If you write to a friend, the text of each message and when it was sent. The title, author, cover, year and ISBN of any book you attach. A book attached before 18 September 2026 also has an Open Library reference. The reaction each of you chose, and how far you have read each conversation. When you unsend a message, we erase its text and book and keep only the fact that a message was there. If you report a message a friend sent you, we keep which message, a copy of its text, the reason you chose and when.	To deliver your messages to the friend you wrote to, and to show you which messages are new. A report is kept so that staff can review that one message.
Reader card	If you set one up, the style, colour, backdrop, frame and featured badge you chose and one line about yourself. Up to three favourite books from your shelves, by their public details. A passage you typed and the book it is from. Which showcases it shows and in what order. A showcase can show what you are reading now and how far you are, the books you finished last with the month, this year's count, pages and longest book, and badges worked out from your shelves with your total of books read. One badge says you have left a book unfinished.	To show your card to friends, and beside your book comments if you switch that on.
Kept styles	Each style you save, with its name, its colours and choices, and when you saved it and last changed it. If you share one, the link that opens it.	So you can move between your styles, and so a signed-in reader with your link can try that style. The link does not say who made the style. When you stop sharing, the link stops working.
Your reading journeys	The journeys feature is switched off. For journeys saved before then, each reading with its dates and status, and what you wrote at each stage. The ratings and pages you noted along the way, and when you asked to be invited to reflect again.	To show you your own record of a book over time. Nobody else sees it, and it is never used for recommendations.
Book discussions	Whether Book discussions is switched on. For each comment you write, the book it is about, its text and when you posted it. Whether you marked it as a spoiler, and your reading status if you ticked the box to show it. If you report another reader’s comment, we keep which comment, the reason you chose, that you reported it, and when.	To show your comments to other signed-in readers on the book’s page, and so that staff can review a reported comment.
Your session	A hash of your session token, your account ID, when the session ends, and whether you chose to stay signed in. The session record holds no IP address and no browser details. Those appear only in the separate logs described under Sign-in activity.	To keep you signed in without asking again each time you open the Service.
Days you used the Service	Your account ID and each UTC day on which you used the Service while signed in. It holds no time of day, page, book, IP address or browser details.	To count how many readers use the Service each day, week and month, and how many come back after they join. Staff see these only as totals.
Sign-in and password-reset codes	A hash of each code we email you, what it is for, how many tries were made, when it ends and whether it was used. We clear codes that are used or out of date.	To confirm that you can receive email at the address on your Account, and to let you reset your password.
Billing and subscription	If you subscribe on the website, your Stripe customer ID and subscription ID. If you subscribe in the App, Apple’s subscription ID, the product and the expiry date. Your subscription status as Stripe or Apple reports it, and the currency you pay in. A record of each billing event. Which payment paid which invoice and the period it covered, so a refund ends only what it refunded. While a subscription runs, the date we last sent you the six-monthly reminder about it.	To bill you, to match what you paid with what Stripe or Apple reports, and to know the date your Pro is paid up to. We update the status when Stripe or Apple tells us of a change. None of this exists unless you start a subscription.
Moderation	Whether your Account is active, suspended or banned. When a suspension ends, and the reason given for a ban. Whether your Account has staff rights.	To enforce suspensions and bans, and to know who can moderate. Staff set these records to protect other readers. When staff act against your content or your Account, we email you what we did, under which rule, and why.
Support messages	The topic and text of each message you send from the support page or the App, and when you sent it. Whether it is open, being worked on, waiting for your reply, closed or dropped, when it ended, which staff member looks after it and for how long, and a private note staff write about it. Each message also reaches our support inbox by email, with your username and email address. When staff use the staff console to open your Account or one support message, search for readers, or change something, we record who did it, what they did, the account or search words involved, and when. The list of support messages shows the start of each message, and loading or searching that list is not recorded.	To answer you, to follow a problem until it is fixed, and to keep staff access to Accounts accountable.
Sign-in activity	Security events for sign-in, registration, password changes and resets, and requests we slowed down. Each event holds the facts it needs, which can be an IP address, the time, the outcome, a username, an account or code identifier, and the limit involved. We never set out to log passwords, session tokens or email codes.	To protect Accounts from break-ins and our forms from automated abuse, and to investigate when that happens. These records live in Cloudflare’s logs.
Rate-limit counters	How many friend actions, messages and book discussion writes you made in the current time window. Sign-in limits count by IP address, username or code identifier. Book lookup limits count by your account ID. Free accounts also have a monthly search counter. No counter stores what you searched for.	To stop anyone flooding other readers, and to keep Free to 50 book searches a month. Each limit resets when its time window ends. That includes the daily lookup limit for accounts without a paid subscription and the monthly Free search limit.

4. Recommendations and usage counts

4.1 Discover ranks books for you from your library and your choices. Those choices are your genres, ratings, interests, muted genres and dismissed suggestions.

4.2 Your reviews, thoughts, notes, messages and journey writing are never used for recommendations. A recommendation never makes a decision with a legal or similarly serious effect on you.

4.3 We count nine kinds of event each day. They are landing-page views, sign-in-page views, new accounts and recommendation sets shown. They also include recommendations opened and recommendations added, each counted apart for ranked and exploration picks, and dismissed suggestions.

4.4 Each count holds only a UTC day, an event name and a number. It holds no account, session, IP address, book, search words or single visit. We delete these counts after 90 days. They are kept apart from the security logs, which do hold identifiers.

4.5 We use no outside analytics scripts, advertising pixels or data brokers. We never use anything you write or record here to train AI models. The website serves its own scripts and fonts.

4.6 We also note each day on which you use the Service while signed in, as section 3 describes. Staff see only totals, such as how many readers came this week, and never the days of one reader. We delete each day after 180 days.

5. Why we use your information, and the legal basis

5.1 The GDPR requires a legal basis for each use of your information. We rely on the four bases below.

To give you the Service you asked for, under Article 6, paragraph 1, point b. This covers your Account, library, settings and sessions, the emails you ask for, and your Pro subscription with its reminders.
Our legitimate interests, under Article 6, paragraph 1, point f. This covers protecting Accounts, stopping abuse, finding faults, handling reports, keeping a record of staff access, and counting how many readers use the Service and come back. You can object to this use.
Your consent, under Article 6, paragraph 1, point a. You switch Friends and Book discussions on in your settings, and you can switch either off at any time. Switching off stops or hides your sharing as section 8 describes. It does not erase what you already wrote. Messages stay part of the conversation until they are unsent or an Account is deleted. Reports are handled under our legitimate interests.
Our legal duties, under Article 6, paragraph 1, point c. This covers the age rules in section 6, payment records kept for bookkeeping, and answers to a lawful request from the authorities.

5.2 You need an Account and an email address that works to use the Service. Sharing, profile pictures and Pro are optional. When you withdraw consent, that does not undo the lawful use made before you withdrew it.

6. Children and parents

6.1 BetweenBooks is for readers aged 9 and over.

6.2 Sign-up asks for the year you were born. We refuse a sign-up if the reader turns 9 after the end of this year.

6.3 If you are under 18, a Parent must agree to the Terms of Use for you. If you are under 13, a Parent must also agree to how we use your information. In Norway, 13 is the age at which a person can agree to an online service alone.

6.4 A Parent agrees by ticking a box at sign-up, and we record the time. We do not check who ticked the box.

6.5 A Parent can use a child’s privacy rights for them. That includes asking for a copy of the child’s information or for the Account to be deleted. We check the request as section 11 describes, and we send a copy only to the email address on the Account.

6.6 If we learn that an Account belongs to someone under 9, or to someone under 13 without a Parent’s agreement, we delete it. Tell us if you know of one.

For readers aged 9 to 12, and their parents

BetweenBooks keeps a list of your books and what you think of them. Your notes and reviews are private, so other readers never see them. A grown-up who looks after you must say yes before you join. If you write a comment on a book page, other readers can read it. So never put your full name, your school or your address there. You and your grown-up can ask us to show you everything we keep about you, or to delete all of it. We never show you adverts, and we never sell anything about you.

7. Who else receives your information

7.1 Apart from the case in 7.5, we share your information only with the providers below, and only for the reason given. Each one has its own privacy policy.

Cloudflare hosts the website, our server code, the database and the rate-limit service. It handles everything we store and every request, including your IP address. Its logs and sampled traces help us find faults and look into abuse. See the Cloudflare privacy policy.
ISBNdb supplies book search results, catalogue details and recommendation ideas. Our server sends it your search words, or a book’s title, author or ISBN, also when it matches imported books. It never sends your account ID, your email address or your IP address. We keep ISBNdb’s public book records, and a hash of each search or title and author, to reuse for every reader. These saved records name no reader. Someone holding them could still guess a common search from its hash. Your browser also loads covers from ISBNdb’s image servers, which receive your IP address and normal request details. See the ISBNdb privacy policy.
Internet Archive and Open Library serve the covers of older books that were saved with an Open Library cover. Your browser fetches those images from covers.openlibrary.org, which receives your IP address and normal request details. New book searches use ISBNdb. See the Internet Archive privacy policy.
Stripe handles subscriptions bought on the website, through its own checkout and customer portal pages. To start checkout we send your email address or your Stripe customer ID, your BetweenBooks account ID, the price you chose and the pages to return to. Stripe collects your payment and billing details on its own pages, so we never see your card number. Stripe tells us about subscription and payment events so that we can update your access. Stripe keeps its own payment records under its own legal duties, also after you delete your Account. See the Stripe privacy policy.
Apple handles payment for Pro bought in the App, through the App Store. Apple shares no payment details with us. Apple sends us signed notices about renewals, expiry and refunds, and our server never calls Apple. We keep only Apple’s subscription ID and product, the status, and the date your Pro is paid up to. See the Apple privacy policy.
Resend delivers our emails, so it receives your email address and the content of each email. These are sign-in and reset codes, username reminders, and security notices after a change to your email address or password. They also include the six-monthly reminder that Pro renews, the email that explains a moderation decision to the reader it concerns, and the email that tells you what we decided about a report you made. Resend also carries each support message you send to our support inbox. We send no marketing email. See the Resend privacy policy.
Have I Been Pwned runs the Pwned Passwords service, which checks a new password against passwords exposed in known breaches. Our server sends only the first five characters of the password’s SHA-1 hash, and checks the answers on our side. It never sends your password, the full hash, your email address or your account ID. See the Have I Been Pwned privacy policy.

7.2 If you use an image hosted somewhere else, that host receives your IP address and request details when your browser loads it. We do not control those hosts.

7.3 The pricing page uses the country Cloudflare reports to choose a currency and how tax is shown. We keep no history of where you are. If you subscribe, we store your billing currency, and Stripe handles the billing address you give at checkout.

7.4 These providers work worldwide, so your information is also handled outside Norway and the European Economic Area, including in the United States. Each provider’s terms and data processing agreement set out the safeguards. These include the EU standard contractual clauses where a provider relies on them. Write to us to learn which safeguard covers your information.

7.5 If content seems illegal, we can report it to the police, as clause 9.7 of the Terms of Use says. We hand over only what the law requires or allows.

8. What other readers and staff can see

8.1 Friends and Book discussions stay off until you switch them on. Your privacy settings control the sharing below.

Friends. You choose which shelves to share and whether to share your wishlist. Shared books show their basic details, reading status and standard genre tags. Ratings, reading dates and page progress each have their own sharing switch. Your own tags, reviews, thoughts and notes are never shared.
Messages. Only the two people in a conversation can read it. An attached book carries its public details, never your private notes or ratings. Removing a friend or switching Friends off stops new messages, and the conversation stays readable. Blocking hides the conversation from the reader you block for as long as the block lasts, and you keep a read-only copy. Unsending erases the message text and the attached book, and leaves a mark that a message was there.
Book discussions. Other signed-in readers see your comments, with your display name or username. They also see your reading status if you choose to show it. You can delete your comments. Switching discussions off hides your comments until you switch it on again, and it does not delete them. Blocking also limits what each reader sees of the other.
Reader cards. Your card shows the line about yourself and the showcases you choose, such as your favourites, your current books, your recent books, your year, your badges with your total of books read, and a passage. You can show your card beside your comments. Check these choices before you share anything personal.
Styles. A signed-in reader with the link to a style you share can open it. The shared style does not say who made it. Switching sharing off stops the link working.
Reports and staff. Reporting a message sends staff a copy of its text and your reason. Unsending the original does not erase that copy. Staff also review reported comments and reported readers. Staff do not read a message unless the friend who received it reports it. The one exception is a data export. If you ask us by email for your data or for your profile picture and background image, staff open a full export of your Account, messages included, and send what you asked for only to the address on your Account. Each time staff use the staff console to open your Account or one support message, open the list of reported messages, search for readers, or change something, we record it. A record of the list of reported messages shows that staff opened the list, not which message they read. The lists of support messages, reported comments and reported readers are not recorded. Staff access that does not go through the staff console is not in that record.

8.2 Private content is not end-to-end encrypted. Staff and Cloudflare have the technical access needed to run the Service. Staff use it only for support, security, moderation and legal duties. A private library is private from other readers. It is not hidden from the people who run the Service.

9. How long we keep it

9.1 Each kind of record stays for the time given below.

Library and account. Kept until you remove it or delete your Account. We do not delete an Account because it is unused.
Sessions and codes. A session ends after 24 hours, or after 30 days if you choose to stay signed in, and using the Service renews it. Signing out deletes that session. We clear sessions that have ended and codes that are used or out of date.
Days you used the Service. Deleted after 180 days, or when you delete your Account.
Messages and reports. A message stays until it is unsent or either Account is deleted. The copy in a message report stays until staff close the report or either Account is deleted. A report about a reader stays until either Account is deleted. Deleting a comment deletes its reports too. A comment report also goes when the Account that made it is deleted.
Support messages. Kept while we deal with them, and deleted 180 days after they are closed or dropped, or when you delete your Account.
Records of staff access. Deleted after one year. They stay for that year after your Account is deleted, so that staff access stays accountable.
Billing events. We keep the ID, type, account ID and time of each billing event from Stripe and Apple, so that no event is processed twice. Deleting your Account does not remove them, and they have no automatic expiry yet. The record of which payment paid which invoice is deleted with your Account. A link that never gained an owner holds only Stripe’s invoice and payment IDs, and it is kept the same way as billing events. Payment records are kept for as long as Norwegian bookkeeping law requires, normally 5 years.
Logs and backups. Cloudflare keeps our server logs for up to seven days, and its database history for up to 30 days. The delete button does not reach into them. They age out on that schedule. See Cloudflare’s pages on log retention and database recovery. Other providers keep their records under their own policies. Write to us about an erasure request.
Usage counts and saved book records. Daily usage counts are deleted after 90 days. Saved public book records are shared by every reader, so they stay when one reader leaves.

9.2 Deleting your Account deletes, at once, the Account and its library, settings, sessions, friendships, sent and received messages, comments, reports, reader card, styles, journey records and support messages. Only the records listed above stay, for the time given.

9.3 Deleting your Account cancels a website subscription with Stripe first. If Stripe cannot be reached at that moment, we stop the deletion and ask you to try again, so that nothing is left billing you. Deleting your Account cannot cancel a subscription bought in the App. Cancel it in your Apple account first.

10. Security

10.1 We use HTTPS, salted password hashing, email codes at sign-in, limits on sessions, and checks that every request reaches only its own Account.

10.2 No online service is perfectly secure. Report a security problem to privacy@betweenbooks.net.

11. Your rights and how to use them

11.1 You can do these four things yourself in the Service.

Download. Settings → Your data → Download gives you a JSON file with your library, account, settings and social records, and a CSV file with your books. Both work on Free. Your profile picture and background image are not in the file. Ask us and we send them to the email address on your Account. The download holds no logs and no provider records. Write to us for a fuller copy.
Correct. Edit your books and settings in the Service. Write to us about anything you cannot change yourself.
Delete. Go to Settings → Your data → Delete account and confirm your password. You can also write to us for help.
Control sharing. Change your Friends, discussion, shelf and reader card settings, or remove what you shared. Other readers can already have copied it.

11.2 The GDPR gives you the right to access, correct and delete your information, to take it with you, to limit how we use it, and to object. Each right applies under the conditions the GDPR sets.

11.3 To use a right, write to privacy@betweenbooks.net. To check that the request is yours, we email a code to the address on the Account and ask you to send it back. We send information only to that address.

11.4 We answer within one month. If a request is complex, or we receive many, we can take two more months, and we tell you why within the first month. If we cannot do what you ask, we explain the reason.

12. Cookies and browser storage

12.1 The website uses one cookie, bt_session, to keep you signed in. It is needed for the Service to work, and it is never used for advertising. If you choose to stay signed in, it lasts up to 30 days and renews as you use the Service. Otherwise your browser forgets it when it closes. Signing out clears it. Stripe’s checkout pages use their own cookies under Stripe’s policy.

12.2 Your browser’s local storage remembers your theme, your Reading controls and whether moving backgrounds are paused. It uses the keys booktracker-theme, betweenbooks-reading-controls and betweenbooks-ambient-paused. If you add your own font in Reading controls, the font file is kept in the browser’s IndexedDB database betweenbooks-reading and is never sent to us. Reading preferences you change in Settings are also saved on our server. The tab’s session storage keeps unsaved writing and a style you are trying, so that you can get them back. None of this is used for advertising. Clearing your browser storage removes it.

13. Changes to this policy

13.1 We update this page and its date when our practices change, and we explain each important change here.

13.2 Version 2.0 of 5 October 2026 rewrites the policy in plain English. It adds support messages and the record of staff access, the emails about a moderation decision and about a report, and the six-monthly reminder that Pro renews. It also adds the year of birth and Parent agreement asked at sign-up, Pro bought in the App, the record that links a payment to its invoice, and the reports readers make about other readers.

13.3 Version 2.1 of 8 October 2026 adds what a reader card can now hold. That is a backdrop, a frame, a featured badge, a passage and the showcases you choose.

13.4 Version 2.2 of 11 October 2026 adds the font file you can keep on your device for Reading controls.

13.5 Version 2.3 of 18 October 2026 adds the days on which you use the Service while signed in, which staff see only as totals.

14. Complaints

14.1 You can complain to Norway’s data protection authority, Datatilsynet, or to the authority where you live. You do not have to contact us first.

15. Contact

15.1 Questions and requests about your information go to privacy@betweenbooks.net. Help with the Service goes to support@betweenbooks.net. Both reach a person.

15.2 By post, write to Betweenbooks, Louis Røislie, Tordenskjolds gate 11, 2821 Gjøvik, Norway.

← Back to BetweenBooks