Privacy Policy

1 What We Collect

We collect information you provide directly:

• Account info - username, email address, and password (stored hashed)
• Profile info - display name, bio, avatar, favorite genre (all optional)
• Book data - books you add, shelf status, ratings, reviews, reading progress, notes
• Activity - follows, reading goals, achievements earned

We also collect some technical information automatically:

• Log data (IP address, browser type, pages visited) for security and debugging
• Session cookies to keep you signed in

2 How We Use It

We use the information we collect to:

• Provide and improve the PorchReads service
• Personalize your experience (recommendations, reading stats)
• Send transactional emails (password resets, account notices)
• Detect and prevent fraud or abuse
• Generate anonymized, aggregate statistics about reading trends

We do not use your data to serve advertisements, build advertising profiles, or sell insights about you.

3 Sharing Your Data

We do not sell or rent your personal data. We may share limited information only in these circumstances:

• With your consent - when you choose to make your profile or shelf public
• Service providers - trusted third parties that help us operate the service (e.g. hosting), bound by confidentiality
• Legal requirements - if required by law or to protect the rights and safety of our users

Public profiles and shelves are visible to other users and search engines. You can make your profile private at any time in your settings.

4 Cookies

PorchReads uses a small number of cookies:

• Session cookie - keeps you signed in while you browse
• CSRF token - protects forms from cross-site attacks

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. Google Fonts is loaded from Google's servers, which may set its own cookies subject to Google's privacy policy.

5 Security

We take reasonable measures to protect your data including:

• Passwords stored using bcrypt hashing - never in plain text
• HTTPS encryption for all connections
• CSRF protection on all forms
• HTTP security headers (X-Frame-Options, X-Content-Type-Options)

No system is 100% secure. If you discover a security vulnerability, please report it to hello@porchreads.com.

6 Your Rights

You have the right to:

• Access - see all the data we hold about you
• Correct - update inaccurate information in your profile settings
• Delete - delete your account and data from your profile settings
• Export - request a copy of your data by contacting us
• Restrict - make your profile private at any time

To exercise any of these rights, visit your account settings or contact us at the address below.

7 Children

PorchReads is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete it promptly.

8 Contact