The short version
At a glance
- We use your details to match books, ship boxes, bill you and help you.
- Card numbers go to Stripe. We never see or store them.
- No ad trackers, no third-party analytics, no tracking cookies.
- We don’t sell or share your information for advertising.
- Passport stamps show a city, never an address. You can hide your city.
- Download or delete your data from your account at any time.
This policy explains how [Company legal name] (“Stray Book Society”, “we”, “us”) handles personal information when you use our website and services. It applies to members, gift buyers and recipients, newsletter subscribers and anyone who contacts us.
What we collect
Information you give us
- Account details: your name, email address and password. We store passwords only as a salted, one-way hash.
- Reader profiles: for you and anyone you add, a name or nickname, an age group (adult, teen, middle grade, little one) and reading preferences from the Sniff Test: genres, moods, pace, length, content notes you want to avoid, format needs (such as large print), the wildness setting and any notes for our curators.
- Books you’ve read: titles, authors and ISBNs you enter, scan or import from a Goodreads or StoryGraph export so we don’t send duplicates. Import files are read in your browser; only the book list is sent to us.
- Shipping details: recipient name, postal address and, if you choose to give it, a phone number for delivery problems.
- Ratings and notes: the tail-wag ratings, reading status and private notes you add to your shelf, and any Book Passport notes you choose to publish.
- Gifts: if you buy a gift, your name and email, the recipient’s name, optionally their email, and your gift message.
- Trade-ins: the ISBNs, condition and format of books you offer us.
- Messages: what you send us through the contact form or by email.
Information created when you use the service
- Subscription and order history: your plan, renewal dates, skips and pauses, boxes, the books in them, invoices, credits and coupons used.
- Payment records: Stripe gives us a customer reference, the last four digits and brand of your card, and whether payments succeeded. We never receive your full card number or security code.
- Security data: a session cookie that keeps you logged in, the browser type you logged in with, and a keyed one-way hash of your IP address stored with your session. We use your IP address briefly in memory to prevent abuse such as password guessing.
- Two-step verification: if you turn it on, an encrypted authenticator secret and hashed recovery codes.
What we don’t collect
We don’t collect your date of birth, precise location, contacts, or data from social networks, and we don’t buy data about you from anyone. Our website analytics count page views and a few anonymous events per day; they contain no identifiers and are not linked to you. Nothing is counted at all if your browser sends a Global Privacy Control or Do Not Track signal.
How we use it
- To provide the service: matching books to each reader, curating and shipping boxes, showing your shelf and Book Passports, processing gifts and trade-ins. Necessary to perform our contract with you.
- To bill you: charging renewals, applying credits and coupons, sending receipts and renewal reminders, and handling failed payments.
- To improve matching: our matcher learns from ratings across the Society, for example noticing that readers who loved one book often love another. This uses ratings as anonymous patterns; no one sees which member rated what.
- To keep things secure: preventing fraud and abuse, protecting accounts, and keeping audit records of staff actions.
- To communicate with you: service emails about your account, boxes and billing (you can’t turn off the essential ones while subscribed), and our monthly newsletter only if you opt in.
- To meet legal obligations: tax and accounting records, responding to lawful requests, and handling your privacy requests.
We don’t use your information for automated decisions with legal or similarly significant effects, and we don’t use it to target advertising.
What other people can see
- Book Passport stamps: when a book ships to you, its passport records your city and state. Anyone with the book’s code can see the journey. You can switch off “Show my city on passport stamps” in your privacy settings, and future stamps will show your state only.
- Passport notes: if you leave a note, it appears after review with the display name you choose (by default your first name and last initial) and your tail-wag rating.
- Referrals: a friend who joins with your code sees nothing about you beyond what you share with them. You see only their first name and whether their reward was earned.
- Gift recipients see the purchaser’s name and message on the gift.
How long we keep it
| Information | Kept for |
|---|---|
| Account, reader profiles, read lists, addresses | While your account is open. Deleted or anonymised within 30 days of an account deletion request. |
| Invoices and payment records | 7 years, for tax and accounting law. After account deletion these are kept without your name or email. |
| Shipping details on past boxes | 2 years after delivery, for delivery disputes and claims, then removed. |
| Ratings and shelf notes | While your account is open. After deletion, ratings may remain only as anonymous patterns in our matcher. |
| Approved passport notes and stamps | As part of the book’s public history. After account deletion, your display name is replaced with “A fellow stray”. Ask us if you want a note removed. |
| Support messages | 3 years after the conversation ends. |
| Sessions and security tokens | Sessions end after 30 days of inactivity. Email verification and reset links expire within hours and are purged. |
| Newsletter subscription | Until you unsubscribe. We then keep your email on a suppression list so we don’t email you again. |
| Server logs | 30 days. Logs never contain passwords or security tokens. |
| Encrypted backups | Rolling 30 days. |
| Aggregate statistics | Indefinitely. They contain no personal information. |
Your choices
- Do not sell or share my personal information: we don’t sell or share personal information, so there is nothing to opt out of. We still treat a Global Privacy Control signal from your browser as a valid opt-out request, automatically.
- Marketing email: the newsletter is opt-in. Every issue has a one-click unsubscribe link, or switch it off under Notifications in your account.
- Service notifications: you can turn off box updates and monthly renewal reminders. We will still send receipts, legally required notices (such as annual renewal reminders and changes to your plan’s price) and security alerts.
- Passport city: switch off “Show my city on passport stamps” in your privacy settings.
- Download your data: Account → Privacy → Download my data gives you a copy of everything linked to your account as a JSON file.
- Delete your account: Account → Privacy → Delete account cancels any subscription and deletes or anonymises your data as described above.
Your rights
Wherever you live, you can ask us to:
- tell you what personal information we hold about you and how we use it;
- give you a copy in a portable format (also available instantly from your account);
- correct information that is wrong (most of it you can edit yourself);
- delete your information, subject to records we must keep by law;
- stop sending you marketing.
Email [privacy email] or use the contact form. We will confirm your identity, usually by asking you to reply from the email on your account, and respond within 45 days. You may use an authorised agent; we’ll ask for proof of their authority. If we decline a request, we’ll explain why, and you can appeal by replying to our decision. We will never charge you more, give you a worse service or deny you the service because you exercised a privacy right.
State privacy rights
If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another state with a comprehensive privacy law, you have rights to know, access, correct, delete and port your personal information, and to opt out of its sale, sharing for targeted advertising and certain profiling. As described above, we don’t sell, share for targeted advertising or profile you in ways that produce legal or similar effects.
In the past 12 months we collected these categories of personal information under California law: identifiers (name, email, postal address); customer records (shipping and billing details); commercial information (subscriptions, purchases, credits); internet activity limited to security logs on our own site; and inferences limited to your reading preferences. We collected them from you directly and from your use of the service, for the purposes in How we use it, and disclosed them only to the service providers in Who we share it with. We don’t collect sensitive personal information as defined by California law.
Children
Our service is intended for adults aged 18 and over. Account holders may create reader profiles for children in their household so we can send age-appropriate books. Those profiles contain only a name or nickname, an age group and reading preferences entered by the adult. We don’t knowingly collect personal information directly from children under 13. If you believe a child has given us personal information, contact us and we will delete it.
How we protect it
All traffic to our site is encrypted with HTTPS. Passwords are hashed with scrypt, session tokens are stored only as hashes, two-step verification secrets are encrypted, and staff accounts must use two-step verification. Access to member data is limited by staff role and every staff action is logged. Read more on our security page. No system is perfect; if we ever have a breach that affects your information, we will tell you and the relevant authorities as the law requires.
Changes to this policy
If we make material changes, we’ll email members and post a notice on the site before they take effect. The date at the top shows when this policy was last updated.
Contact
Privacy questions or requests: [privacy email], our contact form, or by post to [Company legal name], [Business address].