Privacy Policy

Who We Are

Book Snapper: Find Books ("the App") is operated by POLEN WORKS, UNIPESSOAL LDA, a company registered in Portugal. We are the data controller for the personal data described here.

Contact: info@polenworks.com

The Short Version

You photograph your bookshelves. The photo is sent to our server in the United States and on to an AI provider that reads the book spines. We never store the photo. We do store the library you build — your books, lists, wishlist and scan history — so it syncs across your devices. Your conversations with the Librarian are kept on your phone, not on our servers. We do not sell your data and we do not share it with advertisers.

What We Collect

• Your email address and name, from Apple Sign In, Google Sign In, or email sign-up
• An internal user ID that identifies your account in our systems
• Photos you take of bookshelves, or choose from your photo library (not stored — see below)
• Your library: book titles, authors, and the lists and wishlist you build
• Your scan history: the date of each scan and which books it found — not the picture
• Which recommendations you accepted, saved or dismissed
• Messages you send to the Librarian, while they are being answered
• Your subscription status and purchase history
• Product usage data: which features you use and where things fail

We do not collect your contacts, your location, your advertising identifier, or anything from your photo library beyond the individual pictures you choose to scan.

You can browse and scan without an account. Until you sign in, your activity is tied to an anonymous ID, nothing is saved to your library, and we do not know who you are.

Why We Collect It

• To give you the App. Identifying books, storing your library, syncing it between devices, running the Librarian, and managing your subscription. Legal basis: performance of our contract with you.
• To keep the App working and improve it. Usage analytics and failure reporting. Legal basis: our legitimate interest in a product that works.
• To meet legal obligations. For example, keeping records related to purchases. Legal basis: legal obligation.

Photos and AI

This is the part most people want to understand, so we will be direct about it.

When you photograph a bookshelf, the picture is sent to our server, which runs on Google Cloud in the United States. From there it goes to OpenRouter, a US company that routes AI requests, which passes it to Google. Google's Gemini model reads the titles and authors off the book spines and sends back text. Your photo leaves the European Economic Area to be processed.

We do not store your photos. The picture is held in memory only for as long as the scan takes, is passed straight to the AI provider, and is never written to our database or file storage. Only the text that comes back — titles and authors — is saved to your library and scan history.

AI is also used in two other places:

• The Librarian chat. Your recent messages in a conversation are sent through our US server to OpenRouter and on to Anthropic, whose Claude model writes the reply.
• Book descriptions. Some descriptions in the App are written by an AI model (Claude, via OpenRouter) rather than taken from a catalogue. These are stored in a shared book catalogue, not against your account.

OpenRouter states that it does not use inputs or outputs to train models. Book identification and AI-written text are not always accurate — treat them as a helpful starting point rather than a fact.

The Librarian and Recommendations

The Librarian reads the contents of your library — the books you have added, your lists and your wishlist — to work out what you like and suggest other books. It also takes account of recommendations you have previously turned down, so it does not offer them again. Under the GDPR this counts as profiling.

It is based only on what is in your own library inside the App. We do not buy data about you, we do not combine your library with data from other apps or websites, and we do not use it to build an advertising profile. The profiling has no legal or similarly significant effect on you: at worst you get a book recommendation you do not care for.

You can object by not using the Librarian or recommendations, or by deleting your account. Removing books from your library removes them from what the Librarian sees.

Analytics

We use PostHog, hosted in PostHog's European Union region, to understand how the App is used — which features people open, where they get stuck, and what breaks. Some events, such as a subscription renewal reported to us by Apple, are sent to PostHog by our server rather than by the App.

You are identified to PostHog by your internal user ID only. We do not send it your email address, your name, or the titles of the books in your library. The only profile details attached to you are whether you have a paid subscription and which plan. There is no session replay, no screen recording, and no advertising identifier. We do not share data with advertising networks or data brokers, and we do not sell your data.

The App also includes Google's Firebase SDK, which may collect basic app and device information such as app opens, device model, and operating system version. We do not send it your library or your identity beyond your account ID.

Who Else Receives Your Data

These are the third parties the App sends data to, and what each one gets:

• Google Firebase and Google Cloud — sign-in, database, and the server functions that run scanning, chat and recommendations. Holds your account details and your library.
• OpenRouter (United States) — routes our AI requests. Receives your bookshelf photos and your Librarian messages and passes them to Google and Anthropic.
• Google (Gemini models, United States) — reads book titles from your photos.
• Anthropic (Claude models, United States) — powers the Librarian chat and writes book descriptions.
• PostHog (EU region) — product analytics, keyed to your internal user ID.
• Open Library and Google Books — queried for book details and cover images. They receive the book being looked up, not your identity.
• Apple — handles subscriptions and tells us about purchases, renewals and cancellations through App Store server notifications.
• Amazon — where the App offers a link to buy a book, it is an Amazon affiliate link and we may earn a commission. We send Amazon nothing about you; if you tap the link, Amazon receives your visit under its own privacy policy.

Each of these companies has its own privacy policy, and we encourage you to read the ones you care about.

Sending Data Outside Europe

Your account and library are stored in the European Union. But the server functions that process your scans, your chats and your recommendations run in the United States, and OpenRouter, Anthropic and Google are United States companies. So your photos, your Librarian messages and your library data are processed outside the European Economic Area.

For these transfers we rely on the European Commission's Standard Contractual Clauses, agreed with each provider, and — where a provider is also certified under the EU-US Data Privacy Framework — on that certification. You can ask us for details of the safeguards that apply by emailing info@polenworks.com.

How Long We Keep Things

• Bookshelf photos: not kept at all. They are processed and discarded.
• Librarian conversations: kept on your phone, not on our servers. They are sent to us only while a reply is being written, and are not stored afterwards. Deleting the App deletes them.
• Your library, lists, wishlist and scan history: kept for as long as your account exists. When you delete your account they are erased immediately, and removed from our backups within 30 days.
• Analytics data: retained by PostHog under our project's retention settings, and by Google under Firebase's. It is keyed to your user ID, not your name or your books.
• Purchase records: kept for as long as Portuguese tax and accounting law requires, even after account deletion.

Deleting Your Account

You can delete your account from inside the App. Open Settings, scroll to Delete Account, and confirm with Delete Everything. This erases your account, your library, your lists, your wishlist and your scan history from our database, and then deletes your sign-in account. It is permanent and we cannot undo it.

If you would rather not do it yourself, email info@polenworks.com and we will delete the account for you. We will ask you to confirm from the address on the account.

Your Rights

Under the GDPR and Portuguese data protection law you can ask us to: give you a copy of your data, correct anything that is wrong, delete your data, restrict how we use it, send your data to another service, or object to processing we base on legitimate interests — including the profiling described above.

Email info@polenworks.com and we will respond within one month.

If you are not happy with how we have handled your data you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt, or to the authority in the EU country where you live.

Children

The App is not intended for children. You must be at least 13 years old to use it. If you are under 16, you should have your parent or guardian's permission before creating an account.

We do not knowingly collect data from children under 13. If you believe a child has given us their data, email info@polenworks.com and we will delete the account.

Security

Data is sent over encrypted connections and stored in Google Firebase, with database rules that let each account reach only its own data. Access by us is limited to the people who need it. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

If There Is a Data Breach

If personal data is lost, exposed, or accessed by someone who should not have it, we will report it to the CNPD within 72 hours of becoming aware, as the GDPR requires.

If the breach is likely to put your rights or freedoms at serious risk, we will also tell you directly and without undue delay — by email to the address on your account — and explain what happened, what data was involved, and what you should do.

Changes

We may update this policy from time to time. Changes will be posted on this page with an updated date. If a change is significant we will tell you in the App before it takes effect.