Privacy Policy

1. Who we are

nookd is operated by Nova Hawk Labs LLC, a Texas series limited liability company, 1122 Colorado St, Unit 1410, Austin, TX 78701. This policy covers nookd.us and the nookd app. Questions, requests, and complaints go to privacy@nookd.us.

2. We collect user data

Using nookd means we collect the following about you.

• Account data. Your email address, display name, username, and password hash. If you sign in with Google, we receive your email, name, and profile photo URL from Google instead of a password.
• Content you create. The books in your library, shelves and collections, reading sessions and progress, ratings, notes, streaks and achievements, loans, community posts and comments, friend connections, and invitations you send.
• Files you upload. Profile photos and custom book covers.
• Technical and log data. IP address, browser and device type, pages requested, timestamps, and error diagnostics captured when something breaks.

We do not collect payment details, precise location, biometric identifiers, or government identifiers.

3. Some of what you upload is publicly readable

Profile photos and custom book covers are stored in public storage buckets. Anyone holding the file URL can open the image without signing in, and the URL may be cached by browsers and CDNs. Treat anything you upload as public. Your library, reading activity, and community posts are governed by the sharing settings you choose in the app; a library or community you make visible to friends or to everyone is visible to exactly those people.

4. How we use it

To run your account and the features you ask for, to show your libraries and activity to the people you have chosen to share them with, to send transactional email such as password resets and invitations, to keep the service secure and block abuse, and to diagnose errors. We do not use your data to train machine-learning models, and we do not use it for advertising.

5. Third-party data processors

nookd runs on other companies' infrastructure. These are our sub-processors, what each one receives, and why.

• Supabase (United States) hosts our database, authentication, and file storage. It holds all account data, content, and uploads.
• Vercel (United States) hosts and serves the application. It processes request metadata including IP address.
• Sentry (United States) receives error reports, which can include your user id, the URL you were on, and the technical context of the failure.
• Cloudflare Turnstile receives bot-detection signals from your browser on sign-up and sign-in.
• Google Books API receives the search terms and ISBNs you look up so we can fetch book metadata. It does not receive your identity.

Each of these acts as a service provider or processor on our instructions. We do not authorize them to use your data for their own purposes.

6. We do not sell or share your data

We have never sold personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act and the Texas Data Privacy and Security Act. There is nothing to opt out of, and we honor Global Privacy Control signals as an opt-out request regardless.

7. How long we keep it

Account data and content are kept for as long as your account exists. Error diagnostics are kept for 90 days. When you delete your account, your profile, libraries, books, reading sessions, friendships, community posts, invitations, and every file you uploaded are erased. We may keep a minimal record of the deletion itself, and backups taken before the deletion roll off within 30 days.

8. Your rights, and how to use them

Wherever you live, you can ask us to give you a copy of your data, correct it, or delete it, and we will not treat you differently for asking. Residents of California, Colorado, Connecticut, Texas, Virginia, and other states with comprehensive privacy laws have these rights by statute, along with the right to appeal a refusal.

• Delete everything. Delete your account from your profile settings. It takes effect immediately and cannot be undone.
• Copy, correction, or appeal. Email privacy@nookd.us. We respond within 45 days and will tell you if we need a 45-day extension. If we deny a request you may appeal by replying to our decision, and we will answer the appeal within 60 days.

9. Children under 13

nookd is not directed to children under 13 and we do not knowingly collect personal information from them. You must be 13 or older to create an account. If we learn that an account belongs to a child under 13, we delete it and its uploads. If you are a parent or guardian who believes your child has created an account, email privacy@nookd.us and we will remove it.

10. Security

Traffic is encrypted in transit with TLS and data is encrypted at rest. Access between accounts is enforced in the database with row-level security rather than in the UI alone. No system is perfect, and we do not promise that ours is.

11. Changes to this policy

If we make a material change we will update the date above and give notice in the app before the change takes effect.

12. Contact

Nova Hawk Labs LLC, 1122 Colorado St, Unit 1410, Austin, TX 78701. privacy@nookd.us