Book Vault

Privacy policy

Last updated 12 October 2026.

Book Vault is made by Pikeworks, a sole trader in Northern Ireland. This is what the app keeps, what leaves your phone, and why. The short version: your library lives on your phone, and if you sign in to a Pikeworks account, a private copy of it is kept with it so you can get it back. The app looks books and covers up on Open Library and a book's series on Wikidata, and nothing from your library goes with those look-ups. A Pikeworks account and friends are optional and off until you choose them, and friends only ever see a book you finish and choose to share. There are no adverts, no analytics and no tracking.

What stays on your phone

Your books and your shelves (Want to read, Reading, Paused, Read and Didn't finish), your progress, ratings, thoughts, quotes and tags, your reading dates and re-reads, which copy you own, the covers, the cover photos you take, your settings and your goal for the year are kept in the app's private storage on your phone. Without an account none of it is sent anywhere. Signed in, a private copy is kept with your account for you to bring back, as described under Cloud backup below; it never goes to friends.

If your phone backs up its apps to your Google account or to iCloud, that backup includes this app's data. Google or Apple keep it for you. It isn't sent to me.

Looking books up

Book details and covers come from Open Library, a free public catalogue run by the Internet Archive, a non-profit in the United States. When you search, scan a barcode, open a book you picked from the results, or choose another edition, your phone sends the words you typed, the ISBN or the book's Open Library ID straight to Open Library. It doesn't go through me. Each request carries a line naming the app, its version and its contact address, so Open Library knows who to ask if something goes wrong. Nothing in that line identifies you.

Covers are downloaded from Open Library's cover server (covers.openlibrary.org, which serves them from archive.org) and kept on your phone, so your library works offline. That also happens in the background after an import or a restore, one book at a time, until every book has its cover.

Open Library receives those look-ups and, like any website, your IP address. Nothing from your library is sent with them: not your shelves, ratings, thoughts, quotes, tags or notes.

Book Vault also asks two other catalogues, so that a new book can be found. Libris, run by the National Library of Sweden, receives the words you search for and any ISBN, each time. Google Books, run by Google, receives them only when Open Library doesn't have that book with a cover. Your phone sends these straight to them, not through me, and each receives your IP address, as any website does.

A cover from Google Books isn't kept on your phone: it is fetched from Google each time it's shown, so that book shows a plain cover when you're offline. Its description is shown while you add the book and isn't saved. If other readers can see a book with a Google cover, their phones fetch it from Google too.

New from your authors. Once a week, when you open the app, it asks Open Library and Libris for new books by up to 12 authors you have finished or want to read, and asks Wikidata about up to 3 series you are reading. Google Books is asked only about a new book they found, or if neither knows the author. They receive those names and titles and your IP address, and nothing else from your library. Turn it off in Settings, under New books, and none of this is sent.

Which series a book is in, and the other books in it, come from Wikidata, a free public knowledge base run by the Wikimedia Foundation, a non-profit in the United States. When you open a book to add it, or ask for the rest of a book's series, your phone sends that one book's title, its first author and its Open Library ID straight to Wikidata's query service (query.wikidata.org), with the same line naming the app. It doesn't go through me. Wikidata receives the request and, like any website, your IP address. Nothing else from your library goes with it.

The camera and your photos

Book Vault uses the camera for two things, and only when you tap: to read the barcode on a book, and to photograph your own copy to use as its cover. The barcode is read on the phone: on Android by Google's ML Kit, which runs on the device, and on iPhone by Apple's own camera framework. The only thing that leaves the phone after a scan is the ISBN, sent to Open Library as described above.

On Android, when the scanner is used, ML Kit sends Google some technical details: the phone's model and Android version, the app's name and version, a random number for this installation, and how well the scanner worked. Google uses them to keep ML Kit working and to measure how it's used. They don't include what you scanned.

Cover photos you take are kept in the app's private storage on the phone and, if you're signed in, in your private cloud copy too, and nowhere else. If you choose a photo instead, the phone's own photo picker opens and the app only sees the one you pick.

Importing from Goodreads or The StoryGraph

The export file you pick is read on your phone. Nothing in it is uploaded anywhere. Once the books are in, their covers are looked up on Open Library by ISBN, as described above.

Backups and spreadsheets

A backup file or a spreadsheet (CSV) export is only made when you tap to make one, and it goes wherever you choose to send it. A backup includes the cover photos you took.

Sharing a book or a year

The Share button on a book or on your year makes a picture or a line of text on your phone and hands it to your phone's own share menu. It goes only where you send it.

Your Pikeworks account, if you make one

You don't need an account to use Book Vault. Without one, everything stays on your phone and the app works fully. A Pikeworks account is one sign-in for every Vault app, and you choose whether to make one, in Settings.

If you make one, the Pikeworks account service keeps:

• the email address you sign in with, if you use one, stored encrypted, with a scrambled copy so it can be found when you sign in;
• if you sign in with Google or Apple, the account number they give me, and with Apple a token I keep only so I can tell Apple when you delete your account. If you use Apple's Hide My Email, I only ever see the hidden address;
• your password, if you set one, scrambled so it can't be read back, not even by me;
• the public half of any passkey you make (the private half never leaves your phone);
• which phones and apps are signed in: the app, the kind of phone, and when each was last used;
• a short security log of sign-ins and changes to the account, which for 30 days also holds a scrambled tag made from your internet address, to slow down anyone guessing passwords.

I use these only to run the account you asked for and to keep it secure. Keeping it secure is a legitimate interest; running it is what you asked me to do. I never sell any of it, never use it for marketing, and never send you anything but sign-in codes and notices about your own account, such as a new way in being added.

Who handles it for me: Cloudflare runs the service and stores it in the European Union. Sign-in codes and notices are sent by Resend, which keeps the messages it sends in the United States under its data processing agreement, protected by the standard contractual clauses and the UK's addendum to them, and by Cloudflare's own email service. Cloudflare and Resend are companies in the United States.

How long I keep it: for as long as you have the account. A phone that hasn't used it for 18 months is signed out. If nobody signs in to the account for 24 months, I email you once, and delete it 30 days later unless you sign in. The security log is kept for 12 months. When you delete the account, everything above goes at once, and it is gone from my backups within 30 days.

Deleting it: in any Vault app, open Settings, then Pikeworks account, then Delete account. You can also do it on the web, from pikeworks.co.uk/delete-account, or by emailing bookvault@pikeworks.co.uk. Your entries on your phone stay where they are.

Your rights: you can ask for a copy of what the account holds, ask for it to be corrected or deleted, or object to how it's used, by emailing bookvault@pikeworks.co.uk. Where the account has an email address, the copy is sent to that address as a file, so it only reaches you. I reply within a month. If you want to complain about how I handle your information, write to the same address: I'll say within 30 days that I have it, and what happens next. If you're still unhappy, you can go to the Information Commissioner's Office at ico.org.uk.

The account isn't for anyone under 13.

Cloud backup, while you're signed in

While you're signed in to your Pikeworks account, Book Vault keeps a copy of everything you've logged in it with your account, so you can get it back on a new phone or have it on another one. The copy is the same as Book Vault's own backup file: everything you've logged, with any photos. It's saved by itself a minute or so after you change something, and only while you're signed in. Signed out, nothing is saved.

Only you can reach it: the copy is read only by Book Vault, signed in to your account. I don't look at it or use it for anything else, and it never goes to friends. Cloudflare stores it for me in the European Union, in storage that isn't public. Cloudflare is a company in the United States.

One copy is kept, the newest. On a new phone, Book Vault offers to bring it back when you sign in; what's on that phone stays, and the copy is added to it. If you use two phones, each adds the other's entries before it saves.

Deleting it: in Book Vault, open Settings and use Delete the cloud copy. Everything on your phone stays. Deleting your Pikeworks account deletes every app's copy at once. Either way it's gone straight away; I keep no other copy of it.

Social, if you sign in

Social is optional and needs a Pikeworks account. Your library works exactly the same without one. Signed in, you choose a handle, you agree to the community rules, and you choose who sees your books:

• Public: anyone signed in to Book Vault can find you by your handle or name, follow you, and see your shelves, stars and reviews. You can appear on the Community page.
• Followers only: you say yes to each follower. Only they and your friends see your books. Someone can still find your handle and ask to follow you, and sees only your name, handle and what you wrote about yourself until you say yes.
• Private: nobody sees your books, friends included. What you shared stays hidden until you change it back.

I never make you public without you saying so. Friends are people you follow who follow you back, and anyone you're already friends with in another Vault. A follow in Book Vault doesn't make anyone your friend in another Vault, and nothing from your other Vaults shows here.

What other readers see

Whoever can see your books sees, with nothing else to turn on: the books on your Want to read, Reading, Paused, Read and Didn't finish shelves, with the title, the first author, the cover from the catalogue, your stars, how far through you are, the page count and the dates you started and finished. What you start, finish, rate and add to Want to read also shows in their feed, and so does a review you write.

They never see your thoughts, your quotes, your tags, which copy you own or where it came from, your buy list, your goal, a photo you took of your own copy, or the books in your collection marked "No plans yet". Any book can be kept from everyone on its page. That takes it off the service, along with your posts and review about it and any replies to them. Taking a book out of your library does the same.

Importing or restoring books updates your shelves but never posts to anyone's feed.

The service keeps:

• your handle, and a display name if you add one. Your picture is drawn from a random pattern; you can't upload one;
• your invite code, which version of the community rules you agreed to, who can see your books, what you wrote about yourself, whether messages are on and that you said you are 18 or over, whether you want a notice when someone you follow posts, and which app gets notices about friend requests;
• your friends, who you follow and who follows you, the requests you've sent and received, and the people you've blocked;
• your shelves, as described above;
• books you recommend to friends and they recommend to you, with any note;
• your private messages, and which ones have been read;
• your posts: the book, your stars, and any words you wrote for other readers;
• the comments and reactions you add;
• notices for you, such as a friend accepting your request or commenting on your post;
• for each phone that gets friends notifications: an identifier that Google's Firebase, or Apple, gives that phone for Book Vault, whether it's Android or iPhone, and the phone's time zone, so notices arrive quietly at night;
• any report you make, and if someone reports something of yours, a copy of what they reported, kept so that deleting it doesn't destroy the evidence;
• a record of anything I do about a report, such as taking something down or switching friends off for an account. If an account is barred from friends for good, I also keep the Google or Apple account number it signed in with and a scrambled fingerprint of its email address (never the address itself), so the same sign-in can't come back to friends on a new account.

Book Vault also keeps a copy of your feed and notices on your phone, so it works without signal. That copy is kept apart from your log, isn't included in your phone's backup or the app's backup file, and is wiped when you sign out.

Who sees what: anyone who can see your books sees your posts. Comments and reactions are seen with the post they're on, by everyone who can see it, so on a public reader's post that can be anyone signed in, who sees your handle, your display name and what you added.

Messages: friends can message each other if both have turned messages on and said they are 18 or over. Messages are text only, can't be edited or unsent, and are stored on the service so they reach the other person. They are not end-to-end encrypted. I don't read them unless someone reports one: a report sends me that message and five either side, and each time I look is recorded. The words never appear in a notification, an email or a log, and aren't kept on your phone. Clearing a conversation clears your side only.

I use all this to run friends, which you asked for when you turned it on, and to keep it safe, which is a legitimate interest. When the law requires me to report something, as it does for anything that puts a child at risk, I do so because of that legal duty. I never sell any of it and never use it for marketing.

Who handles it for me: Cloudflare runs the friends service and stores what it holds, photos included, in the European Union. Notifications go through Google's Firebase Cloud Messaging and, for iPhones, Apple's push service. Each one carries the app's name and one plain line saying who did what, with the title of the post it is about cut to 40 characters, such as "Sam commented on your Neck Oil": never a note, a comment, anything else anyone wrote, or a photo. Where Firebase is used on your phone, it starts only when you turn friends on, with its analytics off. When something is reported, a private Discord channel gets a one-line alert with the kind of report, the app, the reason and a reference number, never a handle or what was written. Cloudflare, Google, Apple and Discord are companies in the United States. Friends never sends email, so Resend, which sends the account's sign-in codes, handles none of it. If something shared puts a child at risk, I report it to the National Crime Agency, as UK law requires, with the details of the account that shared it.

How long I keep it: for as long as you have the account, except where it says otherwise here.

• Notices are kept for 60 days. An answered recommendation is deleted after 90 days.
• If someone you've messaged deletes their account, you keep your copy of that conversation for 30 days, to read or report, and then it is deleted. If you delete yours, they keep theirs the same way, under your old handle.
• A friend request nobody answers lapses after 30 days.
• A phone's notification identifier goes when you sign out on that phone, or when the phone hasn't refreshed it for 30 days.
• When you change your handle, the old one is held for you for 30 days.
• Something taken down for breaking the rules is deleted 30 days later, and its photo straight away.
• Something reported is kept, where nobody in the app can see it, until the report is dealt with, even if it is deleted or its 90 days pass. A report is kept for a year after it is closed, and the record of what I did about it for a year.
• Anything reported because it may put a child at risk is kept until I have looked at it, even if it is deleted. If it is child abuse, I report it to the National Crime Agency, as the law requires, and it is kept for a year from the day I send that report, with what the law calls relevant data about the account that shared it: its posts, comments, photos, fish handed over, sessions and friend connections from the two weeks before. Then it is deleted unless the Agency asks me to keep it longer. The Agency's reference number for my report is kept for five years. If it is not child abuse, it is let go that night.
• A bar from friends for good is kept after the account is deleted, because that is its purpose.

Whatever is deleted is gone from my backups within 30 days.

Block and Report: every post, comment, message, person and request has Block and Report, and so does everything else friends lets someone send you. Blocking someone works in every Vault at once. It ends the friendship and any follows between you, cancels your requests to them, stops messages, and hides your posts, comments, reactions, notices and table rows from each other. They aren't told, and a request from them never reaches you. You can unblock someone under Blocked in Friends; that doesn't bring the friendship back. I read every report myself and aim to do it within a day, and the person you report is never told who reported them. Anything reported as putting a child at risk is hidden straight away, and anything three people report is hidden until I've looked at it. Breaking the rules can mean what you shared is taken down, and friends switched off for your account for 7 days, 30 days or for good; your own log and backups aren't touched.

Deleting it: you can delete any post or comment of yours, and any comment on your own posts, at any time. Deleting your Pikeworks account, as above, deletes everything the service holds about you too: your profile, shelves, follows, friends, requests, blocks, posts, comments, reactions, recommendations, notices and the messages' link to you. Apart from what's kept for the person you messaged as above, your messages go. Reports about you are closed and their copies deleted, apart from anything held because it may put a child at risk. Reports you made stay open, with your account taken off them.

Your rights: the rights described for the account cover friends too. Email bookvault@pikeworks.co.uk to ask for a copy of what friends holds about you, to have it corrected or deleted, or to object to how it's used.

Social isn't for anyone under 13, and messages aren't for anyone under 18.

Feedback you send

Feedback is only sent when you tap Send in the feedback box, which opens from the speech bubble at the top of any screen or from Send feedback in Settings. It contains what you type, and your email address if you choose to give one so I can write back. If you leave its "Send this picture of the screen" switch on, it also carries a picture of the screen as it was when you opened the feedback box, so I can see what you saw; turn the switch off and no picture goes. So I don't have to ask, it also carries the app's version, whether you're on Android or iPhone, and the model of phone. Nothing from your library goes with it: no books, ratings, quotes or notes, and not your account or any identifier.

It goes to the Pikeworks feedback service, which runs on Cloudflare and keeps what you send in the European Union; Cloudflare is a company in the United States. Your IP address is used to stop abuse and is never stored. A copy of the message is posted to a private Discord channel that only I can read, so I see it on my phone straight away; Discord is a company in the United States. Feedback is kept until it has been dealt with, and deleted within six months after that, Discord copy included. You can ask for yours to be deleted sooner using the address below.

The same screen has a link to write me an email instead, which opens your own email app.

Buying a book

Your buy list is part of your library: it stays on your phone and goes in your backups and cloud copy like the rest. Other readers never see it. When you tap Buy, your phone opens the seller's website or app, with the book's ISBN, or its title and author, in the link. To go straight to the book, a book with no ISBN of its own is looked up on the catalogues above at that moment. Nothing about that tap comes to me, and I can't see what you look at or buy. After that you're dealing with the seller, and its own privacy policy applies.

Tips

Everything in Book Vault is free. The only thing to buy is a tip, from the tip jar in Settings, and a tip unlocks nothing. Tips are paid through Google Play or the App Store, so I never see your card details. RevenueCat, a company in the United States, processes the purchase record to confirm it, using a random anonymous ID rather than your name or email address. It isn't told about your Pikeworks account. RevenueCat's policy is at revenuecat.com/privacy.

Rating the app

After you finish a book, the app may ask whether you'd like to rate Book Vault in the store. That prompt is shown by Google or Apple, and anything you write in it goes to them, not to me.

Permissions

Book Vault asks for the camera only when you first tap to scan a barcode, take a photo of a cover or scan a friend's code. It asks to show notifications the first time you open Social signed in, never when it starts, and it doesn't ask for your location or your contacts.

Age

Book Vault isn't aimed at children under 13. A Pikeworks account and Social aren't for anyone under 13, and messages aren't for anyone under 18.

Deleting your information

Uninstalling Book Vault deletes everything it stored on your phone, including your cover photos. Without an account I don't hold a copy of your library. If you were signed in, its cloud copy stays with your account until you delete it in Settings or delete the account. Deleting your Pikeworks account deletes the account, its cloud copy and everything friends holds about you, as described above, and it's gone from my backups within 30 days. Do it in Settings, then Pikeworks account, then Delete account, or on the web from pikeworks.co.uk/delete-account, without installing anything. Deleting the account doesn't touch your library on your phone. To have feedback you sent deleted, email the address below.

Your rights

For your Pikeworks account, its cloud copy, friends and anything you've sent me, you can ask for a copy, ask for it to be corrected or deleted, or object to how it's used, by emailing the address below, and complain to the Information Commissioner's Office at ico.org.uk.

Changes

If this policy changes, the date at the top changes and the new version is posted on this page.

Contact

Email me at bookvault@pikeworks.co.uk.