Legal

Privacy Policy

Last updated 21 August 2026

Nooklet (“we”) is the data controller for the personal data described here. This policy explains what we collect, why, who processes it, and the rights you have over it. Questions any time: support@nooklets.com.

What we collect

Account data: your email address (sign-in and service emails), password (stored only as a hash by our authentication provider), username, display name, and the optional bio and profile photo you add. If you sign in with Google instead, we receive your email address and basic profile details from Google, and there's no password for us to store.
Content you create: reviews and ratings, comments, lists and notes, likes, reposts, follows, and any reports you file about content.
Waitlist: Nooklet has launched and the waitlist is closed, so there's nothing new to join. If you signed up before launch, we still hold the email address you gave and the site you entered it on. Ask us and we'll delete it.
Technical data: your IP address and basic request data, used for security, abuse-prevention limits and error diagnosis; anonymous, cookieless page-view analytics (no advertising, no cross-site tracking, no profile built about you); and error reports that may include your IP and browser details when something breaks.

We don't collect more than this, and we don't buy data about you from anyone.

What's public

Nooklet is a social review platform, so what you post is meant to be read. Your reviews and comments appear on the page for the thing you reviewed, and on the feed, where anyone can read them, including visitors without an account. Sharing a review gives that link a preview card showing your score, your name and an excerpt. Reviews you mark as containing spoilers keep their text out of those previews.

Your profile and your lists currently need an account to view, and so does finding people by name or handle. Private lists stay private to you. Your Nookbook, the yearly read of your own taste, is yours alone: nobody else can open it, and the only way to share any of it is to save a card and post it yourself. Your email address is never public.

How we use your data

To run the service: your account, your Nook, the feed, search and notifications.
To personalise: recommendations are computed from your own reviews and follows.
To keep Nooklet safe: sign-in protection, rate limiting, bot checks, and handling reports and moderation.
To communicate: transactional email only, such as confirming your address and resetting your password. No marketing lists.

Legal bases (GDPR)

Where the GDPR applies, we process your data: to provide the service you signed up for (contract: account, content, emails); for our legitimate interests in keeping the service secure, preventing abuse, fixing errors and understanding aggregate usage (security logs, rate limiting, error monitoring, cookieless analytics); and with your consent where required, which you can withdraw.

Who processes your data

We use a small set of providers to run Nooklet. Most handle data on our behalf; Google and Have I Been Pwned are services we call out to, and only when you use the feature named:

Supabase: database, authentication and file storage; hosted in Sydney, Australia.
Vercel: application hosting, content delivery, and cookieless analytics.
Sentry: error monitoring.
Upstash: short-lived counters for rate limiting.
Cloudflare Turnstile: bot protection on sign-up, sign-in and password reset; Cloudflare may process technical signals from your browser to tell humans from bots.
Resend: sending transactional email.
Google: only if you choose to sign in with Google, which tells us your email address and basic profile details.
Have I Been Pwned: checking a new password against known breaches, so you don't pick one that's already public. Only the first five characters of a one-way hash of the password are sent, padded so the request can't be read back. The password itself never leaves.

Item information (titles, artwork, descriptions) is supplied by TMDB, IGDB, MusicBrainz, the Cover Art Archive and Google Books. We copy artwork into our own storage the first time an item is imported and serve it from there, so browsing normally tells those services nothing about you. Some older items still load their artwork from the original source, which sees your IP address like any image host would.

International transfers

Your account data lives in Australia (Sydney). Some providers above (for example hosting, analytics, error monitoring and email) process limited technical data in other countries, including the United States, under their standard data-protection safeguards such as the EU Standard Contractual Clauses.

How long we keep things

Account and content: until you delete them or your account.
Rate-limit counters: expire automatically within minutes to hours.
Error reports and security logs: kept for around 90 days.
Waitlist emails: held from before launch, and deleted whenever you ask.
Moderation records: reports may be kept after the reported content is removed, for as long as needed to keep the service safe and meet legal obligations.
Backups: deleted data can persist in encrypted backups for a short period before those backups age out.

Your rights and controls

Built into the product: edit your profile in settings, export your data as a file, and delete your account, which permanently removes your profile and content. Under the GDPR (and similar laws) you also have rights to access, rectification, erasure, restriction, portability and objection: email support@nooklets.com and we'll respond within a month. You can also complain to your data-protection authority, in Australia the OAIC, or your local authority in the EU/UK.

Cookies

We use the essential cookies that keep you signed in, and two that simply remember choices you made here: your theme (light or dark) and whether the sidebar is collapsed. A third lasts ten seconds and carries the sign-up animation from the button you clicked to the page it opens, then expires on its own. Nothing tracks you across sites, and our analytics are cookieless, so there's no consent banner. There's nothing to consent to.

Children

Nooklet isn't intended for anyone under 13, or under the minimum age of digital consent where you live. If you believe a child is using Nooklet, contact us and we'll remove the account.

Changes

We may update this policy as the service evolves; we'll update the date above, and flag material changes on the site.

Contact

Privacy questions or requests: support@nooklets.com.