Legal

Privacy Policy

Last updated 24 October 2026

Nooklet (“we”) is the data controller for the personal data described here. This policy explains what we collect, why, who processes it, and the rights you have over it. Questions any time: support@nooklets.com.

What we collect

Account data: your email address (sign-in and service emails), password (stored only as a hash by our authentication provider), username, display name, and the optional bio and profile photo you add. If you sign in with Google instead, we receive your email address and basic profile details from Google, and there's no password for us to store.
Content you create: reviews and ratings, comments, lists and notes, likes, reposts, follows, your private diary entries, anything you write for Features or send us when asking to write there, and any reports you file about content. When you bring a history across from another service, the file you choose is read in your own browser, and only the entries themselves reach us.
Notifications, if you switch them on: turning notifications on in a browser gives us the delivery address that browser's notification service issues, along with the keys needed to use it. We keep those to reach that one browser and nothing else, and turning notifications off there deletes them.
Technical data: your IP address and basic request data, used for security, abuse-prevention limits and error diagnosis; anonymous, cookieless page-view analytics (no advertising, no cross-site tracking, no profile built about you); and error reports that may include your IP and browser details when something breaks.

We don't collect more than this, and we don't buy data about you from anyone.

What's public

Nooklet is a social review platform, so what you post is meant to be read. Your reviews and comments appear on the page for the thing you reviewed, and on the feed, where anyone can read them, including visitors without an account. A review can also be quoted on the home page with your name and handle once it is a day old, unless it is marked as a spoiler or someone has reported it. Sharing a review gives that link a preview card showing your score, your name and an excerpt. Reviews you mark as containing spoilers keep their text out of those previews.

A piece published in Features is public in the same way, under your name, and search engines can index it. While it is still a draft or waiting to be read, only you and the person reviewing it can open it.

Your diary is private, always. The dates you log, the notes you keep there and the score you give something privately are shown to nobody else, and a private score never counts towards the public score on an item.

Your Nook is public to read. Anyone with its link can open it without an account and see your name, handle, bio and photo, your reviews, how you score on each shelf, and your public lists. A shared link to your Nook shows a preview card with your average score and your four highest-rated titles. We keep Nooks and lists out of search engines, so nobody can find yours by searching your name. Looking people up by name or handle still needs an account, and so does opening the lists of who you follow and who follows you. Private lists stay private to you. Your Nookbook, the yearly read of your own taste, is yours alone: nobody else can open it, and the only way to share any of it is to save a card and post it yourself. Your email address is never public.

After a member posts a review, we may suggest other members who reviewed the same thing and scored it within a point of them, so your name, photo, your score for that title and how closely your scores agree on titles you have both reviewed can be shown, with a Follow button, to a signed-in member who reviewed it too.

How we use your data

To run the service: your account, your Nook, the feed, search and notifications.
To personalise: recommendations are built from your own reviews, diary, likes, reposts and follows, and from anything you ask to see less of.
To keep Nooklet safe: sign-in protection, rate limiting, bot checks, and handling reports and moderation.
To communicate: transactional email only, such as confirming your address and resetting your password. No marketing lists.
To tell you what happened on your account: notifications in the app, and on your device if you asked for them there.

Legal bases (GDPR)

Where the GDPR applies, we process your data: to provide the service you signed up for (contract: account, content, emails); for our legitimate interests in keeping the service secure, preventing abuse, fixing errors and understanding aggregate usage (security logs, rate limiting, error monitoring, cookieless analytics); and with your consent where required, which you can withdraw.

Who processes your data

We use a small set of providers to run Nooklet. Most handle data on our behalf; Google and Have I Been Pwned are services we call out to, and only when you use the feature named:

Supabase: database, authentication and file storage; hosted in Sydney, Australia.
Vercel: application hosting, content delivery, and cookieless analytics.
Sentry: error monitoring.
Upstash: short-lived counters for rate limiting.
Cloudflare Turnstile: bot protection on sign-up, sign-in and password reset; Cloudflare may process technical signals from your browser to tell humans from bots.
Resend: sending transactional email, and the alert we send ourselves when someone files a report. That alert carries the kind of content, the reason and any note, never who filed it.
Your browser's notification service: Google, Apple, Mozilla or Microsoft, depending on the browser, and only if you turn notifications on. We send an empty message that wakes Nooklet on your device, and the app then fetches the wording from us, so whoever delivers it never sees what the notification says.
Google: only if you choose to sign in with Google, which tells us your email address and basic profile details.
Have I Been Pwned: checking a new password against known breaches, so you don't pick one that's already public. Only the first five characters of a one-way hash of the password are sent, padded so the request can't be read back. The password itself never leaves.

Item information (titles, artwork, descriptions) is supplied by TMDB, IGDB, MusicBrainz, the Cover Art Archive and Google Books. We copy artwork into our own storage the first time an item is imported and serve it from there, so browsing normally tells those services nothing about you. Some older items still load their artwork from the original source, which sees your IP address like any image host would.

International transfers

Your account data lives in Australia (Sydney). Some providers above (for example hosting, analytics, error monitoring, email and notification delivery) process limited technical data in other countries, including the United States, under their standard data-protection safeguards such as the EU Standard Contractual Clauses.

How long we keep things

Account and content: until you delete them or your account.
Rate-limit counters: expire automatically within minutes to hours.
Error reports and security logs: kept for up to 90 days.
Notification addresses: until you turn notifications off in that browser, or its notification service tells us the address is dead.
Moderation records: reports may be kept after the reported content is removed, for as long as needed to keep the service safe and meet legal obligations.
Backups: deleted data can persist in encrypted backups for a short period before those backups age out.

Your rights and controls

Built into the product: edit your profile in settings, export your data (one file holding your profile, reviews, comments, lists, diary, Features pieces, any request to write for Features and the browsers you turned notifications on in, plus your reviews, diary and lists as spreadsheets), and delete your account, which permanently removes your profile and content, any published Features pieces included. If you want something that file doesn't cover, ask and we'll send it. Under the GDPR (and similar laws) you also have rights to access, rectification, erasure, restriction, portability and objection: email support@nooklets.com and we'll respond within a month. You can also complain to your data-protection authority, in Australia the OAIC, or your local authority in the EU/UK.

Cookies

We use the essential cookies that keep you signed in, and two that simply remember choices you made here: your theme (light or dark) and whether the sidebar is collapsed. If you close the prompt to install Nooklet as an app, your browser's storage remembers that so it stays closed. Nothing tracks you across sites, and our analytics are cookieless, so there's no consent banner. There's nothing to consent to. Your browser also keeps one page from Nooklet, a short “you're offline” notice, so a lost connection shows that instead of an error. If you install Nooklet as an app, it keeps a little more so it opens quickly and can receive the notifications you asked for.

Children

Nooklet isn't intended for anyone under 13, or under the minimum age of digital consent where you live. If you believe a child is using Nooklet, contact us and we'll remove the account.

Changes

We may update this policy as the service evolves; we'll update the date above, and flag material changes on the site.

Contact

Privacy questions or requests: support@nooklets.com.