Privacy policy

OLK is run by Owais Saleem, who is responsible for your data (the “controller” under the EU's General Data Protection Regulation, GDPR). For anything about your data, including requests to see or delete it, email osaleem.kash@proton.me.

Postal address: Owais Saleem, Straßburger Straße, 22049 Hamburg, Germany.

Your account. Your email address and password. The password is stored only as a secure hash, and nobody at OLK can read it. We record which version of the terms of use you accepted when you signed up. We also keep a record of sign-ins (time, IP address and device type), which the sign-in service uses to spot abuse.

Your profile. Your display name, and if you choose to add them: your area, a short bio, and your location. The location is only taken when you ask for it, and it is rounded to roughly 1 km before it is saved. We never store your exact position. It is used only to show how far away books, clubs and events are. We also store whether you want the weekly email digest and when you were last active.

What you do on OLK. The books you list, including photos you upload, the requests you send and receive, messages with other members about an exchange, reading progress, ratings, saved books, your wishlist, notes about books, club memberships, club posts, events you create or attend, reports you file, members you block, and your conversations with the OLK team through Contact Admin. We also keep the notifications we send you.

Moderation. If you break the terms of use, we keep a record of warnings, suspensions, reports against you or your listings and moderators' notes.

If you apply to join the team. Your name, age, email, phone number, profession, studies, the area you want to help with, your answers, and your CV. The application is stored and also emailed to the team inbox.

If you ask to start a club. The details on the request form. We then ask for a proof of identity and a CV by email. They are never uploaded to the site, and are used only to decide on the request.

Technical data. Your IP address is used briefly to limit how many requests one address can make, which protects the site from abuse. It is held in memory and not saved with your account. When something breaks, an error report (what failed, your browser or device type, the page) is sent to our error-tracking service. It does not include screen recordings or what you typed.

• We don't sell your data or share it with advertisers.
• We don't show ads.
• We don't use analytics or tracking cookies. The only cookies keep you signed in.
• The Android app contains no advertising or analytics code.

• Anyone, including visitors who aren't signed in: your book listings and their photos, and your display name, area and bio.
• Signed-in members: your profile, ratings you have received, and roughly how far away your books are (never where you are).
• The other member in an exchange: your messages about that exchange.
• Club members: your posts in that club's chat.
• OLK admins can see what they need to handle reports, abuse and support requests: profiles, listings, requests, reports, club and event details, and your Contact Admin conversations.
• Only Owais Saleem, who runs OLK, can also read private messages about an exchange, club chats and your saved location, for example to look into a serious report. Your email address is visible only to you and to the OLK team.

If you block a member, only you can see that you did.

We use your data to run the service you signed up for: showing and exchanging books, messages, clubs, events and notifications. We use it to keep the community safe (limits, reports, blocking, suspensions) and to answer you when you contact us. The weekly digest of new books is on when you join, and you can switch it off on your profile at any time. Your location is used only with your permission, and you can remove it whenever you like.

The legal bases for this under the GDPR:

• Providing the service you signed up for (Art. 6(1)(b)): your account, profile, books, requests, messages, clubs, events and notifications.
• Your consent (Art. 6(1)(a)): your location, and a team application. You can withdraw it at any time.
• Our legitimate interest in a safe, working service (Art. 6(1)(f)): limits against abuse, reports, blocking, moderation, error reports and the weekly digest.

• Supabase: database, sign-in and photo storage. Servers in Mumbai, India.
• Vercel: hosts the website. The site's server code runs in Mumbai, India.
• Resend: sends our emails (confirmations, password resets, notifications, the digest). It receives your email address and the text of the email.
• Sentry: error reports, stored in Germany (EU).
• Open Library (Internet Archive): when you look up a book by its ISBN, your device asks Open Library for the details, and some book covers are loaded from there. Open Library sees the ISBN and your IP address. OLK is not affiliated with the Internet Archive.

Because these services are in different countries, your data may be handled outside the country you live in. For data sent from the EU to India or the United States, Supabase, Resend and Sentry process it under their data processing agreements, which include the European Commission's standard contractual clauses. Vercel hosts the website under its standard terms: OLK uses Vercel's free plan, for which Vercel does not offer a data processing agreement. We will move to a plan that includes one as OLK grows.

• Camera: only when you scan a book's barcode or take a photo of a book.
• Approximate location: only when you tap to share your location on your profile. The app never asks for your precise location.
• Photos and files: through Android's own picker, so the app only sees the photo or file you choose.

We keep your data for as long as you have an account. When you delete your account, it is deleted straight away, together with your books, photos, requests, messages, club posts and everything else tied to it. Two kinds of data stay, without your name attached: ratings you gave other members, so their scores stay fair, and reports you filed, so moderators keep the evidence. How to delete your account.

Team applications and the club verification emails are kept while we consider them. Ask us and we will delete them. Error reports are deleted automatically by Sentry after a limited time.

You can see and change most of your data yourself, on your profile and on the pages where you created it. You can also ask us, at the email above, for a copy of the data we hold about you (also in a machine-readable form, to take elsewhere), to correct it, to delete it, to limit how we use it, or to stop using it for something. Where we rely on your consent, you can withdraw it at any time. You can also complain to the data protection authority where you live. We'll answer within 30 days.

You must be at least 18 to use OLK, and you confirm this when you create an account. If we learn that an account belongs to someone younger, we will delete it. If you think someone under 18 has an account, please email us.

If we change what we collect or how we use it, we'll update this page and its date. Big changes will be announced on the site.