Legal

Privacy Policy

Effective date: April 4, 2026 · Last updated: April 4, 2026

Summary: We collect only what we need to run Ex Libris Omnium. We do not sell your personal data. EU/EEA users have full GDPR rights. You can request deletion of your account and data at any time by emailing privacy@exlibrisomnium.com.

1. Who We Are

Ex Libris Omnium ("we", "us", "our") is a book community platform that lets you manage your personal library, discover books, connect with other readers, lend and borrow books, and buy and sell books peer-to-peer. This Privacy Policy explains what personal data we collect, why we collect it, and your rights regarding it.

For privacy-related inquiries contact us at: privacy@exlibrisomnium.com

2. Data We Collect

Account & Profile Data

Email address (used for login and transactional emails)
Display name / username chosen by you
Profile bio and avatar image (optional, user-provided)

Library & Reading Data

Books you add to your library and their read status (read, reading, want to read)
Ratings, reviews, and reading journal entries you write
Reading goals and statistics (pages read, books finished, streaks)
Custom shelves and book tags you create
Book club memberships and poll participation

Social & Marketplace Data

Friend connections and follow relationships
Book loan requests you send or receive
Marketplace listings you create (book title, condition, asking price)
Messages or notes exchanged as part of a marketplace transaction

Technical Data

Authentication tokens stored in your browser (via Supabase Auth)
Basic error and usage logs retained for up to 30 days

We do not collect payment card details. Any peer-to-peer payments for marketplace transactions are arranged directly between buyers and sellers outside our platform; we are not a party to those payment flows.

3. How We Use Your Data

Providing the service — running your library, feed, marketplace listings, and loans
Account authentication — verifying your identity on each login
Transactional emails — sending cover-review notifications, loan requests, and marketplace activity emails via Resend
Book metadata enrichment — looking up cover images, descriptions, and ISBNs via Google Books and Open Library APIs using your book's title/author (no personal data is shared with these APIs)
Service improvement — aggregated, anonymised analytics to understand feature usage

We do not use your data for advertising, profiling for third-party marketing, or automated individual decision-making.

4. Legal Bases for Processing (GDPR)

For users in the EU / EEA, our legal bases for processing personal data are:

Contract performance (Art. 6(1)(b)) — processing necessary to provide the service you signed up for
Legitimate interests (Art. 6(1)(f)) — security logging, fraud prevention, service improvement
Consent (Art. 6(1)(a)) — optional features such as public profile visibility; you may withdraw consent at any time
Legal obligation (Art. 6(1)(c)) — where we are required by law to retain records

5. Third-Party Services

We use the following sub-processors:

Supabase (database, authentication, file storage) — data may be stored on servers in the US and EU. Supabase is compliant with GDPR. Supabase Privacy Policy
Resend (transactional email) — your email address is transmitted to Resend only to deliver emails you have triggered. Resend Privacy Policy
Google Books API — used server-side to look up book metadata. No personal data is sent; only book titles and ISBNs.
Open Library (Internet Archive) — used to fetch public-domain book cover images. No personal data is sent.

We do not share your personal data with any other third parties.

6. Cookies & Local Storage

We use a single authentication session cookie set by Supabase to keep you logged in. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. Local storage may be used to cache non-personal preferences such as theme (light/dark mode).

7. Data Retention

Account and library data is retained for as long as your account is active
Deleted reviews, journal entries, or listings are removed immediately
On account deletion we permanently erase all personal data within 30 days
Anonymised aggregate statistics may be retained indefinitely

8. Your Rights (GDPR & Equivalent)

Depending on your jurisdiction, you have the right to:

Access — request a copy of all personal data we hold about you
Rectification — ask us to correct inaccurate data
Erasure ("right to be forgotten") — request deletion of your account and all associated personal data
Restriction — ask us to pause processing while a dispute is resolved
Portability — receive your library data in a machine-readable format
Object — object to processing based on legitimate interests
Withdraw consent — withdraw consent for any consent-based processing at any time without affecting prior processing

To exercise any of these rights, email privacy@exlibrisomnium.com. We will respond within 30 days. If you are in the EU/EEA and believe we have not handled your request properly, you have the right to lodge a complaint with your national supervisory authority.

9. Children's Privacy

Ex Libris Omnium is not directed at children under 13 (or under 16 where required by local law). We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us and we will delete it promptly.

10. Security

All data is transmitted over HTTPS/TLS. Passwords are never stored — we use Supabase Auth's secure, salted token system. Database access is governed by Row-Level Security (RLS) policies that ensure users can only access their own data. Despite these measures, no system is 100% secure and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via a banner on the app or by email. The "last updated" date at the top of this page will always reflect the most recent version. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact

For any questions about this Privacy Policy or to exercise your data rights: privacy@exlibrisomnium.com