Privacy policy
What happens to your data on this website and in the readme app. Last updated 11 October 2026.
Who is responsible
Raphael Lubaschewski, Kämmererstraße 5, 67346 Speyer, Germany, readme-app@web.de. Full details are in the imprint.
This policy covers this website (readme-app.net), the readme web app (app.readme-app.net) and the readme Android app.
This website
Hosting and server logs
The website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Pages). When you open a page, the host's servers record technical data: your IP address, the date and time, the page requested, the referring page and your browser's user agent. This is needed to deliver the site and keep it secure (Art. 6 (1) (f) GDPR). We do not keep these logs ourselves; Cloudflare stores them only as long as needed for these purposes and then deletes them, as described in its privacy policy.
No tracking, no cookies
The website uses no analytics, no tracking and no cookies, and loads nothing from other servers: fonts and images come from the same host. If you switch between light and dark, your choice is saved in your browser's local storage and never sent anywhere (§ 25 (2) no. 2 TDDDG).
The readme app
Your account
To use readme you create an account with an email address, a password and a display name. Passwords are stored only as a hash. We use this data to provide the service you signed up for (Art. 6 (1) (b) GDPR).
What you add
readme stores what you put into it: your lists and the books on them, reading sessions and progress, ratings and notes, quotes, tier lists and favorites, posts, comments and likes, challenges, the people you follow, and images you upload (profile picture, custom covers, home background). If you import a Goodreads export, the CSV file is uploaded so it can be processed. All of this is stored to provide the service (Art. 6 (1) (b) GDPR).
Who can see it
Your display name and profile picture are visible to other signed-in users, so they can find you. Your library, stats and posts are visible to the people you have accepted as followers. Following always needs your consent.
Service providers
These providers help run the app and process data on our behalf, under data processing agreements:
- Supabase (Supabase, Inc., USA) for the database, accounts, file storage and server functions. Data is stored in the EU (Frankfurt, Germany). Supabase records technical request data, including your IP address, in server logs to run and secure the service (Art. 6 (1) (f) GDPR); these logs are deleted after 1 day.
- Cloudflare Pages (Cloudflare, Inc., USA) to deliver the web app, with server logs as described above.
- Cloudflare Turnstile (Cloudflare, Inc., USA) to tell people from bots when you sign up or sign in. Turnstile processes your IP address and technical browser data (Art. 6 (1) (f) GDPR: protection against abuse).
- Firebase Cloud Messaging (Google Ireland Ltd. / Google LLC) to deliver push notifications in the Android app, only if you allow notifications. It processes a device token and the notification's text (Art. 6 (1) (a) GDPR). You can turn notifications off in your phone's settings at any time.
Where data reaches the USA, the transfer relies on the EU–US Data Privacy Framework or the EU standard contractual clauses.
Book data
When you search for books, the search goes from our server to Google Books and Wikidata, so your IP address is not passed on. Book covers and author details, however, are loaded by your browser directly from Google Books (books.google.com) and Open Library (openlibrary.org, run by the Internet Archive, USA), which receive your IP address in the process (Art. 6 (1) (f) GDPR: showing book information).
Stored on your device
The app keeps your sign-in session, your settings (theme, accent color) and a cache of book data in your browser's local storage. This is strictly necessary for the app to work (§ 25 (2) no. 2 TDDDG).
How long data is kept
Your data is kept as long as you have an account. When your account is deleted, everything you added is deleted with it. You can delete your account at any time in the app's settings.
Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where you gave consent, you can withdraw it at any time (Art. 7 (3)). To use any of these rights, email readme-app@web.de.
You can also complain to a data protection authority, for example the one responsible for us: the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz.