Privacy Policy
Last updated 20 September 2026
The short version: we keep the least we can. Your reading list is yours, we don't sell anything about you to anybody, and you can have the lot deleted by asking.
What we collect
Things you give us
- Your account details — a display name, and a password that is stored only as a one-way hash. We never hold your actual password, cannot read it, and cannot send it back to you. If you forget it, contact us and we will set a temporary one for you to change.
- Everything you put on your shelf: books, ratings, chillies, themes, notes, reviews, where you found a book, and who recommended it.
- Anything you post to Community Recs, including replies.
- Cover images and profile pictures you upload.
- Anything you send through the contact form.
Things we collect automatically
- A session cookie that keeps you signed in. It holds no personal information and disappears when you sign out.
- Ordinary web server logs — IP address, browser, pages requested — which exist to keep the site working and to spot abuse.
- Some settings are kept in your browser rather than on our server: which look you chose, whether you prefer covers or a list, and a cached copy of your shelf so the app still shows something when you are offline. Clearing your browser data clears these.
Things we do not collect
No advertising or tracking cookies. No location data — profile pictures have their embedded camera information, including GPS coordinates, stripped on upload. No payment details: there is nothing to buy yet, and when there is, the payment processor will handle card details and we will not see them.
Why we hold it
To run the service: to show you your shelf, keep you signed in, let you share lists with people you choose, and answer you when you write to us. That is the whole of it. We do not build advertising profiles and we do not sell or rent your information.
Reading images and text you send
When you add a book from a screenshot, a photo or a pasted caption, that image or text is sent to Google's Gemini API so it can read the book details out of it. If Gemini can't, the image goes to OCR.space, which reads the text on it. It is sent for that single purpose. We do not keep the image after the reading is done unless you chose to save it as cover art. Google's and OCR.space's own terms apply to that step; on Google's free tier, Google may use what is sent to improve its services, so avoid screenshots with private details in them. Barcodes are read on your own device and never sent anywhere.
Who else sees it
- People you deliberately share with. A shared shelf link shows only the books you ticked. Your notes, and who recommended each book, are stripped out on the server before the page is built — they are not merely hidden.
- Other members, if sharing is on. While your shelf is shared you appear in Discover: signed-in members can see your name, your bingo card and your MyTBR list, with your reviews of those books. Your Read books (and your reviews of them) are counted, without your name, in other members' recommendations. A member who adds one of these books keeps a copy of the review that came with it. The live ticker at the top of the shelf also shows other members what you just did — books added to your MyTBR, books finished, bingo updates, buddy reads started and when you joined. Turn sharing off and all of that stops, ticker included. The books you tick on the Share sheet only decide what's on your public link.
- People in your buddy reads. Whoever starts or joins a buddy read with you sees the book, your name, your progress and your check-in line. Leaving the buddy read takes you off it.
- Everyone, if you post to Community Recs. That board is public to members. Treat anything you write there as public.
- Book databases. Titles and authors are sent to Google Books and Open Library to fill in covers and details. They receive the search, not your identity.
- Our web host, which stores the files, and our email provider, which carries reset and contact messages.
We will hand information to law enforcement only where the law actually requires it.
How long we keep it
Your shelf stays until you delete it or close your account. Backups are kept for up to 60 days, so deleted material can persist in a snapshot for that long before it ages out. Contact messages are kept for as long as it takes to deal with them.
What you can ask for
- A copy of everything we hold about you.
- A correction of anything wrong.
- Deletion of your account and its contents.
- To take it elsewhere — your shelf exported in a machine readable form.
Ask through the contact page and we will respond within 30 days. You will not be treated differently for asking.
If you are in California, the CCPA gives you these rights explicitly, plus the right not to have your personal information sold. We do not sell it, to anybody, for any purpose.
Age
My To Be Read is for adults only. You must be 18 or older to make an account, and you confirm this when you create one. We do not knowingly collect anything from anybody under 18. If you believe someone under 18 has made an account, tell us through the contact page and we will delete it promptly.
The service covers books written for children, and features people who review them. That is a different thing from being a service for children — the members here are the adults choosing the books.
Keeping it safe
Passwords are hashed, never stored as text. Traffic runs over HTTPS. Uploads are checked and size-limited. We take daily backups.
We will not pretend this is bulletproof — no service can. If we ever discover a breach affecting your information, we will tell you promptly and say plainly what happened.
Changes
If this policy changes in a way that matters, we will say so on the site rather than quietly editing the date. The date at the top always reflects the current version.
Contact
Questions about any of this go through the contact page.