Privacy policy

Parutio is a service for keeping track of book releases. We collect the minimum needed to tell you when your authors publish: an e-mail address, the authors you follow and the books you put in your library. We do not sell or rent any data, and we show no advertising. We measure how much the site is visited, but without any cookie and without attaching those statistics to your account; inside the iOS and Android apps we count a short list of steps, and there the count is attached to your account — a switch in Settings turns it off (article 5).

Three things, since version 1.1.0, no longer stay with you — and none of them switches itself on:

• if you publish a review, it appears on the book’s page under your first name and last initial;
• if it carries text, it is checked before it is published by an automated system;
• if you turn on friend following, the people you gave your code to see your full name, your photo if you added one, and the shelves you choose to show them (articles 3 and 4).

At any time, from your settings, you can take your data with you or delete your account — without writing to us and without giving a reason (article 9).

1. Who is responsible for your data

The controller is Prismatic, société par actions simplifiée (SAS), a French simplified joint-stock company with a share capital of 100 €, whose registered office is at 49 avenue du Raincy, 93250 Villemomble, France, registered under number R.C.S. Bobigny 888 020 112 (see the legal notice).

For any question about your data, and to exercise any of the rights described in articles 9 to 11: privacy@parutio.com. Anything else — support, a mistake in the catalogue, a content report — goes to contact@parutio.com. No data protection officer has been appointed, none being required for the processing described here, and we have not designated a separate representative in the United States or Canada: both addresses reach the people who actually run the Service.

2. What this policy covers

This policy covers the parutio.com website and the iOS and Android apps. It does not cover the bookshop websites the Service links to: as soon as you leave Parutio, the retailer’s own policy applies.

3. What we collect

• Account: e-mail address, internal identifier, creation date, reading languages, display name if you set one. If you sign in with Apple or Google, all we receive is the associated e-mail address (relayed and masked where that is what you chose). Parutio never knows your password: it is held, encrypted, by our authentication provider.
• Profile: first name, last name and, if you add one, a profile photo. All three are optional and the Service works entirely without them; the first and last name become required for two gestures only — publishing a review and turning on friend following — because both show an identity to somebody else. Your full name is never published: a review is signed with your first name and your last initial (“Camille D.”). Only your friends — the people you gave your code to and whose request you accepted — see the whole name. The photo goes with your reviews and represents you to your friends; the file is resized, its metadata (including any location a camera writes into it) are stripped, and it is served from an unguessable but public address with no expiry — whoever holds the address sees the image, until you remove it or delete your account.
• Use of the Service: the authors you follow, the books in your library and their status (owned, want to read, read), with the date they were added; notification preferences.
• Subscription: subscription status, purchase channel (web or app store), the subscription reference at the payment provider, renewal date, trial end date. No card details are processed or stored by Parutio: payments are handled by Stripe on the web, and by Apple or Google in the apps.
• Push notifications: the device notification token and its platform (iOS or Android), only if you turn notifications on.
• Share links: if you turn on sharing of your wish list, a random token is created, along with the first name or display name you choose to show on the page. That page shows only the books marked want to read — never what you own or have read, never your e-mail address — is not indexed by search engines, and the link stops working as soon as you turn sharing off or renew it. The calendar feed included with Premium works the same way: a personal address, to be shared only with whoever you want.
• Reviews and ratings: the rating you give a book (1 to 5), the text you write if you write one, the date, and the state of its check. These are public content: once published they sit on the book’s page, readable by anyone who opens it, account or no account, and the book’s average rating is published in the structured data search engines read. What goes with them is your signature (“Camille D.”) and your photo if you have one: never your e-mail address, never your whole last name, never your account identifier. A rating on its own, with no text, appears immediately; a review carrying text is checked before it is published (article 6).
• Friend following: a friend code — eight random characters, which only you decide to hand out —, the requests sent and received, the friendships accepted, and the per-friend setting of the reading alert. Nobody can find you by your name: the code is the only route, and a request becomes a friendship only if you accept it. Following is on by default on a new account, including one created before the feature existed, and it shows nothing to anyone until you have accepted a friendship. Two settings govern it (Settings › What my friends see): “Friend following” turns it off entirely, “My activity” stops the feed alone, and the feed itself is deleted after 30 days (article 6). Once on, your friends see your full name, your photo, and the shelves you picked out of three — the books you own, the ones you want, the ones you have read. A shelf you do not share is not shown to them empty: it is not sent to them at all.
• Readings and reactions: when you mark a book as read, the date of that marking, and the thumb — liked, did not like — you may attach to it. These exist to tell those of your friends who asked to be told, and nobody else: the thumb appears on no public page and counts towards no average. A reading you date more than seven days back triggers no alert, and unmarking “read” within the hour cancels it.
• Clicks to bookshops: which link was clicked and when. These events are recorded with no account identifier: they exist to check affiliate earnings, not to profile a reader.
• Error reports: the catalogue entry concerned and the boxes you ticked. We keep no message. If you are signed in, your account identifier; otherwise, the app’s installation identifier or, on the website, the parutio_rcid cookie, and as a last resort a keyed hash (HMAC) of your IP address. They serve only to prevent duplicates and abuse. These reports are kept for 3 years; deleting your account erases their link to it.
• Reports on a review: the review concerned, the reason you pick and your account identifier. A report is kept for as long as handling it takes and until the decision that closes it; the review’s author never learns who reported it, and deleting your account deletes your reports.
• Audience measurement on the website: page viewed, referring page, arrival channel (the utm_ parameters of the link you clicked), device and browser type, and the fact that certain steps were reached (sign-up, following an author, adding to the library, search, leaving for a bookshop, friends and reviews, import, seeing the Premium offer, subscribing). These events carry no account identifier, no e-mail address, and not the name of the author or book concerned: they count steps, they do not describe a reader. See article 5.
• Measurement inside the iOS and Android apps: a short, fixed list of product events — the screens viewed, the onboarding steps, an account created or signed in, the answer to the notification prompt, a notification opened, an author or a series followed, a book added to the library, a search result opened, a book scanned (found or not), friend requests and reviews sent, an import started, the Premium offer seen, a purchase started, failed or completed, sharing turned on — and the technical report of a crash. Unlike the website, these events are attached to your account identifier, which is what makes a subscription conversion readable. What never leaves the app is the object: no book title, no author or series name, no ISBN, no search or review text, no content of an imported file, no e-mail address and no advertising identifier. Crash reports carry neither your IP address nor the content of your account. See article 5.
• Technical data: server connection logs (IP address, date, page or request called, browser type) and error reports from the server and the website (Sentry, with no IP address or identity), kept for security and diagnosis. Added to them: the platform (website, iOS or Android) your account was created from, kept with it, and the one a bookshop click came from, kept 25 months with that click.

We process no sensitive data in the sense of article 9 of the GDPR, and none of the categories the California statute calls sensitive personal information, and we ask for none. What you read can of course say a great deal about you: we share with no one, for no advertising purpose, the authors you follow, your library, or what your friends see of it. One point deserves saying plainly: a review you publish is public, and a text about a book can reveal an opinion, a belief or a personal fact you did not mean to make public. What you write there is yours, and you can take it down at any time (article 9).

4. Purposes, legal bases and retention

After your account is deleted, personal data are erased within 30 days, backups included as they rotate, except for the accounting records the law requires us to keep.

5. Cookies, trackers and audience measurement

The site uses no advertising cookie and no third-party tracker. No consent banner is shown: the only cookies set are strictly necessary to run the Service.

• Session cookies (prefix sb-, set by our authentication provider): they keep you signed in from page to page. They disappear when you sign out or when they expire.
• Report cookie (parutio_rcid, 2 years): a random identifier, set only when you report an error on a catalogue entry. It serves to prevent duplicate and abusive reports, and nothing else; it does not identify you.

Audience measurement

We measure how much the site is visited, to know how many people read it, which pages they read and how they arrived. That measurement is carried out by PostHog, on its European infrastructure (Frankfurt, Germany), acting only for us and on our instructions.

It works without any cookie and writes nothing on your device: no identifier is stored in your browser. PostHog recomputes a pseudonymous identifier on the fly from your IP address and your browser, using a secret key that is renewed every day and destroyed the next; your IP address is not kept. From one day to the next you are therefore a new visitor: this measurement cannot follow you over time, or from one site to another.

The resulting statistics are not matched against your account, are passed to no one, and serve no advertising. The events recorded contain neither your e-mail address, nor your account identifier, nor the names of the authors or books you are interested in. The links in our e-mails carry a plain campaign label (utm_ parameters, such as “release alert”) and no identifier. Legal basis: our legitimate interest in knowing the audience of our own site (art. 6.1.f GDPR).

You can object, and nothing about the Service changes if you do. Your browser’s Do Not Track signal is honoured; you can also refuse the measurement right here:

Measurement inside the mobile apps

The mobile apps use no cookie and contain no advertising measurement kit; no advertising identifier is read and nothing is shared with an advertising network. The iOS and Android apps carry our own, and it differs from the website’s on one point that has to be said plainly: it is attached to your account. The events are the short list of article 3 and nothing else — automatic screen capture, automatic interaction capture, session recording and in-app surveys are switched off in the code — and they are sent to the same PostHog European infrastructure, together with the technical report of a crash, which carries no IP address.

Legal basis: our legitimate interest in knowing how our own app is used and in fixing what breaks in it (art. 6.1.f GDPR). These events serve no advertising and are passed to no one. You can object from the app itself: the “Share usage statistics” switch in Settings stops the measurement on that device at once. Deleting your account ends it in any case, and erases at PostHog the events already attached to your account.

6. Who receives your data

Your data are not sold, rented or handed over. They are accessible to authorised people at Prismatic, to the extent needed, and to the following service providers, who act for us and on our instructions alone, under agreements complying with article 28 of the GDPR:

How reviews are checked

A review that carries text is not published straight away: it goes through our content filter first, so that our pages do not carry unlawful, abusive, promotional content, or content aimed at a person. Only the text of the review and its public signature (“Camille D.”) are examined — what is checked is a text, not a person. A rating on its own, with no text, does not go through it and appears immediately.

The outcome is neither final nor closed: article 13 says what you can do about a refusal.

We may also have to disclose data to an administrative or judicial authority where the law requires it.

7. Where your data are stored

Your data are stored in the European Union, whichever country you read from. The website, the API and the database run on a server in Paris, France; the authentication project is hosted in Paris; e-mail is sent from Ireland; audience statistics are held in Frankfurt, Germany, and error reports in Germany. If you live in the United States or in Canada, this means your personal information is transferred to and processed in France and elsewhere in the European Union, where it is protected by the GDPR, and where a public authority may be able to require access to it under the law of that country.

Some of the providers listed above are established outside the European Union, mainly in the United States, and access the data from there. Those transfers are governed by the standard contractual clauses adopted by the European Commission, completed where appropriate by additional technical measures (encryption in transit, minimisation of what is transmitted), or by the provider’s participation in the EU-US Data Privacy Framework.

• Supabase, Inc.: European Commission standard contractual clauses.
• Plus Five Five, Inc. (Resend): European Commission standard contractual clauses.
• Google Ireland Limited: Standard contractual clauses for the processing carried out by Google LLC.
• Stripe Payments Europe, Limited: Standard contractual clauses for the processing carried out by Stripe, Inc..
• RevenueCat, Inc.: European Commission standard contractual clauses.
• PostHog, Inc.: European Commission standard contractual clauses for access from the United States.
• Functional Software, Inc. (Sentry): European Commission standard contractual clauses for access from the United States.

A copy of the safeguards in place can be requested at privacy@parutio.com.

8. Deleting your account

Deletion is directly available from Settings → Delete my account. It is immediate and permanent: your account, the authors you follow, your library, your registered devices and your local subscription record are erased from our database, and the associated authentication account is deleted at our provider.

What version 1.1.0 added goes with the rest, and it has to be said precisely because part of it was public: your reviews and ratings are deleted, not anonymised — they leave the book pages and stop counting towards the average rating; your friendships are deleted on both sides, along with your friend code, your pending requests and the record of which readings your friends were told about; and your profile photo is erased from the server, the file itself, so that the public address which served it leads nowhere.

If you had turned on sharing of your wish list, the token is destroyed with the account and the public page ceases to exist at once.

What remains has no connection to you. Outbound clicks to bookshops are kept in anonymous form, with no account identifier, solely to check affiliate commissions. Error reports you sent us remain for their retention period (3 years) because they fix a catalogue entry, but their link to your account is erased. Accounting records relating to a paid subscription are kept for as long as the law requires.

A subscription bought from Apple or Google has to be cancelled separately with that store: deleting your Parutio account does not stop it.

Before you go, you can take your data with you: see the right to portability in article 9.

9. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, the right to withdraw your consent at any time for the processing that depends on it, and the right to give directions about what happens to your data after your death.

Several of these are exercised on your own, without writing to us and without waiting:

• Portability and access (art. 15 and 20 GDPR): Settings → My data → Export my data immediately downloads a JSON file containing your profile, your preferences, the state of your subscription, the authors you follow, your library, your reviews — with the state of their check —, your friendships and your reading journal, in a structured, machine-readable format. What erasure names, portability returns: the two rights cover the same ground. Of your friends the file carries only the public signature (“Camille D.”): their addresses and identifiers are not yours and are not handed to you.
• Erasure (art. 17): Settings → Delete my account, on the terms described in article 8.
• Rectification (art. 16): e-mail address, password, display name, first name, last name, profile photo and reading languages can all be changed from the settings. Removing the photo erases the file from the server, not just its display.
• Your reviews: each one is edited and deleted from My reviews or from the book’s page. Deleting removes the text, the rating and the signature from the public page at once, and the rating stops counting towards the book’s average.
• Your friends: a friendship is broken at any time, by either side, without the other being told; the reading alert is switched off friend by friend; and turning friend following off closes the whole thing at once — your friends see nothing more and the alerts stop — without destroying either your friendships or your code, both of which you find again if you turn it back on. You can also renew your friend code: the old one then stops working for anyone who wrote it down.
• Objecting to audience measurement (art. 21): directly in article 5 above.
• E-mail: release alerts are switched off in Settings → Emails, or in one click from the unsubscribe link at the bottom of each of those e-mails. The weekly digest is sent only if you have turned it on there, and is switched off the same way. E-mail that is strictly necessary to run the account (sign-in link, contractual information) keeps being sent.
• Push notifications: from your device settings or from the app.
• Wish-list sharing: consent is withdrawn from your library, and the link stops working at once.

For anything else — restriction, objecting to another processing, or simply a question — write to privacy@parutio.com. We answer within one month of receiving the request, extended to three months if the request is complex. Proof of identity may be asked for where there is serious doubt about who is making the request.

If, after contacting us, you believe your rights are not being respected, you may complain to the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr. Readers in the United States and in Canada have the additional routes described in articles 10 and 11.

10. Your U.S. privacy rights

This article is for readers in the United States, and in particular for residents of California, whose Consumer Privacy Act (CCPA, as amended by the CPRA) gives the rights described below. Residents of the other states that have passed a comprehensive privacy law have rights that are substantially the same, and we handle every request the same way wherever it comes from.

What we collect, and why

In the vocabulary of the California statute, the categories of personal information we have collected over the past twelve months are:

• Identifiers — e-mail address, internal account identifier, device notification token, IP address in the server logs, and — if you fill them in — your first name, your last name and your friend code.
• Commercial information — the subscription you bought, its status and its dates, the books in your library, the authors you follow.
• Internet or other electronic network activity — pages viewed, referring page, arrival channel, device and browser type, the steps of the funnel described in article 3, and outbound clicks to bookshops.
• Visual information — your profile photo, if you add one. It is not used to identify you by your face, and no biometric identifier is derived from it.
• Content you write and publish — the text and rating of your reviews. This is the one category you make public yourself, and article 3 says what goes out with it.

We collect them from you (what you type and what you do in the Service), from your device and browser automatically, and — for subscriptions — from Stripe, Apple or Google, who tell us that a payment happened. They are used for the purposes listed in the table of article 4, and for nothing else. We collect no sensitive personal information in the sense of the statute, no biometric or precise geolocation data, and we draw no inferences about you for advertising.

We do not sell and we do not share

We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the past twelve months, and we do not do so today. Those two words carry their statutory meaning: no personal information is disclosed to anyone for money or for any other valuable consideration, and none is disclosed to an advertising network for targeting you elsewhere. There is no advertising SDK in the apps, no advertising identifier is read, and no advertising tag is loaded on the site. That is also why no “Do Not Sell or Share My Personal Information” link is published here: it would switch off something that does not exist. We do not knowingly sell or share the personal information of anyone under 16 — the Service is not intended for anyone under 15 at all (article 14).

What we do disclose, and only for a business purpose, is what the table in article 6 lists: the service providers who host, authenticate, e-mail, bill, check reviews and monitor on our behalf, each bound by contract to use the data only for us.

Publishing is not disclosing. A review you write and publish becomes readable by anyone, and your first name and last initial go with it — but that happens because you published it, not because we passed it to anybody. It is neither a sale nor a share in the meaning of the statute: nobody paid for it, nothing was received in exchange, and it is not sent to any advertising network. The same goes for what your friends see: they see it because you gave them your code and accepted their request, and it goes no further. Both are undone the same way they were done — article 9 says how.

Your rights and how to use them

• Right to know what we have collected about you, the categories, the sources, the purposes and who received it — this article and article 3 answer it in general, and Settings → My data → Export my data answers it for your own account, immediately.
• Right to delete — Settings → Delete my account, permanent, on the terms of article 8.
• Right to correct inaccurate personal information — from the settings, or by writing to us.
• Right to opt out of sale, sharing and profiling — there is nothing to opt out of, as explained above; the audience measurement, which is neither, can nonetheless be refused in article 5.
• Right to limit the use of sensitive personal information — none is collected.
• Right not to be discriminated against for exercising any of these: the Service works exactly the same for a reader who does, and no price, feature or quality of service depends on it.

The two self-service routes above need no contact with us at all. For anything else, write to privacy@parutio.com from the address of the account concerned; we answer within 45 days, extended once by a further 45 days where the request is complex, and we will tell you if we need it. Where there is serious doubt about who is asking, we may ask for something that establishes it. An authorised agent may make a request on your behalf if he provides your written permission, and we may still ask you to confirm it.

Your browser’s Do Not Track signal is honoured by our audience measurement. A Global Privacy Control signal is not currently read: it is designed to opt a reader out of sale and sharing, and we do neither.

11. Your Canadian privacy rights

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to what we do with your personal information, alongside the GDPR. We collect it for the purposes identified in the table of article 4 and for no other; we ask for your consent where consent is the basis (push notifications, wish-list sharing, publishing a review, friend following and the reading alerts that go with it) and you can withdraw it at any time as described in article 9; and we keep it only for the periods stated there.

You may ask us for access to the personal information we hold about you, and for its correction. The export in Settings → My data → Export my data answers the first immediately; anything beyond it can be asked at privacy@parutio.com, and we answer within 30 days.

If you are in Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, applies as well. Nobody has been designated as a separate person in charge of the protection of personal information: under that Act the function belongs, by default, to the person exercising the highest authority within the company — the president of Prismatic, named in the legal notice — and privacy@parutio.com is the address that reaches him. We would rather write that than name a role nobody holds. The same article 9 rights apply, including the right to be informed of, and to withdraw from, a use we base on your consent. No decision producing legal effects concerning you is taken by automated processing alone; the one automated verdict the Service renders — the check a review goes through before publication — is described in article 13, together with the reasons it gives you and the human you can ask instead.

Commercial e-mail. We send you release alerts because you created an account to receive them, and the weekly digest — where the market has it — only if you expressly turned it on in your settings. You can stop either at any time from Settings → Emails or from the unsubscribe link every one of them carries, and the request takes effect at once. Nothing is sent to an address that did not ask for it, and we do not pass your address to anyone for their own mailings.

As stated in article 7, your personal information is stored and processed in the European Union by the providers listed in article 6, and is subject to the law of the countries concerned.

If our answer does not satisfy you, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Residents of Quebec may also contact the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) under the province’s Act respecting the protection of personal information in the private sector.

12. Security

Traffic to and from the Service is encrypted in transit (HTTPS). Access to production data is restricted to authorised people. Passwords are never kept in clear: they are handled by our authentication provider, which stores them as hashes. The servers are rate-limited to prevent abuse. If a data breach were likely to result in a high risk to your rights, you would be told, as article 34 of the GDPR requires and as the notification laws of your state or province may also require.

13. Automated decisions

No decision producing legal effects concerning you is taken solely on the basis of automated processing. We carry out no profiling, advertising or otherwise, and nothing you do on the Service governs your access to your account, your library or your subscription.

One processing does render a verdict automatically, and that is the review check described in article 6. It decides nothing beyond whether a text you offered gets published, and it is bounded three ways:

• it gives a reason: if your review is refused, you see why, picked from a closed list of reasons — never a sentence written by the machine;
• it is reversible: your review stays visible to you, you can rewrite it, and it goes back for checking;
• a human can be asked: write to privacy@parutio.com and a person reads your review and can publish it. It is exactly the same operation as the automated one, done by hand.

14. Minors

The Service is not intended for anyone under 15 — a stricter floor than the 13 years of the U.S. Children’s Online Privacy Protection Act — and we do not knowingly collect their data. If an account were created by someone under 15 without the permission of a parent or legal guardian, write to us and it will be deleted.

15. Changes to this policy

This policy may change, in particular if a new processing or a new provider is put in place. Any substantial change is notified to you by e-mail or in the app before it takes effect. The date it was last updated is at the top of this page.