Legal
Privacy Policy
Most privacy policies explain what a company does with your files. This one mostly explains why we never get them.
Last updated · Applies to BookFold at bookfold.app.
The short version
Your documents never leave your device. BookFold converts files inside your own browser. There is no upload, no server-side processing, and no copy of your document anywhere but your own machine.
- No accounts, no sign-up, no password — so there is no profile of you to hold.
- No analytics, no cookies, no tracking scripts, no third-party requests. That is not a plan for later; it is the current state of the app.
- Your library and settings are stored in your own browser, and you can wipe them yourself in a few clicks.
- If you buy Pro, Stripe handles the payment and collects your email and card details. We never see your card number.
- OCR for scanned PDFs runs on your device too. Read-aloud uses your device’s own voices — with one honest caveat about “online” voices, in section 8.
01 Who is responsible
BookFold is made and run by one person, who is the data controller for the small amount of personal data described here. You can reach them at:
[OPERATOR NAME AND POSTAL ADDRESS — TO BE COMPLETED: required for GDPR/UK-GDPR transparency and for most consumer-law regimes]
02 Your documents stay on your device
When you open a document in BookFold, your browser reads it from your disk and converts it locally. The converted book, its chapters and its text are built in your browser’s memory and saved in your browser’s own storage. The file is never transmitted to us or to anyone else.
This is not a promise about how we handle uploads. There are no uploads. BookFold has no file server, no document database and no processing queue — the entire product is static files plus one small payment-verification function that never touches documents. The conversion libraries (pdf.js, mammoth, JSZip, marked, and Tesseract for OCR) are stored on the same site as the app and run inside your browser, so opening a document generates no network request at all.
You can check this yourself: open your browser’s developer tools, switch to the Network tab, and convert a file. Nothing leaves. You can also disconnect from the internet entirely and BookFold will still convert and read your book.
03 What is stored on your device
BookFold keeps a few things in your browser so the app is useful between visits. All of it lives on your device, none of it is synced anywhere, and we cannot read any of it.
Your converted books (“My Library”)
- Where
- IndexedDB, in a database named
bookfold. - What
- The converted text and structure of each book, plus its title and cover details.
- Who can see it
- Only you, in that browser. We have no copy.
Your Pro status and licence
- Where
- localStorage:
bookfold_pro,bookfold_license,bookfold_email. - What
- A flag saying Pro is on, the signed licence token issued after payment, and the email address you paid with (so the app can show it and re-check the purchase).
- Who can see it
- Only you, in that browser. It is not sent back to us except when you ask the app to restore or re-verify a purchase.
Reading positions, bookmarks and settings
- Where
- localStorage:
bookfold_pos_*,bookfold_bm_*, and keys for your theme, font size and voice preferences. - What
- Where you got to in each book, your highlights and bookmarks, and how you like the reader set up.
- Who can see it
- Only you, in that browser.
The offline app cache
- Where
- The browser’s Cache Storage, used by BookFold’s service worker.
- What
- Copies of BookFold’s own files — the page, the styles, the conversion libraries — so the app works offline. No personal data.
- Who can see it
- Only your browser.
How to delete all of it
Clear the site data for BookFold in your browser settings (often listed as “Cookies and site data” → the site → Delete, or “Clear browsing data” with cached data and site data selected). If you installed BookFold as an app, uninstalling it removes its data on most platforms. That deletes your library, your reading positions and your saved Pro status in one step, immediately and permanently — there is no server-side copy to also delete, and no request to make to us.
Worth knowing: clearing site data deletes your library too, and we cannot bring it back. Pro can always be restored with the email you paid with. Books cannot.
04 No analytics, no cookies, no trackers
Plainly, and with no small print:
- No analytics. No Google Analytics, no Plausible, no Fathom, no self-hosted analytics, no page-view counter of any kind.
- No cookies. BookFold sets no cookies at all — not for tracking, not for preferences. That is also why there is no cookie banner: there is nothing to consent to.
- No third-party requests. No fonts from a font service, no CDN, no ad network, no social widgets, no embedded video, no error-reporting service, no session recording, no fingerprinting. Every file the app needs comes from BookFold’s own site.
- No profiling and no automated decision-making, and we do not sell, share or rent personal data. There is essentially nothing to sell.
The only time your browser talks to a server about you is when you buy Pro or restore a purchase. That is the next section.
05 When you buy Pro: Stripe
Payments are handled by Stripe. When you click to buy, you go to a payment page hosted by Stripe and you enter your details there, not in BookFold. Stripe is our payment processor and, for the payment itself, acts as an independent controller of the data it collects.
Stripe collects, on our behalf and its own: your email address, your card or payment-method details, your billing country and postal code where required, the amount and currency, and technical information such as your IP address and device data that Stripe uses to prevent fraud and to meet its legal obligations.
What we can see afterwards, in the Stripe dashboard: your email address, the amount, the date, the country, the card brand and last four digits, and whether the payment succeeded, was refunded or was disputed. We never see or store your full card number — it does not pass through any system we control.
Stripe’s handling of your data is governed by Stripe’s privacy policy. Please read it if you want the full picture of what a payment processor holds.
Our legal basis for processing your email and payment record is performance of a contract (delivering the licence you paid for and handling refunds), and compliance with a legal obligation for the tax and accounting records that follow from a sale.
06 The licence check and the restore lookup
BookFold has exactly one piece of server-side code: a small function that asks Stripe whether a payment happened, and then issues a signed licence. It is worth describing precisely, because it is the only moment BookFold’s own server is involved with you at all.
After a payment
Stripe returns you to BookFold with a checkout session ID in the URL. The app sends that ID to our function, which asks Stripe “was this session paid?”. If yes, the function creates a short signed token — containing the app name, the plan, the session ID, your email and a timestamp — and returns it to your browser, which stores it locally. Nothing is written to a database, because there is no database.
Restoring a purchase on another device
If you enter the email you paid with, that address is sent to our function, which searches Stripe’s record of recent payments for a matching paid purchase and re-issues the same kind of licence. The address is used for that lookup and then discarded when the request ends. It is not logged, not stored, and never included in the response text; a failed lookup says only that no purchase was found.
The source of truth for who has bought Pro is Stripe’s payment record. We keep no customer list of our own, which means there is no separate database of buyers to breach, leak or hand over.
07 Hosting and server logs
BookFold is hosted on Netlify. Like every web host, Netlify processes the technical information involved in serving a page — your IP address, the time, the file requested, the response status, your user agent and referrer — and may keep standard server access logs for security, abuse prevention and operations. Netlify acts as our hosting provider (a processor) for this.
We do not use those logs as analytics, we do not build profiles from them, and we do not combine them with payment data. Note that these logs exist regardless of what BookFold does — loading any web page from any host produces them. Once the app has loaded, using BookFold to convert and read a document produces no further requests at all.
08 Read-aloud and your device’s voices
This deserves a precise answer rather than a comfortable one.
BookFold’s read-aloud uses your browser’s built-in speech feature and the voices already installed on your device. BookFold sends the sentence to be spoken to that built-in feature; it does not send it to us, and it does not send it to any service we chose or control.
The nuance: on most platforms some of the available voices are “local” (the speech is generated on your device) and some are “online” or “network” voices — higher-quality voices that your operating system or browser renders by sending the text to the vendor’s own servers, for example Microsoft, Google or Apple. If you select one of those voices, the text of the sentences being read is processed by that vendor under their privacy policy, as part of your operating system or browser. That processing is outside BookFold: we do not initiate it, we cannot see it, we receive nothing from it, and we have no relationship with the vendor about it.
If you want read-aloud with no network involvement whatsoever, choose a voice your device marks as local, offline or on-device (the naming differs by platform), or simply switch off your network connection — BookFold keeps working, and only local voices will be available.
09 Scanned PDFs and OCR
When a PDF is a scan with no text layer, BookFold can read the page images using OCR. That OCR engine (Tesseract) and its language data are served from BookFold’s own site and run entirely inside your browser. Page images are not sent anywhere — not to us, not to a cloud OCR service. It is slower than a cloud service would be, which is the price of it being private.
10 How long anything is kept
- Your documents and library: kept on your device until you delete them. We hold them for zero seconds, because we never receive them.
- Your payment record at Stripe: retained by Stripe under its own policy, and by us as long as tax and accounting law requires — commonly six to seven years, depending on the country. This is the one record of you we genuinely have.
- Emails you send us: kept while we deal with your question and for a reasonable period afterwards in case you follow up, then deleted. Support email is held in a normal email account.
- Licence and restore requests: not retained. They are handled in memory and gone when the request finishes.
- Host access logs: kept by Netlify for its standard retention period, and not used by us for anything but investigating a problem.
11 Your rights (UK, EU and similar)
If the UK GDPR or EU GDPR applies to you, you have the right to: access the personal data we hold about you; have it corrected; have it deleted; receive it in a portable form; restrict or object to processing; and withdraw consent where processing was based on consent. You also have the right to complain to your data protection authority — the ICO in the UK, or your national authority in the EU.
An honest note about what those rights get you here: because there are no accounts, we hold almost no personal data about you. If you have never bought Pro, we hold nothing that identifies you at all — there is no profile, no email list, no library on our side. If you have bought Pro, the record that exists is the payment record held at Stripe: your email, the amount, the date, the country and the card metadata.
That record also has a limit worth stating: we cannot delete a completed payment record on demand, because tax and accounting law requires us to keep proof of sales for a number of years, and because Stripe must keep records for its own compliance. We can delete or anonymise anything not covered by that obligation — our email correspondence with you, for instance — and we will explain exactly what is kept and why when you ask.
We cannot access, export or delete your library or reading data. Not for you, not for anyone. Those controls are entirely in your hands (see section 3).
12 Your rights (California and similar US states)
If you are in California, the CCPA/CPRA gives you the right to know what personal information is collected and how it is used, to request deletion, to request correction, to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising those rights. Several other US states now give comparable rights, and we handle all such requests the same way.
In our case: the only category of personal information collected is identifiers and commercial information connected to a purchase — your email address, the payment amount and date, and payment metadata — all collected through Stripe for the purpose of completing your purchase and supporting it afterwards. We do not collect biometric data, precise geolocation, browsing history across other sites, or sensitive personal information.
We do not sell or share personal information, and we never have. We run no advertising, no cross-context behavioural advertising and no loyalty or financial-incentive programme. There is nothing to opt out of, which is why you will not find a “Do Not Sell” link — not because it is hidden.
13 How to exercise your rights
Email us and say what you want:
Please write from, or tell us, the email address you paid with — it is the only way we can find your record, since there is no account to log into. We may ask one clarifying question to be sure we are matching the right purchase; we will not demand ID for a US$39 software purchase.
We will respond within one month, as the GDPR requires, and usually far sooner. There is no charge. You are welcome to use an authorised agent. If you are unhappy with how we handled your request, you can complain to your data protection authority — but please tell us first, since it is usually something we can fix the same day.
14 Children
BookFold is not directed at children under 13, and we do not knowingly collect personal data from them. In parts of the EEA the relevant age is 16. Since the app requires no account and collects nothing from people who do not buy, the only way a child’s personal data could reach us is through a purchase — which needs a payment card. If you believe a child has bought Pro without permission, email us: we will refund it and delete what we can.
15 Where data goes
Your documents go nowhere, so there is no international transfer of the thing you probably care about most.
The two service providers we do use, Stripe and Netlify, are US-based companies operating global infrastructure, so payment data and server logs may be processed in the United States and other countries. Where personal data is transferred out of the UK or EEA, we rely on the safeguards those providers publish for their own transfers — Standard Contractual Clauses, the UK Addendum, and their certifications under the EU–US and UK–US Data Privacy Framework where applicable. Their published privacy documentation sets out the current position, and Stripe’s is linked in section 5.
16 Security
The site is served over HTTPS. The Stripe secret key lives only in the server-side function’s environment and never reaches your browser. Licence tokens are signed so they cannot be forged into a different purchase. The restore endpoint is rate-limited and never echoes an email address back.
The strongest security property here is architectural rather than procedural: we do not hold your documents, so they cannot be leaked by us. There is no user database to breach. The data on your device is protected by your device and your browser — so if a book is sensitive, lock your device and be careful with shared computers.
No system is perfectly secure. If you find a vulnerability, please report it to the address in section 18 and we will fix it as quickly as one person can.
17 Changes to this policy
If BookFold ever changes in a way that affects this policy — a new feature that needs a server, say — we will update this page and change the date at the top. For anything material we will say so in the app rather than quietly editing the page, and we will not start collecting a new category of personal data without telling you first.
18 Contact
Questions about privacy, or about anything in this policy:
Real questions get real answers. If something here is unclear or reads as evasive, please say so — it will be fixed.