Privacy policy

Last updated: 1 November 2026

1. Who we are

Share-a-Book (“we”, “the app”) is a free service at share-a-book.gr and in our mobile apps that lets people pass physical books to one another. We decide why and how your personal data is processed, so we are the data controller. You can reach us at michael_papado@yahoo.gr.

2. What we collect

Account: your email address and display name when you register, or the name, email and profile picture your Google or Facebook account shares when you sign in with it. We never see your password; it is handled by Firebase Authentication.

Profile (optional): a pick-up area you type, and, only if you tap “share my location”, the coordinates your device reports at that moment. We do not track your location in the background.

Your listings: the book details you enter (title, author, category, summary, ISBN, condition, language), and a cover photo if you take or choose one.

Messages and exchanges: the chat for a claimed book, the meeting time and place you agree, the book’s status, and the ratings you give and receive.

Safety: who you have blocked, and reports you send about other users.

Notifications: if you turn them on, a push token that identifies your device so we can tell you about new messages.

Camera and photos: the camera is used to scan an ISBN barcode or photograph a cover. Images stay on your device unless you save them as a cover.

Technical data: Google services that run the app (see below) process IP address and device information to deliver the service and prevent abuse.

3. What other people can see

Other signed-in users can see your display name, your ratings, your listings with their cover photos, and your pick-up area. If you chose to share your location, the coordinates are stored with your listings so the app can show distance; they are visible to signed-in users, so only share it if you are comfortable with that. Your email address is not shown to other users in the app. A chat is visible only to its two participants.

4. Why we use it, and our legal basis

To run the service you asked for — accounts, listings, claims, chat, hand-over and ratings (performance of a contract, GDPR Art. 6(1)(b)). To show distance and send notifications (your consent, Art. 6(1)(a), which you can withdraw at any time by not sharing your location or turning notifications off). To keep the community safe, handle reports and prevent abuse (our legitimate interest, Art. 6(1)(f)). We do not run ads, do not profile you, and do not sell or rent your data.

5. Who processes your data

We use Google Firebase (Authentication, Firestore, Storage, Cloud Functions, Cloud Messaging, App Check) to host data and run the app, and Google reCAPTCHA on the web to block bots. Our data is stored in Google Cloud in the United States; Google acts as our processor under its data processing terms and standard contractual clauses. If you use Google or Facebook sign-in, that provider handles the sign-in under its own policy.

When you look up a book, only its ISBN is sent to Open Library, Google Books and the National Library of Greece, the last through a small relay we run so it works in browsers. No personal data is included.

6. How long we keep it, and deleting your account

You can delete your account at any time in the app: Profile → Delete account. This removes your sign-in, your profile, your chats, and the listings you have not yet given away (with their cover photos), and releases any books you had reserved. Books you already gave away stay in the history of the person who received them, without your name or location. Ratings you gave remain, without your name. Reports involving you may be kept for as long as needed to protect other users.

If you cannot use the app, email us from the address on your account and we will delete it for you.

7. Your rights

Under the GDPR you may ask to access, correct, delete, restrict or export your data, object to processing, and withdraw consent. Most of this you can do in the app; for the rest, contact us. You may also complain to the Hellenic Data Protection Authority (dpa.gr) or your local authority.

8. Children

Share-a-Book is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has registered, tell us and we will delete the account.

9. Security

Data travels over encrypted connections and is protected by access rules that limit each person to what they need. No system is perfectly secure, so please use a strong, unique password.

10. Changes

If we change this policy in a way that matters, we will update the date above and, for significant changes, tell you in the app.