Privacy Policy

We rewrote this page so that it describes what the app does today. The main changes:

• Being findable (1 October 2026): your account's email address is now findable by people who already have it in their contacts unless you turn the switch off. It used to be off until you turned it on. Members who already had an account were told by a notification, and can turn it off in one tap.
• Phone number and contacts: the previous version said we never ask for a phone number. That was no longer true. The optional contact search is now described in full.
• Location: the « Around me » button and the optional city on your profile are now described, including which services see what. The position used to name your town is now rounded to about 100 m before it leaves your device.
• Notifications: the token stored for your phone, and the service that relays notifications, are now described. Signing out now removes this phone's token.
• AI and outside services: every provider is now named, with what it receives. Reports and moderation have their own section.
• Deletion and export: the page now says what really happens. Account deletion is immediate and a few things are kept. Deleting a piece of furniture or a room now deletes its photo file, and the export now includes your city, your devices and the reports you filed. We also no longer promise an email for each change to this page: we update the page and its date.
• 29 September: deleting a whole household now deletes its photo files too.

Tomeling is the data controller for everything described here. Write to privacy@tomeling.app for any request about your data. We answer within one month, as the GDPR requires.

• Account: your email address, plus the username and avatar you choose. There is no first-name or last-name field. When you sign in with Apple, we ask Apple for no name.
• Profile, optional: a city you type yourself (see « Your location and your city »).
• Library: the books, copies, spaces, furniture and shelves you create, with tags, series and acquisition dates.
• Photographs: the furniture and shelf photos you upload, the position of each spine on them, and the covers you add to a book that had none.
• Reading: reading status, ratings, private notes, reading sessions, comments and their visibility, wish list, loans.
• Social: friendships, members you block, book clubs you join, posts you write in a club, reports you file.
• Optional features: a fingerprint of your email address (unless you turn being findable off), a fingerprint of your phone number if you add it, and a notification token for your phone if you accept notifications.
• On this website: the email address you leave in a form (to hear about the iPhone app, or to co-sign the manifesto with a name or pseudonym and a role). It is used only to write to you about that, and is not linked to any account.
• Technical: our hosts keep request logs with an IP address and a browser type, for security and to fix faults, for a limited time. We also keep a record of sensitive actions (an export, a deletion, a contact search), without their content.

We do not ask for a date of birth, a postal address or a payment method. Tomeling is free, so there is no billing data to hold.

• To provide the service you asked for (catalog, capture, social features, and the optional features you switch on): performance of our contract with you (Art. 6(1)(b)). Every optional feature can be switched off at any time.
• To keep the service working and safe (logs, rate limits, moderation, abuse handling): our legitimate interest in a service that stays up (Art. 6(1)(f)).
• To send the emails you asked for on this website: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• To comply with a legal obligation when one applies (Art. 6(1)(c)).

We do not sell personal data, we do not run advertising, we do not track you across other apps or websites, and we do not profile you for anyone else's benefit.

Both are optional. Being findable by your account's email address is on unless you turn it off; your phone number and the search in your contacts stay off until you choose them. They serve one feature: letting people who know you find you on Tomeling, and letting you find them.

Being findable

Your account's email address is findable by people who already have it in their contacts, unless you turn “Let my contacts find me” off — when you sign up, at any time in Settings, or on the “Your preferences” screen. You may also type your own phone number. It is sent to our server over an encrypted connection, turned there into a fingerprint (a hash computed with a secret key only the server holds), and then forgotten. Only the fingerprint is stored with your account, never the number. Turning the switch off deletes the fingerprints and we never turn it back on for you. We never call you or text you.

Finding friends in your contacts (iPhone app)

Only when you ask, and only with iOS's permission. The app reads the email addresses, phone numbers and names in your address book, and nothing else: no photos, no other details. On your phone, each address and number is turned into a fingerprint (SHA-256) before anything is sent; names are never sent. Our server compares those fingerprints with the members who are findable, and answers with their public profile (username, first and last name if they gave one, avatar) and, for each of them, which of the fingerprints you sent matched. Your phone uses that to show the name you gave the person in your contacts. We never see that name or your address book.

Your contacts' fingerprints are not stored and not logged. We keep two numbers per search (how many were compared, how many matched) to detect abuse. Your contacts are never contacted. On your phone, and only there, the app keeps the name you give each member it found in your contacts, so it can show that name elsewhere in the app; it is deleted when you sign out and is never sent to us. A fingerprint is not anonymity: someone holding both our database and the server's key could test guesses. That is why the key sits in a separate encrypted vault, and why members who turned being findable off have no fingerprint at all.

« Around me »

Some screens have an « Around me » button, to show nearby bookshops and events. Your device asks for permission the first time you tap it, never before. The app then reads your position once, while you are using it: never in the background, never continuously. The iPhone app asks for an approximate position (about 100 m).

The position is used for one request: sorting bookshops and events by distance. It is not saved in your account and not kept with your identity.

In the web app, the same tap does two more things. To name your town, your position is rounded to about 100 m and sent to the French government's address service (API Adresse), or, outside France, to OpenStreetMap's Nominatim service. And an anonymous counter goes up for the area of about 10 km around you (France and Switzerland only): no account, no time, just the date. It tells us where to look for book events. The iPhone app does neither.

You can type a place instead. The text goes to API Adresse, OpenStreetMap Nominatim or Google Places to find the spot. Our server keeps a shared cache of typed place names and their answers for 24 hours, with no link to you. The place you pick is remembered on your device only.

Your city

Your profile has an optional « City » field. You type it yourself, up to 120 characters, and only you can see it. The suggestions while you type come from Google Places, which receives the letters you type, never your position. In the web app, the « use my position » button next to it sends a position rounded to about 100 m to OpenStreetMap Nominatim, only to suggest a name. You can change or clear the field at any time.

The iPhone app never asks at launch. It offers notifications when they are useful (after a batch of ISBN scans) or from your settings. Only then does iOS ask you.

If you accept, we store a token for this phone: the token issued by Expo, the platform, an installation identifier created by the app (not a hardware identifier), your language, the app version and when it was last seen. Only you can read it. It is used for one thing: delivering Tomeling notifications to this phone.

Expo, the service that relays notifications to Apple, sees the token and the text of each notification, for example how many books are waiting for your review. Loan reminders are scheduled on the phone itself and never leave it.

To stop, turn notifications off in iOS settings. A token that stops working is disabled automatically. Signing out removes this phone's token, and « Sign out everywhere » removes the tokens of all your devices; signing back in registers the phone again. Deleting your account deletes your tokens.

A photograph of your bookcase is a photograph of your home. Those files live in private storage: no public folder, no guessable address, and every view goes through a short-lived signed link issued to you. Other members of your household see the photos of household furniture, because that is the point of a household. Nobody else does. Covers you add are stored privately too, but can appear on a book's share card.

When you delete your account, we delete your avatar, your past exports, and the photos of any household of which you were the last member. Photos of a household that still has other members stay with that household. Deleting a piece of furniture or a room, or replacing or removing its photo, deletes the photo file from storage as well. A scan's photo is kept as long as the scan, so that it can be read again. Deleting a whole household from its settings deletes its photo files as well, straight after the household itself; the photos of the other households you belong to are not touched.

We use AI models as processors: they act on our instructions under a data-processing agreement, and we instruct them not to train on what we send. None of them receives your email address, your name or your position. Here is what each one receives.

• Shelf photos, to Anthropic: to read the spines we send the whole photo, and the usual languages of your household's books. A scan can be run again on the same photo, by you or by our support team.
• Your reader portrait, to Anthropic: only when you ask for it, at most three times a month. We send statistics about your library (how many books per genre, language or decade), never titles, authors or notes.
• Book pages, to Anthropic: to fill in a missing summary, cover or detail, and to write a short quote, we send public information about the book (title, authors, ISBN, publisher's summary). This can happen when someone opens a book page. Nothing about the reader is sent.
• Translations, to Anthropic: book summaries, quotes and author biographies are translated into your language. What you write (comments, notes, club posts) is never sent for translation.
• News pictures, to OpenAI: illustrations for our news articles are generated from a description of public news. No member data is sent.

To identify a book, we query Google Books, Open Library, the BnF (the French national library) and Wikidata with an ISBN, a title or an author. In the iPhone app, a search by title goes straight from your phone to Google Books and Open Library, which then see your phone's IP address and the words you typed.

You can report a comment, a club, a club post or a member. We store who filed the report, the reason, any details you add (up to 2,000 characters) and what was decided. Our moderators see the report and who filed it. The member reported is not told who reported them.

You can also block a member: they can no longer see your profile or your personal data. If you delete your account, the reports you filed are kept for moderation, no longer linked to you.

• Members of your household see the household library, its photographs, its locations and its loans, never your reading status, ratings, notes, reading sessions or private comments.
• Friends see what you have chosen to make visible to friends, and the library a friend is allowed to browse.
• Other members see your username and avatar. Club posts are seen by the club's members, or by every member for a public club.
• Anyone holding a share link sees the book card only: title, authors, publisher, summary, cover. Never a location, never who owns it, never anyone's reading data. A share link can be revoked at any time and stops working immediately.
• Our processors act on our instructions only: Supabase (database, sign-in and files, in the EU), Vercel (hosting of this website and the web app), Resend (sign-in and invitation emails), Expo (app updates and notification relay), Anthropic and OpenAI (AI, see above), Google (Books and Places, see above), and Sentry (error reports from our servers, EU region).
• Public services we query (Open Library, the BnF, Wikidata, API Adresse, OpenStreetMap Nominatim) receive only the request described above.

Our database and files are hosted in the European Union. Where a processor works outside the EU, the transfer is covered by the European Commission's standard contractual clauses.

We keep your data while your account exists. Deleting your account is immediate: your profile, library, reading data, club posts, notification tokens and contact fingerprints are erased at once. What remains: copies you shared in a household that still has other members stay with that household; reports you filed stay, no longer linked to you; and a security record of the deletion, holding a fingerprint of your account and some counts, not your email address. Your export files stay in private storage until your next export or the deletion of your account.

Under the GDPR you may ask for access to your data, correction, erasure, restriction and portability, and you may object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time without affecting what came before. You may also complain to your national data-protection authority.

Two of those are buttons in your account settings, on the web and on iPhone. Export: a ZIP of CSV files (profile including your city, households, catalog, reading, loans, clubs and posts, friends, scans, imports, shares, your devices, and the reports you filed), through a private link valid for 15 minutes, up to three times a day. Each device is listed by its installation identifier, platform, language, app version and dates, without the notification token itself, which is a key to reach your phone rather than information about you. A report names what you reported by its identifier only. Deletion: immediate once you confirm.

This website sets no cookies and loads no tracker. To count its readers, our own servers record the page, the language, the country and the referring site. Daily unique visitors are counted with a fingerprint of the IP address and browser mixed with a secret, deleted after about 48 hours. The IP address itself is never stored.

The web app sets only strictly necessary cookies: your session, your language, the address a sign-in code was just sent to (for one hour), and a note that you skipped the welcome screen. None is shared. Some preferences stay on your device only, such as recent searches or a place you typed.

There is no product analytics in the web app or the iPhone app today, and the iPhone app contains no advertising or tracking tool. If we add analytics, it will be announced here before it is switched on.

When this policy changes, we update this page and its date at the top, and say here what changed.