Privacy Policy

Last updated: 8 July 2026

This privacy policy explains how Librea ("we", "us") processes personal data when you use the Librea mobile app and this website, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for data processing is:

Milan Tornier
Karlsgartenstr. 14
12049 Berlin
Germany
Email: contact@librea-marketplace.com

2. Overview

Librea is a marketplace for second-hand books. Depending on how you use the app, we process the following categories of data:

• Account data — email address, password (stored only as a cryptographic hash), and optionally your phone number.
• Profile data — display name, profile picture, postal code (ZIP), and the languages and genres you select.
• Book and activity data — your bookshelf, listings, wishlist, reviews, ratings, reading sessions, and book club memberships.
• Communication data — messages you exchange with other users and transaction requests between users.
• Location data — your device location (only while using the app, and only with your permission) to show nearby books and readers on the map.
• Contact data — phone numbers from your address book (only with your permission) to find friends who already use Librea.
• Device data — a push notification token for your device, if you enable notifications.

3. Hosting and backend (Supabase)

Our database, authentication, and file storage run on Supabase, hosted in the EU (AWS eu-central-1, Frankfurt, Germany). Supabase processes data on our behalf under a data processing agreement (Art. 28 GDPR). Legal basis: Art. 6(1)(b) GDPR (performance of the user contract) and Art. 6(1)(f) GDPR (secure, reliable operation of the service).

4. Account and profile

To use Librea you create an account with your email address and a password. Your phone number, if provided, is used only for friend matching (see section 6) and is never shown to other users or exposed through the API. Legal basis: Art. 6(1)(b) GDPR.

5. Location and map

With your consent (device permission), we use your location while the app is open to show books and readers near you. Your exact location is never shown to other users: pins on the map are randomly shifted within your postal code area. You can revoke the permission at any time in your device settings; the map then works with reduced functionality. Legal basis: Art. 6(1)(a) GDPR (consent).

The map itself is provided by Google Maps (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). When the map loads, your IP address and approximate location are transmitted to Google. Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework. See Google's privacy policy.

6. Friend finding via contacts

If you choose to use the friend-finding feature, the app asks for permission to access your address book. Phone numbers from your contacts are pseudonymized (hashed) on your device; only these hashes are transmitted to our server, solely to check whether a matching Librea account exists. Your contacts' readable numbers never leave your device. The hashes are used only for this comparison and are not permanently stored or used for any other purpose. Please only use this feature if you are confident your contacts would not object. Legal basis: Art. 6(1)(a) GDPR (consent); for the matching itself Art. 6(1)(f) GDPR (legitimate interest in connecting users). You can use Librea fully without granting contacts access.

7. Camera and photos

With your permission, the app uses your camera to scan book barcodes (ISBN) and to take photos for listings and your profile picture. Photos are uploaded only when you actively choose to. Legal basis: Art. 6(1)(b) GDPR.

8. Messages and transactions

Messages you send to other users and transaction requests (e.g. buying or reserving a book) are stored on our servers so we can deliver them and display your history. They are visible only to the participants. Legal basis: Art. 6(1)(b) GDPR.

9. Push notifications

If you enable notifications, we store a push token for your device and send notifications (e.g. new messages, friend requests, transaction updates) via Expo (Expo, Inc., USA). The token does not identify you personally to Expo. Transfers to the USA are safeguarded by standard contractual clauses (Art. 46(2)(c) GDPR). You can disable notifications at any time in your device settings. Legal basis: Art. 6(1)(a) GDPR (consent).

10. Book search (Open Library)

When you search for book metadata, your search query is sent to the Open Library API (Internet Archive, San Francisco, USA) to retrieve title, author, and cover information. No account data is transmitted with the query beyond what is technically necessary (IP address). Legal basis: Art. 6(1)(f) GDPR (providing book metadata without maintaining our own catalogue).

11. Retention and deletion

We store your data for as long as your account exists. You can delete your account at any time in the app settings; this deletes your account and the personal data associated with it. Data we are legally required to retain (e.g. under commercial or tax law, if applicable) is deleted after the respective retention period expires.

12. Your rights

You have the right to:

• Access your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing based on legitimate interests (Art. 21 GDPR)
• Withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a supervisory authority, in particular in the German federal state of your habitual residence. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, www.datenschutz-berlin.de).

To exercise your rights, contact us at contact@librea-marketplace.com.

13. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

14. Changes to this policy

We may update this policy when the app or legal requirements change. The current version is always available at this address; material changes will be announced in the app.