Book Break Privacy Policy

This Privacy Policy explains how Book Break ("the App", "we") collects, uses, stores and protects your personal data when you use our mobile and web applications. By using the App, you agree to the practices described in this policy.

Data controller: Book Break
Contact: destek@bookbreakapp.com

This is an English translation provided for convenience. If there is any conflict between versions, the Turkish version prevails.

1. Data We Collect

We only collect the data the App needs to work. We do not use advertising networks or analytics/tracking tools.

1.1 Account information (provided by you)

• Email address — to create your account and sign in (required)
• Name / display name — shown on your profile
• Password — to protect your account (see the Security section below)

1.2 Usage and content data (created while you use the App)

• Reading data — books you add to your library, reading sessions (duration, pages), progress
• Social data — friend connections and friend requests
• Messages — chat messages you send to other users
• Reports — content/user reports you submit
• Achievements — badges you earn and related metrics
• Notification preferences — your notification settings

1.3 Technical data

• Device notification token (APNs token) — to send push notifications (via the Apple Push Notification service)
• Session tokens (JWT) — to keep your session secure

Data we do not collect: location data, contacts, photo/camera access, payment/card details, and we do not log your IP address. We do not use third-party analytics, advertising or tracking tools.

2. How We Use Your Data

We use your data only to:

• Create your account and verify your identity
• Provide reading tracking, library, social and notification features
• Send push notifications (if you have enabled them)
• Keep the service secure and prevent abuse
• Meet our legal obligations

We do not sell, rent or share your data with third parties for marketing purposes.

3. Third-Party Services

We use a small number of technical services and share only the minimum data they need:

• Apple Push Notification Service (APNs) — your device token is sent to Apple to deliver push notifications.
• Open Library / Gutendex — used for book search and catalog information. Only your search query or a book identifier is sent to these services; your personal identity (email, name, etc.) is not sent.
• Google Books — may be used to fill in missing page counts; only the book title/identifier is sent, never your personal data.

We do not use any analytics, crash reporting or advertising/tracking SDKs (Firebase, Sentry, Crashlytics, Amplitude, Mixpanel, Facebook SDK, etc.).

4. Data Security

• Passwords are stored hashed with a strong one-way algorithm (BCrypt); plain-text passwords are never stored and even we cannot see your password.
• All traffic in production is encrypted with HTTPS.
• Sessions are managed with short-lived access tokens (15 minutes) and refresh tokens (7 days).

No system is 100% secure, but we apply reasonable technical and organizational measures to protect your data.

5. Data Retention

We keep your personal data for as long as your account is active. When you delete your account, your data is deleted or anonymized as described in "Your Rights" below.

Technical and error logs (e.g. IP address, device and connection information) are kept for security and debugging purposes for at most 30 days and are then deleted automatically.

6. Your Rights and Account Deletion

Depending on where you live (KVKK, GDPR, etc.), you have the right to access, correct and delete your data, to object to processing, and to data portability.

You can delete your account directly in the App (Profile → Delete Account). When you delete your account:

• Deleted data: your email address, name, password, profile, reading records, library, friendships, notifications, notification preferences, badges and device tokens are permanently deleted.
• Anonymized data: chat messages and reports you sent to other users are not deleted, to preserve the integrity of the other person's history; however, your identity as the sender is removed and shown as "Deleted User". These messages can no longer be linked to you.
• De-identified data: Apple subscription transaction records may be kept, separated from your user identity, to meet legal and accounting obligations; these records do not identify you.

To exercise your rights or make a request, contact us at destek@bookbreakapp.com.

7. Children's Privacy

Book Break is not intended for users under 13, and we do not knowingly collect personal data from anyone under that age. If we learn that a child under that age has provided data, we will delete it.

8. International Users

The App is available to users in Türkiye (KVKK), the European Union (GDPR) and other regions. Your data is processed and stored on servers located in the European Union. You may have additional rights under the laws of your region.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes in the App or by email. The current version is always published on this page.

10. Contact

For privacy questions or requests:
destek@bookbreakapp.com
Data controller: Book Break