Privacy Statement
NederlandsThis statement describes how Circlore handles personal data: what we process about you, why, who we share it with, and what say you have in it.
We have written it as short and as plainly as we could. Where "you" appears, we mean you as a user of Circlore.
This is a translation. The Dutch version of this statement is the binding one; if the two differ, the Dutch text prevails.
Data controller
Responsible for the processing of your personal data is Ethan Speijer, a private individual trading as Circlore. That is the data controller within the meaning of the GDPR.
Circlore is not currently registered with the Dutch Chamber of Commerce (KvK): there is no company behind it yet. So there is no KvK number and no registered business address to give here. If we later bring Circlore into a company, that company becomes the controller and its details will be shown here.
If you have a question about your data, want to exercise a right, or want to object to something, email circloresocial@gmail.com. We have no data protection officer; your message reaches us directly.
What data we process
We process the data you provide yourself and the data that arises from your use of Circlore:
- Account: your email address, your name and your profile photo from the account you sign in with.
- Profile: your handle, your bio and your avatar.
- Location: the place you pick yourself when you search for your area — a neighbourhood, a town or a street. We store the coordinates of that point, your country, the name of the area and, visible only to you, the name of the place you chose, so that Settings can show you what your pin actually sits on. We never ask for a house number and never store one. How finely you drop that pin is your choice: a neighbourhood or a town is as acceptable as a street.
- Books and reading: your shelves, your reading progress, your notes, your reviews and your posts in the timeline.
- Social: who you follow, what you like, your comments and who you have blocked.
- Messages: your conversations with other users and in groups.
- Exchanges: which copy passed from hand to hand and when, with the area it happened in.
- Technical: your IP address and log files. And, if push notifications are ever switched on, the token your device issues for them — today nothing in the app asks for one.
What other people see is deliberately coarser than what we store. Your books are published on a grid of roughly 200 metres, and never with the place name you chose. So a neighbour sees which area a book is in, not where you live.
What we use your data for, and on what legal basis
We process your data only for the purposes below. Each purpose is followed by the GDPR basis we rely on.
- Delivering the service and putting you in touch with neighbours: your account, your shelves, lending and borrowing, and showing what is available near you. Basis: performance of the contract you enter into with us when you create an account.
- Sending notifications about what happens to your account, such as a borrow request or a comment. Basis: your consent. You turn notifications on yourself and you can turn them off again at any time.
- Safety, moderation and abuse prevention: handling reports, making blocks work, acting on accounts that break the rules. Basis: our legitimate interest in a safe platform. You may object to this.
- Improving Circlore and making recommendations to you: seeing what works and what does not, and suggesting books that fit what you read. Basis: our legitimate interest in a service that gets better. You may object to this.
- Showing books that are within reach. You set how far you want to look, and we match that distance against where other members’ books are. That same distance decides who you may borrow from. It works on distance, not on a profile we build of you. Basis: our legitimate interest in a service that is locally useful. You may object to this.
If you want to object to any of the processing based on legitimate interest, email circloresocial@gmail.com. We weigh your objection and stop that processing, unless we have compelling grounds that outweigh your interest.
Special categories of personal data
We do not ask about your religion, your health, your political views, your sexual orientation or your background, and there is no field anywhere for you to enter it.
Even so, we should be honest: what someone reads can give such things away. A shelf full of books about one faith, about an illness, about a political movement or about queer life says something about the reader, even when nobody meant it that way.
That is why the visibility settings exist. You choose, per book on your shelf and per post, who may see it: everyone, only your followers, or only you. If you set something to public, you are the one making it public. If you are in doubt, set it to private — you can always do that, including after the fact.
Who sees what
Your @handle is the only public label on Circlore. We never show your real name to other users, not even when you sign in with Google and we therefore have it. Nor do we show your email address.
We show your location only as an approximate area. Other users see roughly which neighbourhood a book is in, never an address.
Every book on your shelf and every post has its own visibility: public, followers only, or private. Private means only you see it.
If you set your account to private, your content is visible only to followers you have accepted.
What you write in a conversation or in a group is seen by the people in that conversation or group. If you block someone, the two of you drop out of each other’s view.
Notes you keep on a book are yours alone. We never show them to another user — not to your followers and not to the people in your household.
If you share a household, its members can offer and lend the copies you share with them themselves. That is exactly what it is for, but it does mean a household member sees those books listed as their own to offer.
Every copy has a passport page: a public, permanent record of the hands the book has passed through, with the approximate area of each exchange and the @handles of those involved. It only ever grows — an entry is never edited, and never taken out on its own. For users with a private account we do not show the name.
If you delete your account, your entries stay on the passports of the books you passed on, but your @handle comes off them: from that moment they read “someone”. What is left is the event, the date and the approximate area — the history of the book itself, no longer tied to your account. There is one exception: a book that was yours alone leaves with you, and once the copy is gone there is nothing left to document, so its passport page goes too.
Aggregated and anonymised data
We produce statistics about the use of Circlore, for example which genres are widely read in a particular area. We may publish those statistics and use them commercially, for example together with publishers or bookshops.
We do this only with data that cannot be traced back to a person. We do not publish a statistic about an area if fewer than 20 people underlie it. We do not share your name, your handle or your individual reading behaviour.
Consents
For some things we need your consent. We ask for it per subject, separately, never all at once for everything together, and each consent can be given on its own and withdrawn on its own.
Today none of these consents is switched on. If we ever ask for one, we will first explain what for. If you say no, Circlore keeps working — only that one part will not.
If you withdraw a consent, we stop from that moment on. What was processed before then remains lawfully processed; withdrawal does not work retroactively.
Third parties and processors
We do not sell your data and we do not rent it out. We do use a number of parties to keep Circlore running:
- Convex — our backend and file storage. This is where your account, your shelves, your messages and your uploaded photos live.
- Vercel — the hosting of the app. Handles the requests from your browser and keeps technical logs while doing so.
- Resend — sends the email with your one-time sign-in code. Receives your email address for that.
- Google — signing in with your Google account, and the Google Books API we use to look books up. We send no data about you along with that, only your search term. The app’s fonts are fetched when we build the app and served from our own domain, so your browser does not go to Google for them.
- Geoapify — turns what you type in the search box into a place with coordinates when you set your location. Receives your search text and your country for that. It is a commercial service, not a government one; we chose it because its terms let us keep the coordinates you picked rather than having to ask for them again every time.
- OpenFreeMap — the map tiles on the map view.
- OpenLibrary — book covers that Google does not have.
- Apple — book covers that the other sources do not have.
One thing you should know: the map tiles from OpenFreeMap and the covers from Google, OpenLibrary and Apple are fetched by your own browser, directly from those parties. That means they see your IP address. We do not give it to them — it is your browser knocking on the door, as with any image on any website. We do not pass on what you are looking at or who you are.
With the parties that process personal data on our behalf we have data processing agreements. Beyond that, we provide data to third parties only where the law obliges us to, for example to the police or the public prosecutor on a lawful request.
Transfers outside the EEA
Some of the parties above are established outside the European Economic Area, chiefly in the United States. Your data may therefore end up there. Circlore is also no longer Dutch-only: members may live anywhere, and their own location travels with them.
We only make such a transfer where there is a valid basis for it: the EU-US Data Privacy Framework, or standard contractual clauses approved by the European Commission.
If you want to know which basis applies to a particular party, ask us at circloresocial@gmail.com.
How long we keep your data
We do not keep your data longer than necessary:
- Your account and your profile we keep for as long as your account exists. Once it is deleted, we remove your data within 30 days.
- Your messages, your shelves, your reviews and your timeline we keep for as long as your account exists, and they go with it on deletion. A conversation does stay visible to the other participant where your messages are part of it.
- Technical log files we keep for 90 days.
- Passport entries we keep for as long as the book exists, also after your account is gone — but without your @handle, as described under "Who sees what". A passport is a shared record: it is the history of someone else’s book as much as it is yours, and the person holding that book now relies on it. The basis is our legitimate interest, and that of the other people in the chain, in a provenance record that stays whole. You may object; write to us and we will weigh it.
- The limited moderation record described in the Terms of Use we keep for 2 years after the account is removed. It records that an account was removed, when, and which category of violation it concerned — not your messages or your shelves. We keep it to stop someone we have removed from signing straight back up, and to be able to defend ourselves against legal claims. The basis is Article 17(3)(e) GDPR.
Where the law obliges us to keep something longer, for tax purposes for instance, we comply with that.
Your rights
You have these rights over your own data:
- Access: you may request which data we hold about you.
- Rectification: if it is wrong, you may have it corrected or completed.
- Erasure: you may have your account and your data deleted. Email us to say that is what you want and we will do it. Two things named under "How long we keep your data" stay behind: your passport entries, stripped of your @handle, and the limited moderation record.
- Restriction: you may ask us to put a processing on hold temporarily, for instance while we handle an objection from you.
- Objection: you may object to the processing we base on legitimate interest.
- Data portability: you may receive the data you provided yourself in a common file format, and ask us to send it to another party.
- Withdrawal of consent: where you have given consent for something, you may withdraw it at any time.
To exercise a right, email circloresocial@gmail.com. We respond within one month. If your request is complex we may extend that period by two months; in that case we tell you within the first month that we are doing so and why. We may ask you to make your request from the email address on your account, so we can be sure it is you.
If you think we are not handling your data properly, tell us first — we usually sort it out together. You also always have the right to lodge a complaint with the supervisory authority, the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Security
Traffic between your device and Circlore is encrypted, and the platforms we run on store your data encrypted.
Access to your data is limited to what is needed to run the service and to fix faults. We do not read your messages out of curiosity.
Perfect security does not exist. If something does go wrong and it poses a high risk to your rights and freedoms, we will tell you, alongside the notification we will then make to the Autoriteit Persoonsgegevens.
Changes to this statement
This statement may change, for example because Circlore changes or because the law requires it. The version and the date of the last change are at the top of this document.
If it is a material change, or if we start using your data for a genuinely new purpose, we announce it at least 30 days in advance, in the app or by email. That gives you time to object or to delete your account before it takes effect.
Small textual corrections we make without announcement. Those change nothing about what we do with your data.