Biiwow Books — Privacy Notice
Version 1.0 · effective 5 October 2026. Shown before you create an account and at any time under Terms & privacy.
Controller: biiwow (Dutch Chamber of Commerce / KvK 42145985), Netherlands. Contact for anything in this notice: support@biiwow.com. Supervisory authority: Autoriteit Persoonsgegevens (NL); you may also complain to the authority of your own country.
The short version
Your library is private and stays private. We store what you add about your books, your reading, your loans and your wishes, so the app can show them back to you. Photos are read once and never kept. We do not sell data, show advertising, run analytics or trackers, or train any model on your content.
What we process and why
| Data | Purpose | Lawful basis | Kept |
|---|---|---|---|
| Email, password (salted hash), language setting | Your account, sign-in, security and account emails | Contract | Until you delete your account |
One strictly necessary session cookie (bb_session) and hashed sign-in tokens | Keeping you signed in; email verification and password reset links | Contract | Session cookie up to 30 days; tokens 24 h / 1 h |
| Photos and screenshots you send for recognition | Reading titles, authors and language off the image | Contract | Never stored: read once, discarded; only the text read is kept, with the time, image size and the provider's reply status for troubleshooting |
| Your library: books, formats, languages, reading status and pages, loans and borrower names, keep/give-away plans, wishlist, dismissed picks | The service itself | Contract | Until you delete the book or your account |
| Usage counters (books added, photos scanned per month) | Applying the plan allowances | Contract | While your account exists |
| Billing status, Stripe customer and subscription ids, import credits | Subscriptions and the one-time import | Contract | While your account exists; payment records as long as tax law requires (7 years in the Netherlands) |
| Billing country from the address you enter at Stripe Checkout | Charging the correct VAT | Legal obligation | As long as tax law requires |
| Feedback you send from the app, with the screen you were on | Answering you and improving the app | Legitimate interest | 12 months |
| Sign-in attempt counters per email address and IP address | Stopping password guessing and spam | Legitimate interest | Up to one day |
| Server logs at our hosting provider (IP address, time, address requested) | Security and keeping the service running | Legitimate interest | Up to 7 days |
We do not place any cookies other than the session cookie, so there is no cookie banner. We do not use analytics or advertising services. Your library is never visible to other users or to search engines.
Automated recognition and suggestions
- Recognition. A photo or screenshot is sent, with no account information, to our AI vision provider, Anthropic (Claude API), which returns the text it can read: titles, authors, the language on the cover and, for translations, the original work. Anthropic does not use API data to train its models. We do not keep the image. The result is labelled "AI-assisted" in the app and shown to you for review before anything is saved.
- Book data and covers. To add covers and details, and to build "New to you", we send only book text — a title, an author name, an ISBN or a subject word — to Open Library (Internet Archive, USA), an open catalogue. Nothing about you is sent. Cover images reach your browser through our own servers, so Open Library never sees your device.
- Suggestions. "Rediscover your shelf" and "New to you" are computed from your own books, statuses and ratings with simple rules; they involve no profiling beyond that, have no legal or similarly significant effect, and any pick can be dismissed for good.
Where your data is
Our application and database run on Cloudflare in the EU (Western Europe region). Recognition requests go to Anthropic and catalogue look-ups to Open Library, both in the United States, under the safeguards above: no account data leaves the EU with them, and Anthropic processes API data under its data processing terms and the EU Standard Contractual Clauses. Emails are sent through Resend; payments are handled by Stripe, which has its own privacy policy for the payment itself.
Processors
Cloudflare, Inc. (hosting, database, edge cache) · Anthropic PBC (image recognition) · Internet Archive / Open Library (book data and cover images, text queries only) · Stripe, Inc. (payments, billing country, invoices) · Resend, Inc. (transactional email). We have no other processors. If this list changes, the new version of this notice appears in the app first.
Your rights
Access, correction, export (the full library as a file, self-serve in the app), deletion (self-serve in the app, with a 14-day grace period in which you can cancel), objection, restriction, and withdrawal of any consent. Requests to support@biiwow.com are answered within 30 days. Export and deletion remain available on the free plan and after any subscription ends.
Children
Biiwow Books is for adults and for teenagers from 16. We do not knowingly collect data from younger children.
Changes
If this notice changes in a way that matters to you, the app tells you the next time you open it and asks you to look at the new version.
Change history: 1.0 (2026-10-05) — first published version; replaces the unpublished 0.1–0.2 drafts (which still described photo storage, a trial period and analytics that do not exist).