Privacy Policy - Books This Year

Last updated: October 14, 2026

This policy explains what data the Books This Year app (“the app”) and its server handle, which third-party services receive data from it, how long data is kept and what choices you have. The app is published by Ibrahim Yavuz.

There are no user accounts. The app does not ask for your name, e-mail address, phone number or location (ad services can estimate a rough location from your IP address; see section 4).

1. Data that stays on your device

Your library (books, reading progress, notes, goals and statistics) and the photos you choose for book covers or notes are stored on your device. The app does not upload these photos. If you export your data (CSV, PDF) or share it, it goes where you send it using the system share sheet.

2. Data sent to our server

The app connects to our own server (booksthisyear.com) in the cases below. All of these connections use HTTPS.

Configuration: each time the app opens, it downloads its settings (ad and Premium settings, limits) from our server. The server sees your IP address in this request.
Device identifier: the app creates an identifier for your device from the operating system (on iOS, the “identifier for vendor”). It is not your name, but it is a persistent identifier, so we do not call it anonymous. It links your Premium status, push-notification registration and cloud backup to your device, and it is also your user ID at RevenueCat.
Premium status: the app sends the device identifier to our server to check whether Premium is active. The server stores the identifier, platform, Premium status and expiry date, and the time the device was last seen.
Push notifications (optional): when your device provides a push token, the app sends it to our server together with the device identifier, platform and device information (model, OS version, whether it is a physical device and, on iOS, the device name set in Settings, which may contain your name). If you turn notifications off inside the app, the token is removed from our server.
Cloud backup (Premium; only when you tap backup): your book list is uploaded: title, author, status, start and finish dates, tags, genre, ISBN, page counts, description, publisher, favourite flag, reading progress, purchase details (price, currency, store, date) and lending details (name of the person you lent the book to or borrowed it from, dates, notes). Cover images and photos are not included. We keep one backup per device and replace it every time you back up.
Subscription events: RevenueCat notifies our server about purchases, renewals, cancellations and expirations (event type, product, device identifier, expiry date and the other event details RevenueCat sends). We store these events to keep Premium status correct.

3. Third-party services

These services run inside the app or receive data from it. Each of them also sees your IP address when your device connects to it. They handle data under their own privacy policies and may process it in countries other than yours.

Service	Data it receives	Purpose	More information
Google AdMob (Google Mobile Ads SDK)	Advertising identifier where available and allowed (IDFA on iOS, advertising ID on Android), other device identifiers (e.g. identifier for vendor), IP address (rough location), device and OS information, ad impressions and interactions, app launches, crash and performance data.	Showing and measuring ads, limiting repeats, fraud prevention and (unless you restrict it) personalizing ads.	Privacy policy How Google uses ad data
RevenueCat	App user ID (our device identifier), purchase and subscription history (products, dates, status), locale and currency.	Managing and validating Premium subscriptions.	Privacy policy
Firebase Cloud Messaging (Google)	Push registration token, Firebase installation ID, device model, OS and app version, language and time zone.	Delivering push notifications.	Privacy policy
Google Books API	The search text, title or ISBN you type when looking up a book (sent without your device identifier).	Finding book details and covers.	Privacy policy
Open Library (Internet Archive)	The same search text, title or ISBN, plus requests for cover images.	Finding book details and covers.	Privacy policy

The app does not include Firebase Analytics, Crashlytics or any other analytics, crash-reporting or attribution SDK apart from those listed above. Payments are processed by Apple (App Store) or Google (Google Play); we never receive your card or payment details.

4. Advertising and your choices

The free version shows ads served by Google AdMob (mainly full-screen ads that appear from time to time, for example while adding books). To deliver and measure ads, AdMob receives the data listed in the table above. The app does not switch AdMob to non-personalized mode, so by default ads may be personalized based on that data.

On iPhone and iPad, the advertising identifier (IDFA) is only available to apps you have allowed to track you. You can decide this in Settings > Privacy & Security > Tracking (Apple’s explanation). Without that permission ads can still be shown, but without using the IDFA; AdMob may still use other signals, such as your IP address and the identifier for vendor, to deliver ads, limit repeats, measure results and prevent fraud.

On Android you can reset or delete your advertising ID and turn off ads personalization in Settings > Google > Ads. You can also manage Google’s ad personalization at Google Ad Settings.

Premium removes ads from the screen. At the moment the ad SDK is still started when the app opens, so a Premium device may still contact Google’s ad servers.

5. How long data is kept

On your device: until you delete it or uninstall the app.
On our server: the device record (identifier, platform, push token, device information, Premium status, last seen), the subscription events and your backup are kept until you ask us to delete them. There is no automatic expiry. A backup is replaced by your next backup. Uninstalling the app or cancelling Premium does not delete this data.
Web server logs (IP address, time, requested address, app or browser identification) are kept for security and troubleshooting. They are rotated by size, so they can stay for several months. In some requests, such as the Premium check and backup restore, the device identifier is part of the requested address.
Third-party services: according to their own policies (see the table).

6. Deleting your data

The app does not currently have a button to delete the cloud backup or the server record. To have them deleted, e-mail us at the address below and tell us your device model and name (as shown in Settings), the platform (iPhone or Android) and roughly when you used the app; because there are no accounts, this is how we match a request to a device. We will delete the device record, push token, backup and subscription events we hold for that device. To delete data held by Google, RevenueCat or another provider, contact them or use their privacy tools.

7. Security

The app and our server communicate over HTTPS. There are no passwords: access to your Premium status and backup is tied to your device identifier, and backups are stored in our database without end-to-end encryption. Please do not put sensitive information in fields that get backed up, such as lending notes.

8. Your rights

Depending on where you live (for example under the GDPR in the EU and UK, or KVKK in Türkiye), you may have the right to access, correct or delete your personal data, to object to certain processing and to complain to your data protection authority. Contact us at the address below. Because we only know your device and not who you are, we may ask for the device details described in section 6 to act on a request.

9. Changes

If we change this policy, we will publish the new version on this page and update the date above.

10. Contact

Questions and requests: ibrahimyavuznt@gmail.com