Privacy Policy

What we collect

When you use Leatherbound we collect only the information needed to catalogue and value your library:

• Account information. Your email address, display name, and a cryptographically hashed password. If you sign in with Google or Apple, we receive the identifier and email address provided by that service; we never receive your Google or Apple password.
• Library data. The shelf photos you scan, the book records created from those scans (titles, authors, editions, condition grades, estimated values), any additional photos you upload for a book, acquisition notes you record, collection folders you create, and edit history on your records.
• Payment information. When you purchase a catalogue package, your payment is processed entirely by Stripe. We store a Stripe customer identifier on your account so we can look up your purchase history. We never see or store your full card number.
• Automatically collected data. We collect basic server logs (IP address, request timestamps, error traces) to keep the service running and to diagnose problems. We do not use analytics SDKs, advertising identifiers, device fingerprinting, or tracking pixels.

We do not collect more than we need to provide the service.

How we use your data

We use your data to operate Leatherbound: to identify your books, estimate their market value, store your catalogue, process your payments, send you service-related notifications (such as monthly digest emails), and improve the reliability of the service. We do not use your data for advertising, profiling, or behavioral targeting.

How we share your data

We share data only with the service providers that make Leatherbound work:

• Google (Vertex AI / Gemini)— your shelf and book images are sent to Google’s Vertex AI platform for identification and pricing analysis. Leatherbound uses Vertex AI’s paid tier, which means Google does not use your prompts, images, or responses to train or improve its AI models. Google may log this data for a limited period solely for abuse detection and legal compliance, per its Cloud Data Processing Addendum.
• Stripe— your email and payment details are shared with Stripe to process catalogue-package purchases. Stripe’s handling of your data is governed by Stripe’s Privacy Policy.
• Supabase — your images and database records are hosted on Supabase (backed by AWS infrastructure). Supabase acts as our data processor and does not use your data for its own purposes.
• Railway— our application servers run on Railway’s hosting platform.

We do not sell your data to third parties. Leatherbound contains no advertising SDKs, tracking SDKs, or analytics SDKs.

We may also disclose your data if required by law, subpoena, or court order, or if we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Data storage and security

Your data is stored in the United States. Images and uploaded files are stored in cloud storage hosted by Supabase (on AWS infrastructure), referenced by unguessable identifiers. Database records are stored in a managed PostgreSQL database. Backups are encrypted at rest by our infrastructure providers.

We use industry-standard security practices including hashed passwords, authenticated API endpoints, and server-side access controls. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Data retention

We retain your data for as long as your account is active. Deleted items (books, scans) are held in a soft-delete trash for 30 days before permanent removal. Automated library backups are retained for 30 days and then expire. Infrastructure backups (database snapshots, storage manifests) are retained according to our documented backup schedules and then permanently deleted.

When you delete your account, we remove your account and associated library data. Some data may persist in encrypted infrastructure backups for up to 30 days after deletion before those backups expire.

Your rights

• Export — download a full JSON export of your library data from Account → Backups. You can also export your collection as a CSV or insurance PDF at any time.
• Delete — permanently delete your account and associated data from Account → Delete Account.
• Correct — edit any book record directly in the app.
• Restrict processing — if you stop using the service, your data sits dormant. We do not process it for any purpose other than keeping your account available to you.

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction that grants additional data rights (such as the right to data portability or the right to object to processing), you may exercise those rights by contacting us. We will respond within 30 days.

Children’s privacy

Leatherbound is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete that data promptly. If you believe a child under 13 has provided us with personal information, please contact us.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through the app before the changes take effect. The “Effective” date at the top of this page indicates when the policy was last revised.

Contact

Questions about your privacy? Reach us at support@leatherbound.ai.