Readpin Privacy Policy
Effective date: August 2, 2026
Readpin is a reading app that lets you pin books to the places you read them. This policy explains what information Readpin collects, how it's used, and the choices you have. We've tried to keep it short and in plain English, because our data practices are simple: we collect what the app needs to work, we don't sell your data, and we don't show you ads.
Contact: support@readpin.org.
What we collect
Account information. When you sign up (with Apple, Google, or email), we store your email address, username, display name, and — if you add them — a bio and profile photo. Apple and Google sign-in share your name and email with us as part of signing in; if you use Sign in with Apple's private relay, we only see the relay address Apple provides.
Sign in with Apple. If you sign in with Apple, we also store an encrypted token Apple gives us alongside your account. It has exactly one purpose: when you delete your account, it lets us tell Apple to revoke Readpin's access, so the app disappears from your Apple ID too. It's encrypted at rest, never sent to your device, and used for nothing else.
Email we send you. Readpin sends transactional email only — confirming your address when you sign up, and a reset link when you ask to change your password. We don't send marketing email. Delivery is handled by Resend, which receives your email address and the one-time link so it can deliver the message.
Your content. The heart of Readpin is what you create: book pins (the book's title and author, the pin's location, an optional note, an optional photo, and the date), your shelf (which books you've read, are reading, or want to read), your genre preferences, and any recommendations you share. If you import your reading history from Goodreads or StoryGraph, the file is read on your device and we store the books from it.
Location. Readpin uses your device's location (with your permission) in three situations, all in the foreground while you're using the app: when you open the map, to center it on where you are; when you drop a pin, to suggest your current location; and when you set up a privacy zone in Settings. Readpin never tracks your location in the background. When the app turns coordinates into a readable address, that lookup is handled by your device's built-in (Apple) geocoding service. You can always type or edit a location manually, and location permission can be revoked at any time in iOS Settings — the map and pins still work without it.
We want to be precise about what a pin actually stores, because location is the most sensitive thing in this app. A pin keeps its exact coordinates — not a rounded or approximate value — together with the place name and the city, state, and country resolved from it. If you set a privacy zone, we also store the home coordinates you chose and the radius you picked, so the app knows what to hide.
Your privacy zone is the protection. Any pin that falls inside it is hidden from your friends — and hidden means all of it. The coordinates, the place name, and the city, state, and country are withheld together, so a masked pin doesn't quietly leak the town it was in. The same masking applies to pins you mark "hide location" and to pins you keep set to "just me". Friends never read your pins directly: the app serves them through a filtered view that applies these rules on our servers, so a masked location is never sent to their device in the first place.
Friends. If you connect with friends, we store those connections so the app can show you each other's shared pins.
Safety and moderation. If you block someone, or report a pin or an account, we store that as well — who reported what, and the reason given — so that blocks stay in effect and we can act on reports.
Subscription status. If you subscribe to Readpin Premium, our payments partner RevenueCat manages your subscription status. RevenueCat identifies you by a random token we generate for that purpose alone — not your name, not your email, and not your Readpin account ID — so a subscription record can't be tied back to your account by someone holding it. Payment itself is processed entirely by Apple — we never see or store your payment card details.
Crash and error data. If the app crashes or hits an error, we receive a technical report through Sentry (device model, OS version, app version, and the technical details of the error). These reports are configured to exclude personal information and are not linked to your account.
What we don't collect
- We don't sell your data. To anyone, ever.
- We don't show ads and don't share your data with advertisers.
- We don't track you across other apps or websites.
- We don't use product analytics or behavioral tracking SDKs, and we've disabled our map provider's optional telemetry.
- We don't collect your location in the background.
- We don't send marketing email, and we don't add you to a mailing list.
- We don't read your contacts or messages, and we can only access the specific photos you choose to attach.
How we use your information
We use your information for one purpose: making Readpin work. That means storing and displaying your pins and shelf, showing your shared content to the friends you've connected with, operating your subscription, sending the account emails described above, keeping the service secure, and fixing crashes and bugs.
Who can see your content
You control visibility. Each pin has a visibility setting, and you can set your default in Settings. Pins you share are visible to your accepted friends; private pins are visible only to you. These rules are enforced on our servers rather than just hidden in the app: friends read your pins through a filtered view that applies your visibility and privacy-zone settings before anything leaves our database.
One exception is worth knowing about. Profile photos are public. Your avatar — and the small map marker generated from it — is stored in a public bucket, which means anyone who has its direct link can open it without signing in. Photos you attach to pins are not public: those stay private and are served only to people your settings allow.
Services we rely on
Readpin runs on a small set of infrastructure providers, each receiving only what's needed for its job:
- Supabase — hosts our database and file storage (your account data, pins, and photos live here).
- Resend — delivers the transactional email described above. It receives your email address and the one-time link, and nothing else.
- Mapbox — renders the map, generates the small map images shown on pins in the feed, and powers location search. When you search for a place, your search text (and your approximate location, to rank nearby results) is sent to Mapbox. We have disabled Mapbox's optional usage telemetry.
- RevenueCat — manages subscription status, as described above.
- Sentry — receives crash and error reports, configured to exclude personal information.
- Open Library, Google Books, and The New York Times Books API — we use these to fetch book covers, descriptions, and bestseller lists. Your book searches are sent to Open Library, and cover lookups may send a book's title or ISBN to Google Books. Bestseller lists are fetched by our servers, not your device. No account information is shared with any of them.
- Bookshop.org — "Buy this book" links open Bookshop in your browser. The link carries only the book's ISBN or title. Once you leave Readpin, Bookshop's own privacy policy applies.
- Expo — hosts the over-the-air updates the app downloads to keep itself up to date.
- Cloudflare — serves this website. The app itself doesn't route through it.
We don't have "data partners" beyond this list, and none of these providers is permitted to use your data for their own advertising.
Data retention and deletion
Your data is kept for as long as you have an account. You can delete your account at any time in Settings → Delete Account inside the app. Deletion is real: it permanently removes your account, pins, photos, shelf, friend connections, blocks, and reports from our systems, including file storage. If you signed in with Apple, deleting your account also revokes Readpin's access to your Apple ID.
Two exceptions we can't honestly claim otherwise:
- Purchase records. If you ever subscribed, the record of that purchase is held by Apple and by RevenueCat under their own retention policies, which they keep for billing, tax, and refund purposes. Deleting your Readpin account does not remove it from them, and we have no way to delete it on your behalf.
- A pending Apple revocation. If we can't reach Apple at the moment you delete your account, we keep the encrypted revocation token on its own — with no name, email, or other account data attached — until a retry succeeds, and then delete it. This exists so the revocation actually happens instead of being silently dropped.
Crash reports in Sentry (which aren't linked to your identity) age out automatically under Sentry's retention period.
You can also email support@readpin.org to request deletion or a copy of your data.
Security
Your connection to Readpin is encrypted in transit (TLS). Data access on our servers is enforced with row-level security so accounts can only read what their permissions allow, and your login session is stored encrypted on your device.
Children
Readpin is not directed at children under 13, and we don't knowingly collect information from anyone under 13. If you believe a child under 13 has created an account, contact us at support@readpin.org and we'll delete it.
Changes to this policy
If we make material changes, we'll update this page and the effective date above. Continued use of Readpin after a change means you accept the updated policy.
Contact
Questions, requests, or concerns: support@readpin.org