Privacy Policy

1. Who we are and what this covers

BookTok ("BookTok", "we", "us") is operated by Youkla. This Privacy Policy explains what personal data we collect when you use booktokbooks.app and the BookTok apps and services (together, the "Service"), why we collect it, who we share it with, how long we keep it, and the rights you have over it.

BookTok is a streaming library of book summaries. Our team turns published books into short narrated video episodes, made with the help of AI, and subscribers watch them on the web or download them.

We are the data controller for the personal data described here. If you have any question about this policy, write to [email protected].

2. The data we collect

We collect only what the Service needs to work. Here is the full list.

Category	What it includes	Why we need it
Account	Name, email address, profile picture from your sign-in provider, sign-in method	To create and secure your account and to contact you about it
Your library	Books saved to My List, watch progress for each episode, books you requested	To resume where you stopped, show your list, and decide which books to make next
Billing	Plan, payment status, invoices, Stripe customer id	To bill you and to answer billing questions. We never see full card numbers
Usage and device	Pages visited, actions taken, browser type, approximate location from IP address, error reports	To keep the service working, find bugs, and prevent abuse
Messages	Anything you write to support, including screenshots you attach	To answer you

We do not collect government identifiers, precise location, biometric templates, or health data, and we do not build profiles of you from third-party sources.

3. Photos and other files you upload

BookTok has no uploads. Our team makes every episode, and the only things you add are your list, your watch progress, and your book requests.

We use them to show your list, resume an episode where you stopped, and count requests for each book. Other users can see how many people requested a book, never who.

Episodes are made with AI models for the script, the narration, and the pictures. None of your account data goes into making them.

Remove a book from My List and it is gone from your account. Ask us to close your account and your list, progress, requests, and account record tied to it is deleted, apart from invoices we must keep for tax law.

4. Children

Each book shows an age rating. Accounts are for adults, and if a child watches on your account, you decide which books they see.

Anyone under 18 may not create an account. If you believe a child has given us personal data directly, or that a photo of a child was uploaded without a parent's or guardian's permission, write to [email protected] and we will delete it.

5. Why we process your data, and the legal basis

Where the GDPR, UK GDPR, or a similar law applies, we rely on the following legal bases:

Performing our contract with you. Creating your account, generating what you asked for, storing it in your library, billing you, and answering your support requests.
Consent. Handling photos of other people, including your children, which you confirm you have permission to upload. Marketing emails, where you opted in. Analytics and advertising cookies on marketing pages, where the law requires consent. You can withdraw consent at any time; withdrawing it does not affect processing that already happened.
Legitimate interests. Keeping the Service secure, preventing abuse and fraud, measuring which features fail, and improving the Service. We balance these interests against your rights and do not rely on them for anything you would not reasonably expect.
Legal obligations. Keeping billing records for tax and accounting law, and answering lawful requests from authorities.

We do not use your personal data for automated decisions that have legal or similarly significant effects on you.

We never sell personal data. We never share it with data brokers or advertisers for their own use. We share it only with the service providers below, who process it on our instructions, under contracts that limit what they may do with it.

Provider	What they do for us	Where
Stripe	Payments and subscription billing. Card numbers go to Stripe, never to our servers	United States / EU
Mailgun	Transactional email: sign-in codes, receipts, ready notifications	United States / EU
Google Analytics, Meta Pixel, TikTok Pixel	Aggregate traffic and ad measurement on marketing pages	United States

We may also disclose data if the law requires it, to protect the rights and safety of you, us, or others, or as part of a merger or sale of Youkla, in which case this policy continues to apply to your data.

7. Cookies, analytics and advertising

The Service uses a small number of cookies and similar technologies:

Strictly necessary. Signing you in, remembering your session and your preferences. These cannot be switched off without breaking the Service.
Analytics. PostHog and Google Analytics tell us which screens are used, which fail, and where people get stuck. Data is aggregated; we do not use it to identify you.
Advertising measurement. On marketing pages only, Meta Pixel and TikTok Pixel let us see whether an ad led to a sign-up. They do not run inside the app after you sign in.

You can block cookies in your browser settings, opt out of ad measurement through Meta and TikTok's own ad settings, and use browser extensions that block trackers. Blocking necessary cookies will prevent sign-in.

8. International transfers

Our providers operate in the United States and the European Union. When personal data leaves the EEA, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-US Data Privacy Framework, and we take additional measures where a transfer risk assessment calls for them.

9. How long we keep data

Account data stays for as long as your account exists.
Your list, watch progress, and requests stay as long as your account exists.
Billing records are kept for as long as tax and accounting law requires, typically seven years.
Server logs and analytics events are kept for up to 12 months.
Support conversations are kept for up to 24 months so we can follow up on earlier issues.

When data is no longer needed we delete it or anonymise it so it can no longer be linked to you.

10. How we protect data

Every connection to the Service is encrypted with TLS.
Files are stored encrypted at rest, in per-account folders, under random file names that cannot be guessed or enumerated.
Our database is encrypted in transit and access to it is limited to the systems that need it.
Payment card details are entered directly into Stripe and never pass through our servers.
Access to production systems is restricted to the people who operate the Service, protected by multi-factor authentication, and logged.

No system is perfectly secure. If we discover a breach that affects your personal data we will tell you and the relevant authority without undue delay, as the law requires.

11. Your rights

Depending on where you live you have some or all of the following rights, and we honour them for everyone, wherever you are:

Access. Ask for a copy of the personal data we hold about you.
Correction. Ask us to fix data that is wrong.
Deletion. Ask us to delete your data. Most content you can delete yourself inside the Service; for the whole account, write to us.
Portability. Receive the data you gave us in a machine-readable format.
Objection and restriction. Object to processing based on our legitimate interests, or ask us to pause it while we check a request.
Withdraw consent. For anything we do on the basis of consent.
Complain. Lodge a complaint with your data protection authority. In the EU that is the authority of the country where you live; in the UK it is the Information Commissioner's Office.

California residents (CCPA/CPRA). You have the right to know what personal information we collect and how we use and share it, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you. We have not sold personal information in the preceding 12 months.

Other US states. Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights of access, correction, deletion, and portability, and the right to opt out of targeted advertising and profiling. We do not engage in profiling that produces legal or similarly significant effects.

To exercise any right, write to [email protected] from the email address on your account, or use the contact page. We verify requests by confirming control of that email. We answer within 30 days, or within the shorter period your local law requires, and we never charge for a request unless it is clearly unfounded or repetitive. You may authorise someone else to make a request on your behalf; we will ask for proof of that authorisation.

12. Marketing emails

We send transactional emails you cannot opt out of while you have an account: sign-in codes, receipts, and notices that something you made is ready. We send marketing emails only if you asked for them, and every one has an unsubscribe link.

13. Links to other sites

The Service may link to sites we do not control, such as Stripe's checkout or a payment receipt. Their privacy policies apply there, not this one.

14. Changes to this policy

When we change this policy we update the date at the top. If a change reduces your rights or changes how we use existing data in a way you would not expect, we email account holders before it takes effect.

15. Contact

Youkla, operator of BookTok
Privacy requests: [email protected]
Everything else: [email protected]

These Terms and any dispute arising from the Service are governed by the laws of the country in which Youkla is established, without regard to conflict-of-law rules, and subject to the mandatory consumer protection rules of the country where you live.