Legal
Privacy policy
Last updated September 3, 2026 · Terms · Data sources
1 · Who operates Loreful
Loreful is operated by Bahdan Bakunovich, a sole proprietorship (JDG) registered in Poland (NIP 7252311766, REGON 389812819). For anything about your data, write to contacts@loreful.app.
2 · What we store
Your email, your read-states and ratings, and the series you track — that's the product. If you make your profile public, its display name and the shelves you choose to show are visible to anyone with the link. There is no advertising profile, and nothing is collected beyond what the pages need to work.
3 · Cookies and local storage
One cookie: a session cookie that keeps you signed in, set HttpOnly so no script — ours or anyone else's — can read it. Signing in with Google briefly sets a second, short-lived cookie for that handoff only. Your theme choice (dark or light) lives in your browser's local storage, not a cookie — we never see it. None of this needs a consent banner: nothing here is used for tracking or advertising.
4 · Analytics
Loreful runs its own first-party analytics — no Google Analytics, no ad pixel, nothing that talks to another company's server. Your browser sends event names (a click on a handful of buttons, a page settling) and a few allow-listed properties to our own /api/events. Events from one browser tab are correlated by a random id kept in that tab's session storage; our server stores only a one-way hash of that id, never the id itself, and never your IP address — not even hashed. There is no user id on an analytics event, signed in or not.
5 · Third parties
None run in production today. Book cover thumbnails are fetched by your browser directly from their original source — ISFDB, Open Library, or a publisher — with no referrer sent, so that host can't tell which page you were on (see Data sources & licenses). The sign-up form has a wired-but-inactive seam for Cloudflare Turnstile, a bot check: no site key is configured and our content-security policy does not yet allow its script to load, so nothing from Cloudflare runs. If that changes, this page will say so first.
6 · Your rights
Delete your account any time from Settings — it's an immediate, cascading erasure: your login, profile, read-states, ratings and tracked series are all removed. A small number of already-pseudonymous rows (nothing identifying survives on them) can take up to a few hours to clear through a background sweep that runs a few times a day. Download a full copy of your data any time from Settings → "Download my data" — a ZIP of CSV files covering everything tied to your account, available once every 10 minutes. For anything else — access, correction, objection, or a question — write to contacts@loreful.app.
7 · What we never do
Sell your data, share your shelves without your say-so, or lock public pages behind a login.
8 · Data sources & licenses
Loreful's catalog is built on open data, each source credited with its license on Data sources & licenses.