Privacy
Specific to this app rather than boilerplate, because boilerplate tells you nothing true.
What is stored
Your name, your email address, optionally a line about what you read and a picture. Then whatever you do in a club: your place in the current book, what you post, how you rate a book, whether you are coming to a meeting, and your private notes.
What leaves the club
By default, nothing. A club is private and invisible when it is created. Its organiser can choose to give it a public profile, and can choose which of four things that profile shows: the current book, the shelf and totals, the members' names and faces, and that the club meets and when.
Four things are never public, whatever anybody ticks: the club's discussion, private notes, everybody's reading progress, and email addresses. There is no setting that releases them. Where a meeting takes place is also never public — only that there is one, and when.
Your address in particular
It is the credential: a sign-in link goes to it, so it is treated as one. It appears on no page anybody else can read, including a club's own members list. Sign-in links themselves are stored only as a hash, expire in half an hour, and work once.
Email you receive
Four things a club does — a date set, a date called off, voting opened, a book chosen — plus one round-up a week. Organisers also hear when somebody asks to join their club. One switch in your settings turns all of it off. Nothing is marketing, because there is nothing to sell you.
Third parties
Book titles, authors and cover images come from Open Library, which we query for a book you look up and then copy into our own database — so no page you load waits on them, and they are not told who is reading what. Fonts are served by Google Fonts. There is no analytics, no advertising and no tracking of any kind.
Closing your account
From your settings, at any time. Your notes, your reading progress, your meeting answers and your ratings are deleted. What you wrote to a club — threads, replies, questions, nominations — stays under your name, because other people are still reading it and removing half a conversation damages the record for everybody else. If you would rather it went too, ask an organiser to delete the posts before you close the account.