Privacy

Complaints and AI assistance

When a complaint is raised, we store the reporting account, the reference to an order or review received, messages, handling status and timestamps. The conversation is visible only to the reporting account and the responsible Relibro administration team. The other party to the purchase cannot access this conversation.

Cloudflare Workers AI assists with the initial assessment and the choice of a follow-up question or guidance. It receives the message text and necessary details such as book title and order status. Payment data, delivery addresses and reviews that are still hidden are not automatically sent to the AI. Please do not enter passwords, bank or card details in messages. The AI cannot issue refunds, restrict accounts or remove reviews. Personal review can be requested at any time.

We use this data to handle the request and provide the complaints process under Article 6(1)(b) GDPR. Conversations and handling records are retained for processing and necessary evidence, then deleted unless statutory obligations or outstanding claims require continued retention.

Seller profiles, listing reviews, reports and ratings

On each listing, we display the seller's public name and their stated private or business status. Business profiles also publish the company name and business address. The account address and internal user ID are not published as seller contact details.

To review listings before publication, Cloudflare Workers AI and our administration team process listing details and uploaded photos. The AI does not receive sign-in passwords or account tokens for this purpose. A review note is stored with the listing status. Listings that raise concerns or cannot be checked for technical reasons are held for human review. The legal basis is Article 6(1)(f) GDPR; our interest is to prevent fraud, spam and unlawful listings. You can send objections to this review to info@apptheism.de.

When a listing is reported, we store the listing reference, reason, description, time and any contact address provided voluntarily. These details are visible only to the responsible administration team. To prevent abuse, we use time-limited request counters; for reports, these use an identifier derived from the IP address that changes daily. Reports and reasoned moderation decisions are retained for processing and necessary evidence, then deleted unless legal obligations or outstanding claims prevent this. The legal basis is Article 6(1)(f) GDPR.

Reviews are linked to the submitting account, the reviewed account and the completed order. Buyers and sellers can review each other. Until both have submitted or the 14-day period ends, reviews stay hidden from the other person and the public. After that, stars, date and the role as buyer or seller appear on the profile; averages and counts also include only visible reviews. Order verification and display are provided as part of the review feature under Article 6(1)(b) GDPR.

Data controller

Apptheism®, owner Jörg Klausewitz, Fischmarkt 17, 78462 Konstanz, Germany. Contact: info@apptheism.de, telephone 07531 2841665.

Visiting the website

Relibro runs on Cloudflare. To display the site on your device, your IP address, the time, requested URL, browser details and the technical result of the request are processed. These data also help us detect outages and attacks. The legal basis is Article 6(1)(f) GDPR; our interest is an accessible and secure book marketplace. Logs are removed according to the hosting service's applicable settings. We retain data needed to investigate a specific security incident only for handling that incident.

Website statistics with Plausible

We use Plausible Analytics from Plausible Insights OÜ, Tartu, Estonia, to understand which pages are visited and how visitors find Relibro. This involves analysing the page path, visit sources, browser and device type, and an approximate region. Plausible uses no cookies for this and stores neither full IP addresses nor persistent identifiers. Search terms and other URL parameters are not collected, except for campaign parameters. According to Plausible, visitor data are processed and stored in the EU. The legal basis is Article 6(1)(f) GDPR; our interest is to improve the website using aggregated usage figures.

Further details are provided in the Plausible data policy.

Account and sign-in

You can browse and search for books without an account. For a seller account, Relibro needs your email address and sign-in details. Supabase Auth handles registration, sign-in, confirmation messages and password resets. Your password is not stored as plain text in our listing database. If we offer sign-in with Apple or Google and you use it, the selected service transmits the account data needed to sign in; its privacy notice also applies. The legal basis is Article 6(1)(b) GDPR.

To keep you signed in, the website stores session data in your browser. It needs these data for the account feature you have chosen. You can sign out and also delete browser data on your device. Your account remains until deletion, unless we are legally obliged to retain certain details for longer. While signed in, you can submit a deletion request under “My account”.

Following and blocking

When you follow or block a profile, we store the accounts involved and the time in Cloudflare D1. Your public profile name and the numbers of your followers and followed profiles are visible. Without a seller profile, we initially use “Member”; you can choose a public name under “My account → Contacts”. Your private account name and email address are not published for this purpose. If you enter a city and country in your account profile, these voluntary details are also displayed on your public profile. You can change or clear them there at any time. Sellers you follow may be prioritised in homepage recommendations; “Only followed sellers” restricts the selection to them. Additional ad placements from the relevant account are not shown to the account itself or when blocked. Individual contact lists and your block list are accessible only to you.

Blocking removes mutual follows and prevents new purchases and price offers between the accounts. Public listings and existing orders remain accessible. You can unfollow and unblock under “My account → Contacts”, which deletes the respective relationship. Deleting an account also removes its relationships and public member profile.

Listings, photos and wishlist

A published book includes your chosen price, condition, description and up to eight of your own photos, along with book details such as title, author and ISBN. We also store when the listing was created and which seller account it is technically linked to. Active listings are visible to all visitors. Please therefore check photos and free text for private information before uploading. Book data are stored in Cloudflare D1 and uploaded photos in Cloudflare R2. The legal basis is Article 6(1)(b) GDPR. When you remove a listing, we delete its uploaded photos; the book record is initially marked as removed and later deleted once we no longer need it for operations, preventing abuse or possible claims.

For price changes and discount promotions, we store the price, validity period and associated change history. For price offers, we store the listing, accounts involved, amount, decision and expiry time to provide the price agreement. Automatic acceptance and rejection thresholds are visible only to the seller. The legal basis is Article 6(1)(b) GDPR.

The basket and wishlist store your selection in local browser storage, separately for each signed-in account. There is no synchronisation between devices. The last ten search queries also remain in local browser storage. You can clear your search history directly in the search field.

Book search, covers and scanning

When you enter a title, author or ISBN, Relibro receives this search query. Our server uses it to search Open Library; if ISBN data are incomplete, it may query the German National Library. These providers receive the search terms or ISBN from the server request. Some cover images are loaded directly from Open Library into your browser; the provider also receives your device's usual connection data. Book search is based on Article 6(1)(b) GDPR, and cover display on Article 6(1)(f) GDPR.

The website scanner reads ISBNs or book titles directly in the browser. The camera image is not sent to our server. This separate scanner does not transmit images for automatic listing recognition. For browser text recognition, Relibro loads program and language files from jsDelivr; the provider receives the connection data needed to retrieve them. Your browser may cache these files.

In the listing form, selected book photos and an optional title are sent to Relibro and Cloudflare Workers AI for automatic recognition before saving. This produces editable suggestions for book details, description and visible condition; the suggested price is a rough estimate. Relibro does not save the photos from this recognition request as a listing or in photo storage. Only the subsequent save submits the listing for publication. To limit automated requests, we store time-limited counters using an identifier derived from the IP address that changes daily.

Contact, support and advertising enquiries

When you enquire about banner advertising, we store your name, email address, company and destination URL where provided, and the ad placement, preferred dates, message, processing status and time in our Cloudflare D1 database. These details are visible only to the responsible administration team and are used to process and respond to the enquiry. To counter automated requests, we use time-limited counters with an identifier derived from the IP address that changes daily. An enquiry does not publish advertising or subscribe you to a newsletter. The following information on contact enquiries applies to processing and deletion.

When you contact us by email, we process the sender address, content and metadata needed to handle your enquiry. The legal basis is Article 6(1)(b) GDPR for enquiries about an account or listing, or otherwise Article 6(1)(f) GDPR for handling the enquiry. We delete the message once the matter is resolved and there is no retention obligation or legitimate need for documentation.

Recipients and transfers

Several services work together for Relibro: Cloudflare serves the website and stores book listings and photos; Supabase handles account sign-in; Plausible produces website statistics. Open Library supplies search results and covers, and the German National Library occasionally supplements ISBN data. Opening an external book profile or loading a cover directly also establishes a connection to that provider. Cloudflare, Supabase, Open Library and jsDelivr may process data outside the European Economic Area. The Cloudflare data protection agreement and the Supabase agreement provide for EU Standard Contractual Clauses for the relevant transfers. You can ask us about a specific transfer at the email address given above.

Browser storage

Your browser stores session data for sign-in. Program files technically required for book search and the scanner may be cached.

Your rights

You can ask which data we hold about you, have errors corrected and, subject to the legal requirements, request a copy, deletion, restriction or portability. You can object to processing based on legitimate interests and withdraw consent with effect for the future. To do so, write to info@apptheism.de. If you are not satisfied with our response, you can contact a data protection supervisory authority, particularly the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

iPhone app

The native app is also covered by the App privacy notice.