Privacy Notice
What information we collect, why we have it, who else sees it, and what you can ask us to do about it.
Last updated 2 October 2026Who we are
Literally is a social reading platform, operated by Literally Books Ltd (company number 17407736), a company registered in England and Wales with its registered office at 66 Paul Street, London, England, United Kingdom, EC2A 4NA. Literally Books Ltd trades as “Literally” and is the controller of your personal data. This notice explains what we do with it.
For privacy questions, contact us at Support@literallyapp.com.
Literally Books Ltd is registered with the UK Information Commissioner's Office, registration reference ZC226038, registered 18 August 2026 and due for renewal 17 August 2027.
Information that we collect
We collect what you create on Literally:
- Content you create, such as posts, comments, reviews and reading progress updates.
- Images you upload, such as your profile picture.
- The books on your shelves and in your collections.
- Messages you send and receive in book clubs, including their content.
And the information you give us. Some of it is needed to create an account; the rest is optional, and is there so you can fill out your public profile.
- Email address*
- Password*
- Date of birth*
- Display name or username*
- Profile picture
- Bio
- Country
- City
- Gender
- Reading preferences, such as favourite genres
* Required to create an account. Date of birth is used to check your age.
We also keep a record of how you use Literally — the pages you view, the searches you run, and the recommendations you were shown.
If you join the waitlist on our website, we keep your email address, which phone you use if you tell us, the page you signed up on, and how you reached the site: the address of the website that sent you, without the rest of its link, and any campaign tags in the link you followed. If you don’t confirm your email within 7 days, the sign-up is deleted. Otherwise we keep it until we tell you the app is ready, or until you leave the waitlist with the link in our emails, which deletes it straight away.
How your information is shared
Most of what you add to Literally is visible to other readers: your profile, your shelves, your reviews, your posts, and the book clubs you take part in. Settings controls what is public.
We also use other companies to run the platform. They process data on our instructions.
Companies that process data on our behalf
| Who | What they receive | Why | Where |
|---|---|---|---|
| Supabase | All information | Database and file hosting | Switzerland |
| Vercel | Site requests and server logs | Website hosting | US |
| Resend | Your email address and the message we send you | Email delivery | EU |
| Sentry | Error reports, including the page you were on | Error monitoring | EU |
| Stripe | Payment and subscription details | Payments | Ireland / US |
| Site activity, with your consent | Analytics | US | |
| GitHub | The description and screenshot you send with a bug report | Issue tracking | US |
| OpenAI | The text you post publicly, and your profile fields1 | Content moderation | US |
| Anthropic | Access to the live database during development2 | Platform development | US |
1 Moderation
Text you post publicly is checked for harmful content before it appears, by sending it to OpenAI. Your email address and internal account id are not sent with it. OpenAI deletes the text after 30 days, keeping it only so they can detect misuse of their service, and does not use it to train their models.
2 The tools we build with
Parts of Literally are built and maintained with AI development tools from Anthropic, which are connected to the live database. Information you have given us can be read during development work. We do not use these tools to browse readers' content, and Anthropic does not train their models on what they see.
Transfers outside the UK
Switzerland is recognised by the UK and the EU as providing an adequate level of protection. Transfers to the United States rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses. Ask us and we will send you a copy.
Our lawful bases
| What we are doing | Lawful basis |
|---|---|
| Running your account and the social features | Performance of our contract with you |
| Moderating content and scoring trust | Legal obligation, and our legitimate interest in a safe platform |
| Understanding how the site is used | Legitimate interests — statistical purposes |
| Google Analytics | Consent — see the Cookie Policy |
| Telling you when the app is ready, if you joined the waitlist | Consent |
| Learning which websites and campaigns bring people to the waitlist | Legitimate interests — statistical purposes |
| Marketing email | Consent |
| Taking payment | Contract, and legal obligation |
Where we rely on legitimate interests, you can object — see Your rights below.
Automated systems and profiling
Some decisions about you are made automatically.
Moderation
Text you post publicly is scored automatically before it appears. Content that scores badly can be blocked or hidden, and your scores over time feed a trust score that affects how strictly your later posts are treated.
Challenging a moderation decision
If something you wrote is removed we tell you why, and whether the decision was made automatically or by a person. You can appeal for six months after the removal. A person reviews the appeal and writes back to you.
Your home feed
What you see is ranked by who you follow, the books you have read, and what you have engaged with.
Marketing email
We only send marketing email if you have opted in.
You can withdraw at any time, in Settings or with the unsubscribe link in any marketing email. It takes effect immediately. We record when you gave consent and when you withdrew it.
Service messages are not marketing: your daily digest, replies to your posts, and anything about your account or subscription. Those follow the notification settings in Settings.
How long we keep it
Most of your information is deleted when you delete your account. Some records are deleted on a schedule instead, and a few are kept with the connection to your account removed.
How long each kind of data is kept
| What | How long | What happens |
|---|---|---|
| Your account and profile | Until you delete your account | Deleted with your account |
| Your shelves, reading activity and reading goals | Until you delete them, or your account | Deleted with your account |
| Your reviews, posts, replies, collections and club messages | Until you delete them, or your account | Deleted with your account |
| Notifications we showed you | Until you delete your account | Deleted with your account |
| Records of the data exports we have sent you | Until you delete your account | Deleted with your account |
| A record that we deleted your account, and when | Kept after deletion, so we can show your erasure was carried out — it holds no name or email, only a scrambled reference | Kept, but no longer linked to you |
| Page views, feed and notification clicks, and session starts | 90 days, after which only daily totals remain — and those are not linked to anyone | Deleted on a schedule |
| Which recommendations we showed you | 90 days | Deleted on a schedule |
| Searches, onboarding steps, paywall views and shop clicks | Kept while Literally runs, so we can see how the service is used | Kept, but no longer linked to you |
| Emails we sent you, and whether they arrived | Kept as a delivery record | Kept, but no longer linked to you |
| Bug reports and support conversations | Kept so we can see what has been reported and fixed | Kept, but no longer linked to you |
| Payment and subscription records | Until you delete your account | Deleted with your account |
Deleting your account removes your posts and replies outright. Because a reply cannot exist without the post it answers, deleting one of your posts also removes the replies other readers left on it. We tell you before you confirm.
Bug reports you have already sent us are held in our issue tracker and are not reached by deleting your account. Tell us and we will remove them.
Your rights
You have the right to see the personal data we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, to receive a copy in a portable form, and to withdraw any consent you have given. Exercising these rights is free, and we will respond within one month.
You can do most of this yourself in Settings: edit your profile and privacy settings, download a copy of your data, and delete your account. The download lists what it contains, and the few things it leaves out — ask us for any of those and we will send them separately.
To turn Google Analytics off on our website, use Cookie preferences at the foot of any page.
If you think we have got something wrong, please tell us first — but you are entitled to complain to the UK Information Commissioner's Office (ico.org.uk) without doing so.
Age
Literally is for readers aged 16 and over. We do not knowingly allow accounts for anyone younger. If you believe someone under 16 has an account, tell us and we will remove it.
Changes to this notice
When we change this notice we will update the date at the top. If a change materially affects what we do with your data, we will tell you directly.