1) Scope and Summary

2) Information We Collect

We do not intentionally collect sensitive personal information like precise geolocation, health, or government IDs. Under CPRA, account log-in credentials may be deemed "sensitive"; we use them only to operate your account and do not use them to infer characteristics.

3) How We Use Information (Purposes)

• Provide the Service: create and secure your account; show book reports and lists; enable rating, saving, sorting, archives, and other features.
• Personalize & improve: remember settings; measure performance; debug; develop new features; maintain availability and security.
• Communications: send transactional emails (e.g., sign-in, receipts, important updates). With your consent, send newsletters or product updates (you can opt out).
• Payments & subscriptions: process purchases, prevent fraud, and manage entitlements.
• Compliance & enforcement: comply with legal obligations; protect our rights, users, and the Service; prevent abuse.
• Advertising/attribution (if/when enabled): measure campaign performance and show interest-based content in accordance with your choices.

4) Disclosing Information

We share personal information only as described below:

• Service providers (processors): hosting, storage, security, analytics, payment processing (e.g., Stripe), email delivery, logging/monitoring, customer support tools. They may access personal information only to perform services for us under contracts with confidentiality obligations.
• Affiliate/commerce partners: we may share pseudonymous identifiers or click events necessary to attribute referrals and commissions (e.g., Amazon Associates, Bookshop.org).
• Legal & safety: to comply with law, enforce our terms, or protect rights, property, and safety.
• Business changes: if we explore or complete a merger, financing, or sale of assets, information may be transferred subject to continued protection consistent with this Policy.

We do not sell your personal information for money. Under CPRA, some analytics, marketing, and cross-context behavioral advertising could be considered a "sale" or "share" of personal information. See Section 8 for your choices, including a "Do Not Sell or Share" option and recognition of Global Privacy Control signals.

5) Cookies & Similar Technologies

• Strictly necessary: sign-in, security, load balancing, core features.
• Functional: remember preferences and improve experience.
• Analytics: understand feature usage and performance.
• Advertising (if enabled): personalize or measure ads across sites.

You can manage cookies through your browser settings and (where required) our cookie banner/controls. Blocking some cookies may limit functionality.

6) Data Retention

We retain personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements, then delete or de-identify it.

7) Security

We implement administrative, technical, and physical safeguards appropriate to the nature of the data (e.g., encryption in transit, salted/password hashing, least-privilege access). No system is 100% secure; we cannot guarantee absolute security. If we discover a breach affecting your information, we will notify you and/or authorities as required by law.

8) Your Privacy Rights & Choices

A. All users

• Access/Export: request a copy of your personal information.
• Correction: ask us to correct inaccurate information.
• Deletion: request deletion of personal information (subject to legal/operational exceptions).
• Objection/Restriction (where applicable): object to or restrict certain processing.
• Marketing controls: opt out of non-transactional emails at any time (links in emails or in account settings).

Contact us at info@spicebound.com to exercise rights (or use in-product controls where available). We may need to verify your request.

B. U.S. state privacy laws (e.g., CA, CO, CT, UT, VA)

Residents of certain states have additional rights, including:

• Right to know: categories and specific pieces of personal information we collected, sources, purposes, and categories of recipients.
• Right to delete and correct personal information.
• Right to opt out of 'sale'/'sharing' and targeted advertising (cross-context behavioral advertising).
• Right to limit use/disclosure of sensitive personal information (we use SPI only to provide the Service).
• Non-discrimination for exercising rights.

C. EEA/UK

Where GDPR/UK GDPR applies, you also have the right to data portability and to lodge a complaint with your local supervisory authority. If we rely on consent, you may withdraw it at any time.

9) Children's Privacy

The Service is intended for users 13 and older. We do not knowingly collect personal information from children under 13 (or a higher age where required by local law without verifiable parental consent). If you believe a child has provided us personal information, contact hello@readspicebound.com and we will take appropriate steps to delete it.

10) International Transfers

We process and store information in the United States and may transfer it to service providers in other countries. Where applicable law requires, we use approved safeguards (e.g., Standard Contractual Clauses) for transfers from the EEA/UK.

11) Third-Party Sites & Services

Links to third-party sites (e.g., retailers, book sources) are provided for convenience. Their privacy practices are governed by their own policies; we are not responsible for them. Please review those policies before sharing information.

12) State "Notice at Collection" (California)

Categories collected (past 12 months):

• Identifiers: name (optional), email, IP address, account IDs.
• Protected classifications: Not collected.
• Commercial information: subscription plan, purchase/referral events.
• Internet/Network activity: device info, usage data, cookies, interactions.
• Geolocation: coarse (derived from IP); no precise tracking.
• Sensory/Biometric: Not collected.
• Employment/Education: Not collected.
• Inferences: limited preference inferences (e.g., saved lists/spice preferences); no sensitive profiling.

13) Changes to This Policy

We may update this Policy to reflect changes to our practices, technologies, or legal requirements. We will post the updated Policy with a new effective date and, where required, notify you or seek consent. Your continued use of the Service after an update signifies acceptance.

14) Contact Us

Questions or requests about this Policy or your information:
Email: info@spicebound.com

15) Additional Disclosures for Transparency

• Passwords & authentication: We never store plain-text passwords. If you use social sign-in, your identity and email may be confirmed by that provider per their policies.
• Affiliate transparency: If you click to buy a book, we may earn a commission. Affiliate partners may set cookies/identifiers to attribute sales; see their policies and our cookie controls.
• No automated decisions with legal effects: We do not make decisions producing legal or similarly significant effects solely by automated means.
• De-identification: Where we de-identify data, we commit not to re-identify it except as needed to verify de-identification or for security/compliance.