book by book
Log in
← Back to Home

Privacy Notice

Last updated October 31, 2026

This Privacy Notice for Ligma Tech LLC, which operates book by book ("we," "us," or "our"), describes how we collect, use, store, and share ("process") your personal information when you use our services ("Services"). If you do not agree with our practices, please do not use the Services. Questions? Email support@bookbybook.app.

Table of Contents

1. What Information Do We Collect?

Information you give us

We collect the personal information you provide when you register, connect your Square account, use the Services, or contact us, such as your name, email address, and store details. We do not process sensitive personal information (such as racial or ethnic origin, health information, or religious beliefs).

Information collected automatically

When you use the Services, we automatically collect device and usage information, such as your IP address, browser and device type, operating system, language preferences, referring URLs, country, and how and when you use the Services. This information does not directly identify you. We use it to keep the Services secure and running, and for internal analytics.

Information about bookstore customers

Bookstores that use book by book can offer an online storefront. If you place an order through one, we collect the information needed to complete it, such as your name, email address, phone number, the items you ordered, and, for orders shipped to you, your shipping address. Payments are processed by Square; we do not receive or store your full card details. We use this information to place the order with the bookstore, send you order confirmations and updates, and let the bookstore's staff fulfill it. The bookstore you order from is responsible for how it uses your information; please refer to its own privacy policy, and contact the bookstore directly with requests about your order data.

We also record anonymous usage events on storefronts (such as page views and items added to a cart) to keep storefronts working and to understand how they are used. These events do not include your name or contact details.

2. How Do We Use Your Information?

We use your information to provide, improve, and administer the Services, communicate with you, prevent fraud and abuse, and comply with the law. We do not sell your personal information.

3. Who Do We Share Your Information With?

We do not share your personal information with third parties without your consent, except in the following cases:

  • Hosting and Infrastructure Providers: Our application runs on Cloudflare, which serves our website, processes requests, and stores uploaded files such as images. Account and application data is stored in Google Firebase (Cloud Firestore), and sign-in is handled by Firebase Authentication. See Cloudflare's Privacy Policy and Firebase's privacy information.
  • Square: Our Services connect to your Square account to manage your catalog and inventory, and storefront orders and payments are processed through the bookstore's Square account. See Square's Privacy Notice.
  • Stripe: We use Stripe to process subscription payments. Stripe may collect certain personal information from you as described in Stripe's Privacy Policy.
  • Email Delivery: We use Mailgun to send account, order, and service emails. See Mailgun's Privacy Policy.
  • Search: We use Algolia to power catalog search. Algolia receives book and catalog data, not customer contact details. See Algolia's Privacy Policy.
  • AI Services: We use Google's Gemini API to help categorize books and organize your catalog. We send it book and catalog data, not customer contact details.
  • Logging and Monitoring: We use Axiom and Firetiger to store application logs and diagnose problems. Logs may include technical information such as IP addresses and request details.
  • AI Apps You Connect: If you connect an AI app (such as ChatGPT, Claude, or Gemini) to your store, the app's provider receives the information the app asks for on your behalf. See AI Apps and Agents.
  • Compliance with Laws: We may disclose your information to legal authorities if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).

4. Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences, keep the Services secure, and support basic site functions.

5. Signing In With Google

If you sign in with your Google account, we receive basic profile information from Google, such as your name, email address, and profile picture. We use it only as described in this Privacy Notice. Google's own privacy policy governs how Google handles your information.

6. AI Apps and Agents

You can connect an AI app or agent (such as ChatGPT, Claude, Gemini, or another app that supports the Model Context Protocol) to your book by book store at https://bookbybook.app/mcp. This section explains what a connected app can do and what happens to your data.

Connecting an app

When you connect an app, you sign in to book by book and approve the connection for one store. The approval screen lists what the app will be allowed to do, and it can never do more than you can do yourself in that store. The permissions are:

  • View your store: orders, books, restock lists, store settings, sync status, team members (names, email addresses, and roles), pending invitations, and your plan. Every connection includes this.
  • Edit orders: create, edit, and delete draft receiving orders, import invoices and order files, and mark books on the restock report.
  • Change settings: change store, vendor, and direct ordering settings, and invite team members or revoke invitations.
  • Update Square: push orders to your Square catalog and inventory.
  • Send publisher orders: send purchase orders to publishers through Pubnet. Publishers ship and bill these orders.

Members can allow viewing and editing orders. Only store owners and admins can allow the other permissions. Update Square and Send publisher orders are off unless you turn them on when you connect. Before an app pushes to Square or sends a publisher order, it has to show a preview, and the action must then be confirmed, either in a prompt from book by book or in the app's own confirmation step.

Connected apps can't see orders placed by shoppers on your storefront or shoppers' contact details. They also can't change your plan or payment details.

What the AI provider receives

When a connected app uses your store, book by book sends the app the information it asks for, such as order and book details, settings, or the list of team members. The app's provider (for example OpenAI, Anthropic, or Google) receives that information and handles it under its own privacy policy and terms, not this Privacy Notice. Please review the provider's policies before you connect an app. We don't control what the provider does with the information once we have sent it.

What we record

Changes a connected app makes appear in your order history marked with the app's name. We also keep an activity log of every action a connected app takes that could change something: who connected the app, which app it was, what action it took, when, whether it succeeded, and the IDs of the records it changed (such as an order ID). The log never includes what the app sent us or what the AI said. We use it to keep the Services secure and to help you understand changes made in your store.

Viewing and revoking connections

You can see the apps connected to your store, when each was connected and last used, and what each is allowed to do, under Settings → Connected agents. Members see their own connections; owners and admins see everyone's in the store. Click Revoke access to disconnect an app right away: its access ends immediately, and it has to be connected again before it can do anything.

Connections also end automatically when a member is deactivated or given a different role, and an app loses access as soon as the person who connected it no longer has access to the store.

How long we keep it

  • Access tokens expire after 1 hour. Apps renew them using the connection.
  • Connections expire after 90 days without use, and the app must then be connected again. A connection the app keeps using stays active. Revoking a connection deletes it and its tokens immediately.
  • Confirmation codes for previewed Square pushes and publisher orders expire after 10 minutes and are then deleted automatically.
  • Apps that register themselves with book by book are deleted automatically after 180 days unless they are still in use.
  • The activity log is kept for 12 months; older entries are deleted automatically each day. Deleting your store deletes its activity log, and disconnects every AI app connected to it straight away. To ask us to delete the log sooner, email support@bookbybook.app.

We store tokens as one-way hashes, not in readable form.

To manage or delete your data, including disconnecting AI apps, see our guide to managing and deleting your data. Questions about AI apps? Email support@bookbybook.app.

7. Where Is Your Information Stored?

Our application data is stored in the United States. Our application runs on Cloudflare's global network, so your requests may be processed in a data center near you, which may be outside your country. Our service providers may also process your information in the United States and other countries. These countries may not have data protection laws as comprehensive as those where you live, but we will protect your personal information as described in this Privacy Notice and as required by applicable law.

8. How Long Do We Keep Your Information?

We keep your personal information only as long as we need it for the purposes in this Privacy Notice, unless a longer period is required or permitted by law (such as for tax or accounting). When we no longer need it, we delete or anonymize it. If that is not possible right away (for example, because it is in backups), we store it securely and isolate it from further processing until it can be deleted.

9. Children

The Services are not intended for anyone under 18, and we do not knowingly collect personal information from children. If we learn that we have collected personal information from someone under 18, we will delete it.

10. Your Privacy Rights

Depending on where you live, you may have the right to access the personal information we hold about you, learn how we have processed it, correct it, or delete it, and to withdraw any consent you have given us. Withdrawing consent does not affect processing that happened before you withdrew it. These rights may be limited in some circumstances by applicable law.

You can review and update your account details in your account settings. To make any other request, including closing your account, email support@bookbybook.app. Our guide to managing and deleting your data explains what you can do yourself. When you close your account, we will delete or deactivate your account and information, though we may keep some information as needed to prevent fraud, resolve problems, enforce our terms, or comply with the law.

11. Do-Not-Track

There is no agreed standard for responding to browser Do-Not-Track signals, so we do not currently respond to them.

12. Changes to This Notice

We may update this Privacy Notice from time to time and will change the "Last updated" date at the top when we do. If we make material changes, we may also notify you directly.

13. Contact Us

If you have questions or comments about this notice, email us at support@bookbybook.app.