1. About Bookleaf
Bookleaf operates in two modes:
- Server mode — the librarian's device runs a local library server over the institution's Wi-Fi network. All library data is stored in a local database on this device.
- Client mode — patron devices connect to the server over the local Wi-Fi network to browse the catalog, borrow books, and manage their account. Client devices store no library data locally.
At no point does Bookleaf connect to the internet or transmit any data outside the local network.
2. Data We Collect
The following data is collected and stored locally on the server device only as part of normal library operations.
| Data | Purpose | Storage |
|---|---|---|
| Full name | Member identification for library records | Local only |
| ID number | Unique member identifier (student/faculty ID) | Local only |
| Department / user type | Membership categorisation (student, faculty, alumni, external) | Local only |
| Profile photo (optional) | Member card display and visual identification | Local only |
| PIN (hashed) | Authentication. PINs are stored as a salted SHA-256 hash — the original PIN is never stored. | Local only |
| Borrowing history | Tracking which books are borrowed, due dates, return dates, and renewal counts | Local only |
| Reservations | Recording holds placed on library materials | Local only |
| Fines | Overdue fine calculation and payment tracking | Local only |
| Favorites | Personal reading list saved by the patron | Local only |
| Reviews and ratings | Patron book reviews visible within the institution's catalog | Local only |
| Gate entry/exit logs | Recording library entry and exit timestamps for attendance | Local only |
| Session tokens | Keeping patron devices authenticated during a session (30-day expiry, stored on-device) | Device (client) |
3. Device Permissions
| Permission | Why it is needed |
|---|---|
| Camera | Scanning barcodes and ISBNs to add books or process checkouts. Camera data is processed on-device and is never stored or transmitted. |
| Wi-Fi state | Reading the local IP address so the server device can broadcast its address to patron devices on the same network. |
| Network state | Checking connectivity before attempting to connect to the local library server. |
| Internet | Used exclusively for local network (LAN) communication between the librarian's device and patron devices. No internet traffic is generated. |
4. AI Assistant (Library Chat)
Bookleaf includes an optional AI assistant powered by a Gemma 2B language model that runs entirely on the server device. No queries, prompts, or responses are sent to any external AI service or cloud provider.
The model is downloaded once to the device on first use and operates fully offline thereafter.
5. Data Sharing and Third Parties
Bookleaf does not:
- Share any data with third parties
- Sell user data
- Use advertising networks or analytics SDKs
- Transmit any personal data to external servers or the internet
- Use crash reporting or telemetry services
All data remains within the institution's local devices at all times.
6. Network Security
Communication between the server device and patron devices occurs over the institution's local Wi-Fi network using HTTP. In the current version (v1), this communication is not encrypted with HTTPS.
All data at rest on the device is stored in a local SQLite database. Backup exports are encrypted using AES-256-CBC with PBKDF2-derived keys before being written to the device's file system.
7. Data Retention and Deletion
Data is retained for as long as the institution requires it for library operations. There is no automatic expiry for member records or borrowing history.
The following deletion capabilities are available:
- Librarian/Admin: Can delete individual member records, borrowing history, reservations, fines, and reviews from within the app.
- Patron: Can remove their own favorites and reviews. May request full record deletion from the institution's librarian.
- Uninstalling the app from the server device permanently deletes all library data stored in the local database.
8. Request Account & Data Deletion
You have the right to request deletion of your account and all associated personal data. Because Bookleaf is an offline, institution-managed system, deletion requests are handled directly through the institution that operates the app — not through an online form.
How to request deletion:
- Contact your institution's librarian or library administrator in person or by email.
- Ask them to delete your member account from the Bookleaf server device.
- You may also email the developer at don.lino.xd@gmail.com with your institution name and member ID number, and we will assist in coordinating the deletion.
What gets deleted:
- Your name, ID number, department, and profile photo
- Your borrowing history and active loans
- Your reservations, fines, favorites, and reviews
- Your gate entry/exit logs
- Your PIN hash and active session tokens
What may be retained:
- Aggregated, anonymised statistics (e.g. total circulation counts) that do not identify you personally
- Records required by the institution for legal or audit compliance, for the minimum period required by applicable law
Deletion is permanent and cannot be undone. If you have outstanding borrowed items or unpaid fines, the librarian may ask you to resolve these before the account is removed.
Partial data deletion (without deleting your account): Patrons can remove their own favorites and reviews directly from within the app at any time. For deletion of borrowing history or other records without closing the account, contact your institution's librarian.
9. Children's Privacy
Bookleaf is a library management tool intended for use by library staff and institutional members. It is not directed at children under the age of 13. Member registration is performed by library staff, not by users registering themselves online.
If your institution serves minors, the institution is responsible for complying with applicable local laws (such as COPPA or GDPR-K) regarding the collection of data about minors.
10. Your Rights
Depending on your location, you may have the right to:
- Access the personal data held about you
- Request correction of inaccurate data
- Request deletion of your data
- Object to certain uses of your data
Because all data is managed by the institution that operates Bookleaf, please direct these requests to your institution's librarian or administrator. As the app developer, we do not have access to any institution's data.
11. Changes to This Policy
We may update this privacy policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of the app after changes are posted constitutes acceptance of the updated policy.
Significant changes that affect how personal data is handled will be communicated through the app's release notes on Google Play.
12. Contact Us
If you have questions or concerns about this privacy policy or how Bookleaf handles data, please contact us at:
Bookleaf Support
don.lino.xd@gmail.com
We aim to respond to all privacy-related inquiries within 7 business days.