Privacy Policy
Last updated & effective: October 15, 2026 · Version 1.2
At Tomeward (operated by BeaverByte Software), we respect your personal sanctuary and physical collection. We believe your private library reflects your innermost intellectual pursuits. We do not sell your personal information, run third-party advertising networks, or monetize reading habits.
This Privacy Policy explains what information we collect, why we collect it, how your camera and hardware are utilized, and how you exercise sovereignty over your catalog.
1. Information We Collect
We collect only the information strictly necessary to operate your personal library catalog:
- Account Identification: Name, email address, and a cryptographically salted password hash (we never store plain text passwords).
- Catalog & Physical Archive Records: Books you enter, ISBNs, publishers, physical shelf and room locations, acquisition dates, conditions, notes, and lending custody histories (borrower names and due dates).
- Billing Data: When upgrading to the Archivist tier, your payment transactions are processed directly by Stripe. We store only your Stripe Customer ID, Subscription ID, and renewal dates.
2. Mobile Camera & Optical Barcode Scanner Usage
Tomeward provides a camera-based ISBN barcode scanner to rapidly catalog physical volumes on mobile and touch devices.
- Local Client-Side Processing: Camera video streams are processed entirely inside your device browser using the local Barcode Detector / HTML5-QRCode scanner.
- No Image Transmission: Video frames, photographs, or camera feeds are never transmitted to our servers or saved to disk. Only the extracted 10- or 13-digit numeric ISBN string is sent to query bibliographic metadata.
- Hardware Permissions: Camera access is strictly requested on demand and can be revoked at any time via your device browser permissions.
3. Third-Party Sub-processors & Services
To deliver a resilient, high-speed experience, we engage the following vetted infrastructure partners:
- Stripe, Inc.: Processes payments and recurring subscriptions under strict PCI-DSS Level 1 compliance.
- Cloudflare, Inc.: Provides authoritative DNS routing, edge SSL/TLS encryption, and DDoS mitigation.
- MxRoute: Delivers transactional system missives (password resets and authentication notices) from
custodian@tomeward.app. - Google Books API & Open Library: Queries public bibliographic records for ISBNs. No personal user identification or private location data is passed in bibliographic queries.
- Coolify / Dedicated PostgreSQL: Houses our encrypted application database and standalone Next.js server instances.
4. Cookies & Local Storage
We believe in minimal cookies:
- Essential Authentication Cookie: NextAuth session cookie strictly necessary to keep you securely signed in to your archive.
- Theme Preference: Local storage item saving your dark mode or parchment light mode aesthetic preference.
- Zero Third-Party Advertising Pixels: We do not deploy Meta Pixel, Google Analytics advertising tags, or third-party behavioral trackers.
5. Your Rights & Data Portability (GDPR / CCPA)
Regardless of your geographic location, you enjoy the following rights:
- Right to Export: You can download a complete copy of your library in standard CSV or JSON format at any moment with 1 click.
- Right to Rectification: You may edit, update, or correct any metadata or personal detail through the application interface.
- Right to Erasure (Be Forgotten): You may request full deletion of your account and all associated books, shelves, and records by contacting
custodian@tomeward.app.
6. Custodial Inquiries
For any questions regarding your data privacy, sub-processors, or to request account erasure, reach out to our privacy custodian:
Tomeward Privacy Desk
A BeaverByte Software Project
Email: custodian@tomeward.app
Domain: https://tomeward.beaverbyte.app