Privacy Policy

01Who we are

Maktabaty is a multimedia reading platform: a bookshop and reader for books whose pages can carry video and images, together with the tools for the authors and publishers who make them. It is operated by Ahmed Labeb Alashari of Baghdad, Iraq (“Maktabaty”, “we”, “us”), which is the data controller for the personal data described here.

This policy covers the website at maktabaty.app, the Books Reader for web and Android, the Authors & Publishers portal, and the Story Studio authoring tool. It does not cover anything an author chooses to link to from inside their own book.

02What we collect

We have tried to keep this list short, and to justify every row of it. If something is not listed here, we are not collecting it.

We do not ask for, and have no use for, your date of birth, your postal address, your contacts, your location, or your photo library.

03Google sign-in

You may sign in with a Google account instead of creating a password. If you do, Google asks your permission and then tells us three things: your name, your email address and your profile picture, together with the stable Google account identifier that lets us recognise you next time.

We request only the standard openid, email and profile scopes. That is the narrowest set Google offers for signing in. We do not ask for and cannot see your Gmail, Drive, Calendar, Contacts, Photos, or anything else in your Google account.

We never receive your Google password. You type it on Google's own screens; we only ever see the signed result.

Using Google sign-in does mean Google knows you signed in to Maktabaty. That part is governed by Google's Privacy Policy. You can disconnect Maktabaty at any time from your Google account permissions page. If you do, set a password with us first so that you do not lock yourself out of your library.

Maktabaty's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use that information solely to create and operate your account.

04What we never do

This section is deliberately specific, because “we value your privacy” is worth nothing on its own.

• No analytics. There is no Google Analytics, no Meta pixel, no Hotjar, Mixpanel, Segment, Amplitude or any equivalent in any Maktabaty app or on this website.
• No advertising. We do not serve ads, we are not part of an ad network, and we do not build advertising profiles.
• No third-party scripts. Our pages load their code from our own servers. The only external resource is the Google Fonts stylesheet used for typography.
• No selling or renting data. Not to advertisers, data brokers, publishers or anyone else — and we will not start without asking you first.
• No reading surveillance. We do not record how long you read, how fast, when you open a book, or which passages you linger on.
• No cross-site tracking of any kind.

05Why we may lawfully use it

Where data-protection law such as the GDPR applies to you, these are the legal bases we rely on:

• Performance of a contract — running your account, delivering the books you bought, and syncing your reading position. Without this data there is no service to provide.
• Legitimate interests — keeping the platform secure, preventing fraud and abuse, and diagnosing faults. This is what the server logs are for, and we keep them minimal.
• Consent — for anything optional, such as a marketing email you asked for. You may withdraw consent at any time.
• Legal obligation — keeping transaction records where tax or accounting law requires it.

06Cookies and local storage

Maktabaty sets no advertising or tracking cookies. There is nothing here for a cookie banner to ask you about.

The apps do keep a small amount of data in your browser's local storage or on your device: your session token, which is what keeps you signed in, and your highlights, notes and reading position. Clearing your browser data or uninstalling the app signs you out and erases the on-device items.

07Who we share it with

We share personal data only where it is necessary to run the service, and only with these categories of recipient:

• Our hosting provider, which operates the physical server our software runs on. They do not process your data for their own purposes.
• Our email delivery provider, to send account emails such as address confirmation and password resets.
• Google, only if you choose Google sign-in, and only to the extent described in section 3.
• A payment processor, if and when paid purchases go live. Card details will be handled entirely by that processor and will never reach our servers. Maktabaty does not take payments today, and we will name the processor here before it does.
• Authors and publishers, in aggregate only. A publisher can see how many copies sold; they do not receive your identity.
• Legal and safety — where we are compelled by valid legal process, or where disclosure is genuinely necessary to protect someone's safety or our legal rights. We will tell you unless we are legally forbidden from doing so.

We use no other processor, and we hand your data to nobody else.

08Where it is stored

Maktabaty runs on its own dedicated server rather than on a large third-party cloud platform. Your data sits in a database we administer directly, located in the United Kingdom, and every connection to it is encrypted with TLS.

If you are in a country whose law restricts international transfers, note that using the service involves your data being stored in that location. Where required, we rely on appropriate safeguards for such transfers.

09How long we keep it

• Account data — for as long as your account exists, then deleted within 30 days of you closing it.
• Purchase records — retained after account closure only for as long as tax and accounting law requires.
• Server logs — rotated and deleted on a rolling basis, ordinarily within 30 days.
• Uploaded works — until the author removes them or closes the account, subject to the wind-down period in the Terms.
• Highlights and notes — we never hold these at all; they live and die on your device.

10Your rights

Wherever you live, we will honour the following on request. Under the GDPR and comparable laws these are rights; everywhere else we apply them as policy.

• Access — a copy of the personal data we hold about you.
• Rectification — correction of anything inaccurate.
• Erasure — deletion of your account and its data, subject to records we are legally obliged to keep.
• Portability — your data in a structured, machine-readable file.
• Restriction and objection — including objecting to processing we base on legitimate interests.
• Withdrawal of consent — at any time, without affecting what was lawful before.
• Complaint — to your local data-protection supervisory authority. We would rather you came to us first, but it is your right either way.

Write to maktabaty@maktabaty.app and we will respond within 30 days. We do not charge for this, and we will not ask you to justify the request.

11How we protect it

• All traffic to and from Maktabaty is encrypted with TLS. Plain HTTP is redirected, and HSTS is enforced.
• Passwords are stored only as salted one-way hashes.
• The database enforces row-level security, so one account's rows are unreachable from another account's session. That isolation is applied by the database itself, not merely by application code.
• Administrative access is restricted to key-based SSH over a private network, and administrative tooling is not exposed to the public internet.
• Backups are taken regularly, encrypted, and access to them is restricted.

No system is perfectly secure. If a breach ever affects your personal data and poses a real risk to you, we will notify you and the relevant authority without undue delay, and within 72 hours where the law requires it.

12Children

Maktabaty is not directed at children under 13, and we do not knowingly collect their personal data. Where local law sets a higher age of digital consent — 16 in parts of the European Union — that age applies instead.

Children may of course read books on a parent's or a school's account. If you believe a child has created an account of their own, write to maktabaty@maktabaty.app and we will remove it.

13Authors and publishers

If you publish through Maktabaty, some of your information is necessarily public: your author or imprint name, your biography, and the works you publish. That is the point of publishing, and you control what goes in those fields.

Your contact details, payout information and sales figures remain private. Sales reporting given to a publisher is aggregated and never identifies an individual reader.

14Changes

If we change this policy we will update the version and date at the top. For any change that materially affects your rights or how we use your data, we will notify you by email or in the app before it takes effect, and we will never apply it retroactively.

Superseded versions are kept, and available on request, so you can see what changed.

15Contact us

A real person reads these. If our answer does not satisfy you, you may complain to your local supervisory authority.