Kosmotheka is an app for cataloguing what a family or group owns: books, comics, games, films, series, video games, music and more. It works fully without an account and without a server: in that case your data stays on your devices and we never see it. The account and the cloud are optional, and this policy explains what changes if you use them.
Who is responsible
Controller: Sergio Rebollo, Spain, who maintains Kosmotheka as a personal project. Contact: privacy@kosmotheka.com
If you use the app without an account
- Your catalogue, the people in each library and the names of your devices are stored only on your device.
- If you pair two devices with a QR code, they sync directly with each other over your local network, encrypted. Nothing goes through a server of ours.
- To fill in the details of a work, the app can query public catalogues (the National Library of Spain, the Library of Congress (United States), Open Library, Inventaire, Wikidata, MusicBrainz and Cover Art Archive, and Google Books or GameUPC if you add your own key). Only what you search for is sent: an ISBN, a barcode or a title. As with any internet connection, each service also sees the IP address you ask from and the name and version of the app; the same goes for downloading covers, which come from those services.
- The barcode scanner uses ML Kit, from Google, through the phone's Google Play services. It is governed by their terms (ML Kit). To measure and improve how it works, ML Kit sends Google technical usage data (the device model, the system and app versions, and the scanner's timings and errors), never the images. We receive none of it.
- The camera is used only to read barcodes, when you ask it to. Images are not stored or sent.
If you create an account
The account lets you have a library on several devices without them being on the same network, and share it with other people. When you create it, our server stores:
- Your email and your name, and your password in a form that cannot be read (only a hash computed with an algorithm designed for passwords).
- Your devices: the name you gave each one, an identifier and its public key, and when it was last used.
- If you sign in with Google: Google tells us your email, whether it is verified, your name and an identifier of yours. We keep the identifier to recognise you next time; nothing else from Google. Google knows that you use Kosmotheka, as with any sign-in with Google.
- If you turn on two-step verification: the secret shared with your authenticator app, and your backup codes in a form that cannot be read.
If you upload a library to the cloud
Uploading a library is a decision separate from creating the account, and it is taken by whoever administers that library. When you do it, the server stores the contents of that library: the works, the copies, where they are and whose they are, the people in the library with their name and role, what each one records (status, rating, favourites, wishes), and the history of changes with the device that made each one.
What you should know: this data travels encrypted to the server, but it is not end-to-end encrypted on the server. Whoever administers the server could technically read it. We do not, unless it is essential to resolve an incident you ask us to resolve. If you prefer that nobody else can read it, use the app without the cloud: syncing between your devices over the local network does not go through any server.
Libraries you do not upload never leave your devices, whether you have an account or not.
If you search for a book with the account
If you have not set your own Google Books key, and your server offers it, the app can ask the server for an ISBN instead of asking Google Books directly (which often fails for people without a key). The ISBN is sent and nothing else, together with your session, which the server needs to check that you have an account. The server looks it up in Google Books with its own key, so Google sees the searches as the server's, not yours. The server keeps the answer for a few days (30 if it found the book, 1 if not) so as not to repeat the question, without recording who asked or writing it in any log; it only counts how many searches you make to set you a limit (600 per hour) and does not keep that beyond that hour. You can turn it off in Settings › Data providers (it is on by default) or set your own Google Books key, which takes precedence: then the server does not even find out.
If you search for a film or a series with the account
If your server offers it and you have not turned it off in Settings › Data providers, when you search for a film or a series by title the app sends your server what you type, whether it is a film or a series, and the app's language, together with your session. The server looks it up in TMDB with its own key, so TMDB sees the search as the server's, not yours. What the server keeps is the answer, for a few days (at most 30; the search itself, one day), without recording who asked or the text you typed: the search is stored under a fingerprint from which the text cannot be recovered. Neither the text nor its author is written in any log. It only counts how many searches you make to set you a limit (600 per hour, together with those for books). If you set your own TMDB key in Settings, the app asks it directly and the server does not even find out. This app uses TMDB and the TMDB APIs but is not endorsed, certified or otherwise approved by TMDB.
If you search for a video game with the account
If your server offers it and you have not turned it off in Settings › Data providers, when you search for a video game by title the app sends your server what you type, together with your session. The server looks it up in RAWG with its own key, so RAWG sees the search as the server's, not yours. The server keeps the answer for a few days (up to 30; the search, 7), without recording who asked or the text you typed: the search is stored under a fingerprint from which the text cannot be recovered. Neither the text nor its author is written in any log. It only counts how many searches you make to set you a limit (600 per hour, together with those for books and films). If you set your own RAWG key, the app asks it directly. Video game data comes from RAWG.
If you search for a comic with the account
If your server offers it and you have not set your own Comic Vine key or turned it off in Settings › Data providers, when you search for a comic by title the app sends your server what you type, together with your session. The server looks it up in Comic Vine with its own key, so Comic Vine sees the search as the server's, not yours. The server keeps the answer for a few days (up to 30; the search, 7), without recording who asked or the text you typed: the search is stored under a fingerprint from which the text cannot be recovered. Neither the text nor its author is written in any log. It only counts how many searches you make to set you a limit (600 per hour, together with those for books, films and video games). If you set your own key, the app asks Comic Vine directly and the server does not even find out. Comic data comes from Comic Vine.
If you search for a board game or a role-playing book with the account
If your server offers it and you have not turned it off in Settings › Data providers, when you search for a board game by title (and, when you search for a book by title, role-playing books) the app sends your server what you type, together with your session and whether it is a game or a role-playing book. The server looks it up in BoardGameGeek with its own token, so BoardGameGeek sees the search as the server's, not yours. The server keeps the answer for a few days (up to 30; the search, 7), without recording who asked or the text you typed: the search is stored under a fingerprint from which the text cannot be recovered. Nothing else is sent. BoardGameGeek has no relationship with this app.
If you invite someone
If you invite by email, the server sends a message to that address. We do not keep the address: only a fingerprint that lets us check that whoever accepts is the person you invited. The message does not include your name or the name of the library.
The activity log
To be able to account for what happens with an account or a library (for example, who removed whom, or where a session was started from), the server records: creating the account, signing in and out, failed attempts, changing the password, two-step verification, deleting the account; and, in cloud libraries, uploading them, changing permissions, removing or restoring a person's or a device's access, and invitations.
For each event it stores what it was, when, the account and the device, the IP address and the app version. Passwords, codes and the contents of the catalogue are not stored. It is kept for one year and then deleted automatically. The legal basis is our legitimate interest in keeping the service secure.
Who else processes your data
- Hosting: the server is on DigitalOcean, in its Amsterdam data centre (the Netherlands, European Union).
- Email: messages (confirmation codes, password recovery, invitations) are sent through Brevo (Sendinblue SAS, France), which receives the destination address and the content of the message.
- There is nobody else: no advertising, no analytics of ours, no tracking, no selling of data. The only thing that goes to Google is ML Kit's technical data when you scan (above).
How long data is kept
- An account that does not confirm its email is deleted after 24 hours.
- The codes we send by email expire within minutes and are deleted.
- Invitations are valid for 24 hours and are deleted a week after they expire.
- The activity log, one year.
- Your account and your cloud libraries, until you delete them.
Deleting your data
- Without an account: deleting a library or uninstalling the app removes its data from that device.
- Deleting the account: from the app, on your account screen. The account, its devices and the cloud libraries you uploaded that only you used are deleted. The ones you share with other people stay in the cloud for them: they pass to another account that has access, and what you recorded in them stays there, because it is part of that library. What you have on your devices is not touched. Activity log entries are kept until their year is up, without your email.
- If you cannot get into the app, write to privacy@kosmotheka.com from the account's email address; we delete it within 30 days at most. The steps are at kosmotheka.com/en/delete-account.html.
Your rights
You can ask us to access your data, correct it, delete it, restrict its use or object to it, and to receive it in a format you can take with you (the app already exports your catalogue to CSV and makes full backups). Write to privacy@kosmotheka.com. If you believe we have not handled your request properly, you can complain to the data protection authority of your country (in Spain, the AEPD).
Minors
Any member of the family can use the app without an account. Creating an account is meant for adults, from the age of 14 (the age at which, in Spain, a person can give their own consent). A minor can be in a family library without having an account: their data reaches the cloud through whoever administers the library.
Changes
If what we do with data changes, we will update this policy before the change reaches the app, and change the date above.