Privacy Policy
Last updated: October 2026 · The German version is legally binding.
Controller
Daniel Metzner
Graz, Austria
Email:
Hosting
This site is served via Cloudflare Pages (Cloudflare, Inc.). On access, technically necessary access data (including your IP address) is processed in server log files. Transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses.
Local storage — no cookies
While you are not signed in, your library, reading status, ratings, theme, language and accent colour are stored only locally in your browser (localStorage). No cookies are set.
Account & cloud (optional)
Only when you sign up is an account created with Supabase (EU region). It processes your email address, your password (stored encrypted), shared library data (such as titles, ISBNs, notes, tags and inventory status), and your personal reading data (such as reading status, progress, ratings and borrowed books). Signing in and syncing transmits your IP address to Supabase. Account emails (confirming your address, password resets) are sent by Supabase through the mail service Resend (Resend, Inc., USA), which receives your email address and the message content for that purpose. Transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses. If you share a library via invite link, signed-in members can view or edit the shared inventory according to their role. Your personal reading data is accessible only to you. Members of a shared library see its name and, with your email address, which books you added; the library's owner sees the member list with email addresses. If you send a borrow request, everyone who can edit the library sees your email address and your message. Notifications show the email address of whoever acted — for example who answered a borrow request, changed a role or joined a library. Legal basis: contract / consent (Art. 6(1)(a/b) GDPR).
Book data (Open Library)
Scanning or looking up an ISBN and loading book covers sends requests to openlibrary.org and covers.openlibrary.org (Internet Archive); this transmits the ISBN and your IP address to that service. The Internet Archive is based in the USA; the request goes there directly from your device, and only when you look up a book or a cover is shown.
Camera
Barcode scanning runs entirely locally in your browser. No camera images are transmitted or stored.
Technical error counts
To improve stability, Verso counts technical events such as failed syncs or camera starts by day. Only the date, event kind, and count are stored — no email address, user ID, URL, error message, ISBN, or book data. The counter is sent through Supabase, which technically processes the IP address.
Error reports
When something crashes, Verso sends a technical error report to GlitchTip (app.glitchtip.com,
Burke Software and Consulting LLC, USA). It transmits the error message, the stack trace from
our own code, browser and device details, and the route the error happened on — with
identifiers removed (e.g. /book/:id rather than the book id). It also includes
your last few interactions, but only as the kind of element you clicked (e.g. a.spine[title]) — the contents of such attributes are stripped before the report
leaves your device. The report does not contain your user ID, email address, network requests,
console output, ISBNs, book titles, or any other library data. Your IP address is — as with
any connection — technically processed in order to deliver the report at all; it is not part
of the stored report, and GlitchTip is configured not to retain it. Transfers to the USA rely
on standard contractual clauses. Legal basis: legitimate interest in a working application
(Art. 6(1)(f) GDPR).
Bot protection on sign-in
The sign-in and sign-up form uses Cloudflare Turnstile (Cloudflare, Inc.). This loads a script from challenges.cloudflare.com and transmits your IP address and technical browser characteristics to Cloudflare. Turnstile sets no advertising cookies and builds no cross-site profile. Without the script you cannot sign in, sign up or reset your password; Verso without an account keeps working. Transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses. Legal basis: legitimate interest in preventing automated sign-ups (Art. 6(1)(f) GDPR).
Analytics
The public pages of this website — the landing page, the information pages, the import guides, the imprint and this page — use GoatCounter for anonymous, cookieless analytics (counting script from gc.zgo.at; aggregated page views, without cookies, cross-site tracking, or personal profiles). Legal basis: legitimate interest in privacy-friendly statistics (Art. 6(1)(f) GDPR).
Nothing inside the app is counted. No screen within Verso — shelf, scan, book
page, wishlist, stats — is ever reported to GoatCounter. That is not a setting but a property
of how this is built: the counter is loaded only by the public site's layout, which no app
screen renders. Addresses like /book/… name a specific book, and so they never leave
your device.
In the Android app GoatCounter is never loaded at all — not even on these public pages when you open them from the app's menu. Only the website in a browser is counted.
Retention
We keep account and library data until you delete your account; then it is removed. Books you added to someone else's library stay there as long as that library exists, but are no longer linked to you. When a library's owner deletes their account, the library and everything in it is deleted. Read notifications older than 90 days are deleted the next time you open the app. Data stored locally stays in your browser until you delete it there. The daily error counts carry no personal reference and are not deleted automatically. Server logs and the records of the services named above are deleted on those services' own schedules.
Your rights & contact
You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent at any time. Contact: . You can lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at). You can permanently delete your account and its data from “Account & data” in the menu — step by step under Delete your account and data.