Privacy Policy

Pothio ("Pothio", "we", "us") runs a free, non-commercial platform that lets readers in India give and receive second-hand books. This policy explains what personal data we collect, why, and the choices you have. It is written to align with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act").

We collect only what we need to run the swap community:

• Account details — if you sign up with email, we collect your email address and a password (handled by our authentication provider). If you sign in with Google, we receive your name, email address, and profile picture from Google to create and sign you into your account. You also choose a display name, city, and optional neighbourhood and bio.
• Your library and activity — the books you list, request, give, and receive, your reading status, wishlist, reviews you write, and your Karma balance and history.
• Shelf Scan photos — if you use Shelf Scan, you can upload a photo of your bookshelf. We send the image to our AI provider (Anthropic) to read the titles so you can add them quickly. We do not keep the photo: once the titles are read and you've reviewed them, the image is deleted.
• Location (optional) — if you allow it, we use your device's location to show you nearby books and rough distances, and we store your location so we can keep doing this. We deliberately blur your position with a fixed offset so others only ever see an approximate area, never your exact spot, and we use LocationIQ to turn coordinates into a locality name. You can use Pothio without this by setting your city manually.
• Shipping address — when you request a book to be posted to you, we collect your name, postal address, PIN code, and phone number so the sender can deliver it.
• Messages — messages you send in a swap's chat are stored so both people in the swap can see them.
• Group membership — if you join a group (a society, campus, or workplace space), we record that you are a member.
• Basic technical data — standard information your device sends (such as general usage, push-notification settings, and error logs) to keep the service working and secure.

• To create and run your account (including signing you in with Google, if you choose).
• To let you list books — including reading your Shelf Scan photo to suggest titles — and to match givers with receivers.
• To show you nearby books and approximate distances, if you allow location (we store your location so we can keep doing this).
• To enable a book to be posted to you, and to let the sender post it.
• To run group spaces so you can swap with people in your society, campus, or workplace.
• To let the two people in a swap message each other, and to keep Pothio safe.
• To keep the Karma system fair and prevent misuse.
• To send you notifications about your swaps and activity.
• To keep Pothio safe, secure, and working as intended.

Under the DPDP Act, we process your personal data on the basis of your consent and for the legitimate purposes above. Optional features — location, push notifications, and uploading a Shelf Scan photo — happen only if you choose to use them. When you request a book to be posted, you tick a clear, unticked-by-default box to share your name, postal address, and phone number with the sender so they can post the book to you. You can withdraw consent at any time by turning off the feature, removing your saved address, or deleting your account (see Your rights below). Withdrawing consent does not affect anything already in progress.

If you choose "Continue with Google," Google shares your name, email address, and profile picture with us. We use this only to create your Pothio account and sign you in. We do not sell this information, and we do not use it for anything beyond running your account. You can disconnect Google access at any time from your Google account settings; you can also delete your Pothio account by contacting us.

We deliberately limit who can see your address, and when:

• No one sees your full address by default. It is stored encrypted and is never shown publicly or to people who are not part of your swap.
• Before accepting, the book's owner sees only your city and state — enough to judge postage, nothing more.
• Only after the owner accepts your request, and confirms they will use your details only to post the book, is your full address and phone number revealed to that one sender, for that one swap.

This applies to posted swaps. If you agree to swap in person instead, no postal address is shared.

If you join a group, that group's volunteer managers can see your display name, the date you joined, and your participation counts (how many books you've listed and how many swaps you've completed). They cannot see what you are reading privately, your library beyond what you've listed to swap, your messages, or your address. Managers are fellow members who volunteer, not Pothio staff.

• Per-swap address snapshots are wiped automatically once a swap is received, declined, or cancelled.
• Your saved shipping address stays in your account so you don't have to retype it — until you remove it using "Remove saved address" in your profile.
• Shelf Scan photos are deleted once the titles have been read and you've reviewed them. We do not keep your bookshelf images.
• Your location is kept while your account is active so we can keep showing you nearby books; it is removed if you turn location off or delete your account.
• Messages are kept while the related swap and your account are active.
• Account and activity data is kept while your account is active and for a reasonable period afterwards, or as required by law.

Under the DPDP Act you can:

• Access the personal data we hold about you and ask for a summary of how it is processed.
• Correct or update your details — most of this you can do yourself in Edit profile.
• Erase your data — remove your saved shipping address with "Remove saved address", or contact us to delete your account.
• Withdraw consent and nominate another person to exercise your rights in the event of death or incapacity, as provided by law.
• Raise a grievance with us (see below).

We use a small number of trusted third-party services to run Pothio. They process data only to provide their service to us, under their own terms:

• Hosting — Vercel.
• Database and authentication — Supabase.
• Google sign-in — Google, if you choose to sign in with Google.
• Reading Shelf Scan photos — Anthropic, to extract book titles from a photo you upload.
• Turning location into a place name — LocationIQ, if you use location.
• Sending emails — our email delivery provider.
• Book information — Google Books and Open Library, to look up book details (these don't receive your personal data).

We do not list system credentials or secrets here. We do not sell your personal data to anyone.

Pothio is for adults. You must be 18 or older to create an account or use the service. We do not knowingly collect data from people under 18.

For any privacy question, request, or complaint, contact our Grievance Officer, Pothio at Hello@pothio.com. We will acknowledge and respond within the timeframes required by the DPDP Act.

We may update this policy as Pothio evolves or as the law requires. We'll update the effective date above and, where appropriate, tell you in the app.