Privacy notice
Last updated 10 October 2026
Stacks is a home library app at stacksonline.com. It lets you catalogue the books you own, arrange them on shelves, share a library with other people, and reserve books for the readers you share them with. This notice explains what personal information Stacks collects, why, who it is shared with, how long it is kept, and the rights you have over it.
- We collect only what is needed to run your account and your library.
- We don't show adverts or use analytics tools, and we never sell your information.
- We only use cookies that Stacks needs to work, such as keeping you signed in.
- We only send service emails, never marketing. They let us see whether they were opened and which links were clicked.
- You can delete your account at any time from your Profile page, and you can contact us to use any of your rights.
- Who we are
- What we collect
- Information about other people
- How we use your information
- Cookies
- Who we share your information with
- International transfers
- How long we keep your information
- Security
- Keeping your information accurate
- Your rights
- Children
- Changes to this notice
- Contact and complaints
Who we are
Stacks is operated from the United Kingdom. In this notice, "Stacks", "we", "us" and "our" mean the operator of Stacks.
For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), the data controller is Stacks. We decide how and why personal information is used and are responsible for looking after it.
You can contact us about anything in this notice.
What we collect
Your account
To create an account we need your email address and a username of your choice. You can also add a display name if you like. You can't use Stacks without the email address and username.
Your libraries
For each library you create or join, we record that you are a member, your role (Owner, Admin, Member or View Only), and when you joined. Every member of a library can see the other members' display names and email addresses in the library's settings. Members can also see some of your actions in that library, such as reservations you make and when you last downloaded a backup.
Notes
We store the notes you write on books. Notes are visible only to members of that library, and are written and managed by those members. We don't routinely read, monitor or edit them.
If a note mentions you and you want it changed or removed, contact the library's Owner, or contact us and we will pass your request on to them.
Reservations
We store the reservations you make, including who each book is reserved for and who made the reservation. The people books are reserved for come from your library's People directory. See Information about other people.
Invitations
If an Admin or Owner invites someone to a library, we store the invitee's email address, the role they were offered, who sent the invitation, and when. The invitation is deleted as soon as it is accepted or cancelled. We only email an invitee the invitation itself, plus a resend if a library Admin asks for one. We never use their address for anything else or add them to any list.
Changing your email address
When you change your email address, we keep the new one until you confirm or cancel the change. Once confirmed, it replaces your old address, which we delete. If you cancel, we delete the new one instead.
Technical information
Like most websites, our hosting provider automatically receives technical information when you visit, such as your IP address, browser type and the pages requested. This is recorded in server logs, along with any errors Stacks runs into while handling your request. We use these logs only to keep the service secure and to find and fix problems, and we do not use them to profile you. They are deleted automatically after a short time. See How long we keep your information.
If you support Stacks
If you donate through our Buy Me a Coffee page, Buy Me a Coffee shares with us the name you give, your email address and any message you leave. We never see your card or payment details.
When you contact us
If you email us or use our contact form, we keep your message and our reply so we can deal with your request and refer back to it if you contact us again. See How long we keep your information.
Information about other people
Each library has a People directory, used to record who books are reserved for. An entry must have a name, and can also include a username, email address, phone number, address and birthday (day and month only). The people in the directory do not need a Stacks account, and may not know Stacks exists.
If you add someone to your People directory, you must only add details they would expect you to have, and only what you need. You should let them know you use Stacks to keep track of the books you share with them. You must not add sensitive information about anyone, such as health details, in notes or anywhere else in Stacks.
People directory entries are visible only to members of that library. We do not contact anyone in a People directory, and we do not use these details for any other purpose.
If you are in someone's People directory and want your details changed or removed, you can ask the library owner, or contact us and we will help.
How we use your information
UK data protection law says we must have a lawful basis for each way we use personal information. These are ours:
| Information | Lawful basis | How we use it |
|---|---|---|
| Your email address, username, display name, library memberships and roles | Contract | Create and run your account, sign you in, let you use your libraries, and send you service emails about your account |
| An invitee's email address | Legitimate interests | Send them the library invitation a member asked us to send |
| Names and optional contact details of people in a People directory | Legitimate interests | Let library members keep track of who they share books with |
| Technical information | Legitimate interests | Keep Stacks secure, prevent misuse, and diagnose faults |
| Whether our emails were opened and which of their links were clicked | Legitimate interests | Check that our emails arrive and that their links work |
| Supporters' names, email addresses and messages | Legitimate interests, and legal obligation for tax records | Thank supporters and reply to their messages, and keep a record of donations for tax purposes |
| Messages you send us | Legitimate interests, or legal obligation when you use a data protection right | Answer your messages and requests |
Where we rely on legitimate interests, we have considered your interests and rights and believe our use is proportionate and what you would reasonably expect. We do not make automated decisions about you, and we do not profile you.
International transfers
Some of our providers are based in, or use systems in, countries outside the UK, including the United States. When personal information is transferred outside the UK, we make sure it is protected by one of the safeguards UK law requires. This means either a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, which our providers include in their data processing terms. You can ask us for more details.
How long we keep your information
We keep personal information only as long as we need it.
| Information | How long |
|---|---|
| Your email address, username and display name | Until you delete your account |
| Your library memberships and roles | Until you leave the library, are removed from it, or delete your account |
| People directory entries | Until a library member deletes them, or the library is deleted |
| An invitee's email address | Until the invitation is accepted or cancelled |
| Technical information in server logs | Up to 1 day |
| Copies in database backups | Up to 60 days |
| Supporters' names, email addresses and messages | 6 years after your last donation |
| Emails and contact form messages you send us, and our replies | 6 years after the last message |
If you are an Owner of a library that has other members, you will need to hand ownership to someone else before you can delete your account. Libraries you share with others carry on without you after you leave.
Security
We protect your information with measures including encrypted connections (HTTPS), passwords stored only in scrambled form, and access controls so each library's content is visible only to its members.
If something goes wrong
If we become aware of a breach affecting your information, we will investigate it and let you know what happened. Where required, we will also report it to the relevant authorities.
Keeping your information accurate
We aim to keep the information we hold accurate and up to date, and we rely on you to help. Please keep your details current, and tell us if anything we hold about you is wrong.
You can update most of your details yourself from your Profile page, including your display name, username and email address. A new email address only takes effect once you confirm it from a link we send there.
Library members can edit or remove People directory entries at any time. If you are listed in someone's People directory and your details have changed, ask them to update your entry, or contact us.
Your rights
Under UK data protection law you have the right to:
- Be informed about how your information is used.
- Access the personal information we hold about you and get a copy of it.
- Rectification: have inaccurate information corrected.
- Erasure: have your information deleted.
- Restrict processing: ask us to limit how we use your information.
- Data portability: receive your information in a common, machine-readable format.
- Object to our use of your information where we rely on legitimate interests.
- Not be subject to automated decisions with legal or similarly significant effects.
These rights also apply to people listed in a People directory, even if they don't have a Stacks account.
To use any of these rights, contact us. We may need to confirm who you are first, usually by asking you to write from the email address on your account. If you are asking on behalf of someone else, we will need to see that you are authorised to act for them. We will respond within one month, and there is normally no charge. If a request is complex we may extend this by up to two further months, and we will tell you if we do.
Children
You must be at least 13 to create a Stacks account. If you are under 18, you must have a parent or guardian's permission before you sign up. If you believe a child under 13 has given us personal information, please contact us and we will delete it.
Changes to this notice
We may update this notice from time to time. The date at the top shows when it last changed. If we make a significant change, we will let you know by email or with a notice in Stacks.
Contact and complaints
If you have a question about this notice or how we handle your information, or want to use any of your rights, email us at info@stacksonline.com or use our contact page.
If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live outside the UK, you may be able to complain to the regulator where you live.
Stacks is not responsible for the privacy practices of other websites we link to, such as Buy Me a Coffee.