Privacy Policy

Last Updated: May 15, 2026

Privacy Policy

Version 1.2 — Last updated: August 22, 2026

Previous versions are archived and available upon request at [email protected].

In this policy, we lay out: what data we collect and why; how your data is handled; and your rights with respect to your data. We never sell your personal information or any data that identifies you individually. We may use or share aggregated, anonymized insights to understand collector trends (e.g., "collectors in Nordic countries prefer fantasy editions"), but only where individual users or collections cannot reasonably be identified.

This policy is split into sections. For your convenience, links to each of those sections is as follows:

This policy applies to Rare Bindings, including our website at rarebindings.net and all related services. We refer to site visitors, users, and anyone who creates an account as "you" throughout this policy.

For California residents: Our Notice at Collection describes the categories of personal information we collect, the purposes for which it is used, and your right to opt out of the sale or sharing of personal information.

What we collect and why

Our guiding principle is to collect only what we need. Here's what that means in practice:

Legal basis: Our processing of data for analytics, site functionality, fraud prevention, and service improvement is based on our legitimate interest in operating and improving Rare Bindings in a secure and useful way. For marketing communications and certain analytics uses, we rely on your consent, which you can withdraw at any time.

Legal Bases for Processing (EU/UK users)

Under the GDPR, we rely on the following legal bases for processing your personal data:

  • Contract: To provide you with the Rare Bindings service, including account management, notifications about tracked books, and core functionality.
  • Consent: For marketing communications, optional demographic information, and optional analytics or marketing cookies. You can withdraw consent at any time from your account settings or cookie preferences.
  • Legitimate Interest: To maintain security, prevent fraud and abuse, improve our service, conduct internal analytics, and operate our business efficiently. We balance these interests against your privacy rights.

Identity and access

When you sign up for Rare Bindings, we collect your name and email address through Google Sign-In. That's so you can create and access your account, and we can send you notifications about special editions matching your interests. We may also send you optional surveys from time to time to help us understand how you use Rare Bindings and to make improvements.

We'll never sell your personal information to third parties, and we won't use your name in marketing statements without your permission.

Tracking preferences

When you use Rare Bindings, you can choose to track specific authors, book series, retailers, and works. We store these preferences so we can notify you when special editions matching your interests become available. You can update or delete these preferences at any time from your account settings.

The tracking preferences you set are used exclusively to:

  • Send you email notifications about relevant special edition releases
  • Personalize your browsing experience on Rare Bindings
  • Help us understand which books and authors our community cares about (in aggregate)

Optional demographic information

You may optionally provide demographic information such as your age range, country, or other preferences to help us understand our collector community and improve our service. This information is:

  • Always optional - you can use Rare Bindings without providing it
  • Stored securely - optional demographic information is protected by the same application, database, access-control, and hosting safeguards as other account data
  • Used only in aggregate - we may include this in aggregated reports (e.g., "collectors aged 25-34 in Nordic countries prefer fantasy") but never in ways that identify you individually
  • Your choice - you can update or remove this information at any time

We will never ask for or collect sensitive demographic information (such as gender, unless you explicitly choose to provide it with clear explanation of how it will be used) without your explicit consent and a minimum cohort size of 200 opted-in users for any analysis.

Children and minors

Rare Bindings is not directed to children under 16, and we do not knowingly collect or process personal data from anyone under that age. If we learn that we have collected data from a minor without appropriate parental consent, we will delete it promptly. If you believe we have inadvertently collected information from a minor, please contact us at [email protected].

Book and retailer data

Rare Bindings collects publicly available information about special edition books from retailer websites. This includes book titles, authors, editions, pricing, availability, images, and features (such as sprayed edges, signed copies, exclusive content, etc.). This data is used to provide our core service: helping collectors discover and track special editions.

Website interactions

We collect information about your browsing activity for analytics and statistical purposes such as understanding which features are most useful and improving our service. This includes:

Basic analytics: If you opt in to analytics cookies, we may collect your browser and operating system versions, IP-derived region, pages visited, performance information, referring website, searches, and general navigation patterns. We use PostHog hosted in the EU, Ahrefs Analytics, and Google Analytics only after analytics consent. These tools help us understand site usage and improve Rare Bindings.

Behavioral events: When you interact with Rare Bindings (such as viewing a book, adding something to your wishlist, clicking through to a retailer, or searching for specific content), we may record these actions in a de-identified format. These behavioral signals help us understand what features collectors find valuable and inform the aggregated insights we may license to industry partners (see "Aggregated and de-identified data" section below).

How we protect your privacy in behavioral tracking:

  • We use cryptographic hashing to separate your identity from your behavior patterns
  • Your user ID is never stored alongside behavioral events in our analytics systems
  • We rotate cryptographic keys regularly to prevent long-term tracking
  • Individual behavioral events are automatically deleted after 12 months; only aggregated statistical summaries (which cannot identify you) are retained longer for trend analysis

If you have an account and are signed in, these web analytics data are tied to your account until you delete your account or opt out of behavioral analytics. You can opt out of behavioral event tracking while still using all features of Rare Bindings from your account settings. You can contact us at [email protected] to exercise applicable opt-out rights.

Anti-bot assessments

We use CAPTCHA across Rare Bindings to mitigate brute force logins and as a means of spam protection. We have a legitimate interest in protecting our service and the broader Internet community from credential stuffing attacks and spam. When you log into your account, the CAPTCHA service evaluates various information (e.g., IP address, how long you've been on the site, mouse movements) to try to detect if the activity is from an automated program instead of a human. The CAPTCHA service then provides Rare Bindings with the spam score results; we do not have access to the evaluated information.

Cookies

We use persistent first-party cookies to store certain preferences and make it easier for you to use Rare Bindings. A cookie is a piece of text stored by your browser. It may help remember login information and site preferences. You can adjust cookie retention settings and accept or block individual cookies in your browser settings, although Rare Bindings won't work properly if you turn cookies off.

Voluntary correspondence

When you email Rare Bindings with a question or to ask for help, we keep that correspondence, including your email address, so that we have a history of past correspondence to reference if you reach out in the future.

We also store information you may volunteer, for example, written responses to surveys. If you agree to provide feedback or participate in user research, we may ask for your permission to record the conversation for future reference. We will only do so with your express consent.

When we access or disclose your information

To provide services you've requested. We use third-party services to help run Rare Bindings:

  • Google OAuth for authentication, if you choose Google sign-in
  • Mailgun and other email service providers for sending verification, account, and notification emails
  • DigitalOcean Managed PostgreSQL, Redis, object storage, PostHog EU analytics, Ahrefs, Google Analytics, Meta, Reddit, Stripe, and infrastructure providers for hosting, storage, caching, backups, payments, analytics, and consented campaign attribution
  • Analytics services to understand how people use our service

All third-party services act as data processors under GDPR and process data only under our instructions and in accordance with our data protection requirements.

We may share your email address with our email service provider solely for the purpose of sending you notifications about special editions you've chosen to track.

To help you troubleshoot or squash a software bug, with your permission. If at any point we need to access your account to help you with a support case, we will ask for your consent before proceeding.

To investigate, prevent, or take action regarding restricted uses. Accessing a user's account when investigating potential abuse is a measure of last resort. We want to protect the privacy and safety of both our users and the people reporting issues to us. If we discover you are using Rare Bindings for prohibited purposes (such as spam, harassment, or illegal activity), we will take action as necessary, including notifying appropriate authorities where warranted.

Aggregated and de-identified data

We may create or share aggregated or de-identified information that cannot reasonably be used to identify you. We maintain technical and organizational measures to ensure de-identified data cannot be re-linked to individual users. We require our partners not to attempt re-identification or combine such data with other datasets.

We may aggregate and/or de-identify information collected through Rare Bindings. For example, we may analyze which types of special editions are most popular, which authors collectors track most frequently, which book features (sprayed edges, signed copies, exclusive content, etc.) generate the most interest, or how collector preferences vary by region or demographic.

We may use de-identified or aggregated data for any purpose, including:

  • Improving our service and understanding user behavior
  • Sharing industry insights and market research
  • Licensing aggregated analytics and behavioral data to publishers, retailers, distributors, and other businesses in the book industry
  • Providing trend reports, demand forecasting, and market intelligence products

Important privacy protections: This aggregated data never includes your personal information or identifies you individually. We implement strict technical safeguards:

  • Minimum cohort sizes: We only report on groups of at least 50 users (for commercial reports) or 30 users (for internal analysis), never individuals or small groups
  • No identifiers: Aggregated reports never contain names, emails, user IDs, IP addresses, or any information that could identify you
  • Coarse granularity: We use broad categories (e.g., age ranges like "25-34", regions like "Nordic countries") rather than precise demographics
  • Statistical noise: For sensitive analyses or small regions, we may add mathematical noise to prevent reverse-engineering of individual behavior
  • Behavioral data only: Reports contain only usage patterns (e.g., "40% of fantasy collectors track signed editions") never the actual content of your preferences

Examples of what we might share:

  • "Fantasy special editions with sprayed edges have 3x higher tracking rates than standard editions"
  • "Collectors in the Nordic region show 25% higher interest in translated works"
  • "Pre-release tracking for [Book Title] indicates strong collector demand"

Examples of what we will never share:

  • "John Smith tracks Brandon Sanderson books"
  • Your individual tracking preferences, wishlists, or purchase history
  • Any combination of data points that could identify you

We may receive compensation for licensing aggregated insights and analytics data. This revenue helps support and improve Rare Bindings while providing valuable market intelligence to the publishing industry.

You can opt out of having your behavioral data included in commercial analytics reports at any time from your account settings. Opting out will not affect your ability to use Rare Bindings.

When required under applicable law. Rare Bindings is based in Finland. Our policy is to not respond to government requests for user data unless we are compelled by legal process or in limited circumstances in the event of an emergency request. However, if law enforcement authorities have the necessary warrant, criminal subpoena, or court order requiring us to disclose data, we must comply. It is Rare Bindings' policy to notify affected users before we disclose data unless we are legally prohibited from doing so, and except in some emergency cases.

Finally, if Rare Bindings is acquired by or merges with another company — we don't plan on that, but if it happens — we'll notify you well before any of your personal information is transferred or becomes subject to a different privacy policy.

Your rights with respect to your information

At Rare Bindings, we strive to apply the same data rights to all users, regardless of their location. Some of these rights include:

  • Right to Know. You have the right to know what personal information is collected, used, shared or sold. We outline both the categories and specific bits of data we collect, as well as how they are used, in this privacy policy.
  • Right of Access. This includes your right to access the personal information we gather about you, and your right to obtain information about the sharing, storage, security and processing of that information.
  • Right to Correction. You have the right to request correction of your personal information. You can update your tracking preferences and account information directly from your account settings.
  • Right to Erasure / "To Be Forgotten". This is your right to request, subject to certain limitations under applicable law, that your personal information be erased from our possession. You can delete your account at any time from your account settings, which will remove all your personal information and tracking preferences.
  • Right to Complain. You have the right to make a complaint regarding our handling of your personal information with the appropriate supervisory authority.
  • Right to Restrict Processing. This is your right to request restriction of how and why your personal information is used or processed. For California residents and others where applicable by law, this includes the right to opt out of the "sale" or "sharing" of your personal information. While we never sell personal information in the traditional sense, licensing aggregated behavioral analytics might be considered "sharing" under some privacy laws. You can contact us to exercise applicable opt-out rights. You can contact us to exercise applicable opt-out rights.
  • Right to Object. You have the right, in certain situations, to object to how or why your personal information is processed.
  • Right to Portability. You have the right to receive the personal information we have about you and the right to transmit it to another party. You can export your tracking preferences and account data from your account settings.

Many of these rights can be exercised by signing in and updating your account information. Please note that certain information may be exempt from such requests under applicable law.

In some cases, we also need to take reasonable steps to verify your identity before responding to a request. If you have questions about exercising these rights or need assistance, please contact us at [email protected]. If an authorized agent is corresponding on your behalf, we will need written consent with a signature from the account holder before proceeding.

Depending on applicable law, you may have the right to appeal our decision to deny your request, if applicable. You also have the right to lodge a complaint with a supervisory authority. If you are in the EU or UK, you can contact your data protection authority to file a complaint or learn more about local privacy laws.

How we secure your data

All data is encrypted via SSL/TLS when transmitted from our servers to your browser. The database backups are also encrypted. We go to great lengths to secure your data at rest.

Access controls: Access to user data is logged and restricted to authorized staff only. We maintain audit trails of all data access for security and compliance purposes.

For more information about how we keep your information secure, please contact us at [email protected].

Data retention

We keep your information for the time necessary for the purposes for which it is processed. The length of time for which we retain information depends on the purposes for which we collected and use it and your choices, after which time we may delete and/or aggregate it.

Active accounts: We retain your account information, tracking preferences, and profile data for as long as your account is active.

Behavioral event data: We retain behavioral data in stages as it becomes progressively more anonymized:

  • Raw events (linked to your hashed account): Retained for 12 months, then deleted. This includes individual actions like viewing a specific book or adding something to your wishlist.
  • Aggregated monthly summaries (separated from your identity): Retained for 36 months. These are statistical summaries (e.g., "200 users viewed fantasy books in March 2025") that cannot be traced back to individuals.
  • Long-term trend data (fully anonymized): May be retained indefinitely for historical analysis, as it contains only statistical patterns with no connection to individual users.

This tiered approach allows us to understand long-term trends and industry changes while progressively removing any connection to your individual behavior.

Deleted accounts: If you choose to delete your account, we delete the user data tied to your account and keep only limited anonymized security, audit, or operational records where needed. Data may remain in temporary encrypted backups until those backups expire, currently up to 30 days for nightly database backups and up to 7 days for managed database point-in-time recovery. Aggregated data that does not identify you may remain in analytics systems.

Aggregated analytics: De-identified and aggregated metrics may be retained for up to 36 months for trend analysis and historical reporting. This data cannot be traced back to you individually.

Correspondence: We retain support correspondence and voluntary feedback for as long as necessary to provide support and improve our service, typically for the duration of your account plus a reasonable period afterward.

Backups: Encrypted backups are retained only for the backup retention period, currently up to 30 days for nightly database backups and up to 7 days for managed database point-in-time recovery. Backups of aggregated data may be retained for the full 36-month analytics retention period.

We may also retain and use information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Location of site and data

Rare Bindings is operated from Finland. Our primary production data stores and analytics infrastructure are hosted in the EU:

  • Production infrastructure: Core account, collection, PostgreSQL, Redis, and PostHog analytics data are hosted on EU infrastructure.
  • Other processors: Some providers, such as email, authentication, payment, advertising, and content delivery or security services, may process limited data in other regions.

We use EU-hosted primary infrastructure where practical. Where personal data is transferred outside the EEA or UK, we use appropriate safeguards such as Standard Contractual Clauses or other approved transfer mechanisms.

When transferring personal data from the EU

The European Data Protection Board (EDPB) has issued guidance that personal data transferred out of the EU must be treated with the same level of protection that is granted under EU privacy law. UK law provides similar safeguards for UK user data that is transferred out of the UK.

If we transfer personal data from the EU, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses or other approved transfer mechanisms under GDPR and UK GDPR.

California Notice at Collection

For California residents, this section provides additional information required under the California Consumer Privacy Act (CCPA):

Categories of personal information we collect:

  • Identifiers (name, email address from Google Sign-In)
  • Internet activity (pages viewed, books tracked, features used)
  • Geolocation data (country/region, derived from IP address)
  • Demographic information (optional age range)

Purposes for collection:

  • Providing and improving our services
  • Sending notifications about tracked books
  • Analytics and service improvement
  • Creating aggregated market insights (de-identified)

Categories of third parties we share with:

  • Service providers (hosting, email, authentication)
  • Business partners (aggregated, de-identified insights only)

Your rights:

  • Right to know what personal information we collect
  • Right to delete your personal information
  • Right to opt out of "sale" or "sharing" (we may share de-identified data; opt out via account settings)
  • Right to non-discrimination for exercising your rights

We do not sell personal information in the traditional sense. We may share aggregated, de-identified behavioral data with industry partners, which some laws may consider "sharing." You can opt out at any time.

Extension to other U.S. states: We extend equivalent privacy rights and opt-out options to residents of all U.S. states with active privacy legislation, including Colorado, Connecticut, Utah, and Virginia.

Data Controller

Data Controller: Rare Bindings, Helsinki, FinlandData Protection Contact: [email protected]General Contact: [email protected]

Data Protection Officer (DPO): While we are not currently required to appoint a formal Data Protection Officer under GDPR, all data protection inquiries are handled directly by our privacy team at [email protected].

For questions about your data, privacy rights, or to exercise any of your rights under GDPR, CCPA, or other privacy laws, please contact us at [email protected].

Payments and PayPal

Our marketplace lets collectors buy from and sell to each other. Payments in the marketplace go directly from buyer to seller through PayPal Goods & Services. Rare Bindings never processes, holds, or settles these payments; PayPal handles them under its own terms and its own privacy policy.

When a seller verifies their PayPal payout address, we use PayPal’s Log in with PayPal service. If you verify, PayPal sends us the identifier of the PayPal account you signed in with, the name on that account, and the confirmed email address on it. We use this information to confirm the address buyers will be told to pay, and we keep it for as long as your seller profile exists or until you verify a different account.

We show your payout address to a buyer only after they place an order with you, and it never appears on your public profile. Other members may see that your account is PayPal verified; we never show them your PayPal account details.

Your use of PayPal is a relationship between you and PayPal. Data PayPal holds about you is governed by PayPal’s own privacy policy, and we do not control what PayPal collects.

Changes and questions

We may update this policy as needed to comply with relevant regulations and reflect any new practices. If we make significant changes, we will refresh the date at the top of this page and notify users via email.

New features and data collection: If we introduce new features that collect additional categories of personal data beyond what is described in this policy, we will update this policy and seek your consent where required by applicable law.

Have any questions, comments, or concerns about this privacy policy, your data, or your rights with respect to your information? Please get in touch by emailing us at [email protected].

Attribution: Adapted from the 37signals open-source policies / CC BY 4.0