Privacy Policy
Last updated 12 November 2026
Wyrm is a social app for ranking the books you read and seeing what your friends are reading. This policy explains what we collect, why, who can see it, and how to delete it.
Who we are
Wyrm is run by Luke West, based in Dublin, Ireland, who is the data controller for the personal data described here. You can reach us at lukeoliverwest@gmail.com with any question about your data.
What we collect
Account details you give us. Your name, username, email address, phone number and password. Passwords are handled by our authentication provider and stored only in hashed form. We never see them in plain text.
Profile details you choose to add. A profile photo and your city.
What you do on Wyrm. The books you rank and their scores, categories and any notes you add, books you save to Want to Read, people you follow, likes, comments, and the notifications those actions create.
Safety records. If you block someone, we store that. If you report a post, comment or profile, we store the report, including your reason, any details you write, and a copy of the reported content.
Your contacts, only if you ask. When you tap to find friends from your contacts, and only after you allow access, Wyrm reads the phone numbers in your address book on your device. Those numbers are converted into one-way hashes on your device before anything is sent. We use the hashes only to find which of your contacts already use Wyrm, and we do not save your address book. Names and other contact details are not sent to us.
Your camera, only when you scan. When you scan a book's barcode, the camera reads the number on your device. No photos or video are saved or sent to us. Only the book's ISBN is used, to look the book up.
Device storage. The app keeps some data on your device, such as your login session and recent activity, so it loads quickly. We do not use advertising trackers or third-party analytics.
Why we use it
- To run Wyrm for you: creating your account, saving your rankings, showing your feed, notifications and leaderboards. This is necessary to provide the service you signed up for.
- To help you find people you know: matching your phone number or your contacts against other users. This is based on your consent, which you can withdraw at any time by turning off Findable by phone number in Privacy settings or removing contacts access in your phone's settings.
- To keep Wyrm safe: reviewing reports, removing content that breaks our Terms, and acting on blocks. This is in our legitimate interest and yours.
- For account recovery and support: sending password reset emails and replying when you contact us.
- To improve Wyrm: we may look at aggregated, anonymised patterns, such as which books are ranked most often. This never identifies you.
We do not sell your personal data and we do not show you targeted ads.
Who can see what
Wyrm is a social app, so most of what you post is visible to other Wyrm users: your name, username, profile photo, city, rankings and notes, Want to Read list, comments, likes, and who you follow and who follows you. Your city is used for local leaderboards.
Your email address, phone number and password are never shown to other users. Your phone number is only used, in hashed form, to let people who already have your number find you, and only while Findable by phone number is on.
Services we use
We rely on a small number of providers who process data on our behalf, under contracts that require them to protect it:
- Supabase: database, login and file storage (our main backend, hosted in the United States).
- Netlify: hosts the Wyrm website.
- Resend: sends us an email alert when content is reported.
- Apple: delivers push notifications if you allow them.
To show book details, the app looks up titles and ISBNs with Open Library, Google Books and Wikipedia. Those requests contain the book you searched for or scanned, not your account details. The app also loads fonts and code libraries from Google Fonts, jsDelivr and Cloudflare, which see your device's IP address as with any website.
International transfers
Our backend is hosted in the United States. When your data is transferred outside the European Economic Area, we rely on safeguards such as the European Commission's Standard Contractual Clauses included in our providers' data processing terms.
How long we keep it
We keep your data for as long as your account exists. When you delete your account from Settings → Manage account → Delete my account, we permanently delete your profile, photo, rankings, saved books, follows, likes, comments and notifications, along with your login. Copies may remain in backups for a short time before they are overwritten. We may keep a record of a safety report where we need it to protect other users or meet a legal obligation.
Your rights
If you are in the EU, the UK or another place with similar laws, you have the right to access your data, correct it, delete it, receive a copy in a portable format, object to or restrict how we use it, and withdraw consent at any time. To use any of these rights, email lukeoliverwest@gmail.com. We will reply within one month.
You also have the right to complain to a data protection authority. In Ireland that is the Data Protection Commission (dataprotection.ie).
Children
Wyrm is not meant for children. You must be at least 13 to use it, and at least the age of digital consent where you live (16 in Ireland). If we learn that someone below that age has an account, we will delete it.
Security
Data is encrypted in transit, and access to each user's data is restricted at the database level. No system is perfectly secure, so if you think your account has been compromised, change your password and contact us.
Changes
If we make important changes to this policy, we will update the date above and let you know in the app before they take effect.