Privacy Policy

1.Who we are

BookSwap.lk ("we", "us") runs bookswap.lk, a platform for readers in Sri Lanka to swap, lend, give away and sell books. We are the controller of the personal data described in this policy for the purposes of the Personal Data Protection Act No. 9 of 2022 (the "PDPA").

For any privacy question or request, write to [email protected] with "Privacy" in the subject, or use the contact form.

2.The short version

• We collect only what we need to run a safe book-swapping community.
• Your mobile number is verified to keep fake accounts out. It is never shown to other members unless you choose to show it on books you sell.
• Your location is stored at town level only, never your exact position or street address.
• We do not sell or rent your data, show third-party advertising, or use advertising or analytics trackers.
• You can see, correct and delete your data. Just ask.

3.Information you give us

• Account details: mobile number, email address, username, display name and password (stored only as a secure one-way hash).
• Profile details: photo, cover image, bio, town and district, the languages you read, favourite genres and your preferred site language.
• Listings: book details, condition, price, notes and photos of your books.
• Activity and content: messages and message requests, posts, comments, likes, book reviews and ratings, exchange feedback, circle discussions, wishlists, saved books, reading records and notes.
• Exchanges: swap, loan and sale requests, their status and dates.
• Lending records: if you record a loan to someone who is not a member, their name and phone number as you enter them. Only add someone's details with their permission; we use them only to help you send a return reminder.
• Reports and contact messages: what you tell us when you report something or contact support.

We do not ask for your national identity card (NIC) number, date of birth, street address or bank card details.

4.Information collected automatically

• Sign-in and security: the sessions you are signed in to and a short description of each device and browser (shown to you under signed-in devices); failed sign-in attempts with a scrambled (hashed) form of the IP address, kept for 24 hours to stop password guessing; and IP addresses recorded in security logs of administrative actions.
• Online status: whether you are online and when you were last seen. You can hide this in your privacy settings.
• Technical logs: like any website, our servers and network providers record technical information such as IP address, date and time, and pages requested, to keep the Service running and secure.

5.Location, camera and photos

• We store the town you choose and the coordinates of that town's centre, so we can show books near you. We never store your exact location.
• If you allow your browser to share your location on the search page, it is used only inside your browser to pick the nearest town. It is not sent to or stored by us.
• The barcode scanner uses your camera inside your browser only. No camera images are sent to us.
• Photos you upload are re-saved in a web format, and hidden information such as camera details and GPS location is removed.

6.Information from others

• Other members may give us information about you, for example when they rate an exchange with you, report you, or record a loan to you.
• If you had an account on the previous version of BookSwap.lk, we carried your account details and books over to the new site. Old passwords were not carried over; you sign in with a code sent to you.

7.How we use your information

We use personal data only for these purposes, and only on a lawful basis under the PDPA:

• To provide the Service you asked for: your account, profile, listings, search, distances, messaging, exchanges, circles and notifications (to perform our agreement with you).
• To verify your phone number and email, prevent fake accounts, spam, fraud and abuse, and keep members safe (our legitimate interests and legal obligations).
• To moderate content, handle reports and enforce our Terms and Community Guidelines (legitimate interests).
• To send service messages by SMS and email, such as verification codes, exchange updates and important notices. You can change which emails you receive in your settings.
• To understand how the Service is used, in aggregate, and improve it (legitimate interests).
• To comply with the law and respond to lawful requests from authorities (legal obligation).
• With your consent, for optional things such as showing your phone number to buyers or using your browser location. You can withdraw consent at any time.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

8.What other members can see

• Your public profile: display name, username, photo, town, bio, badges, the books you list, ratings and reviews, and your public posts. Depending on site settings, some of this may be visible to visitors who are not signed in.
• Your phone number: never, unless you switch on the option to show it to buyers on books you sell.
• Your email address: never.
• Messages: only the members in the conversation. Our moderators may see messages when they are reported or when needed to investigate abuse or a safety concern.
• Private circles: only their members.
• Ghost mode: when on, your name is not shown on the journey history of books you pass on.
• Online status and reading statistics follow your privacy settings.

9.Who we share data with

We never sell or rent your personal data. We share it only as follows:

• Service providers who process data on our behalf under contract: Amazon Web Services (servers, file storage and email delivery), Supabase (database hosting), Notify.lk (SMS delivery in Sri Lanka), and Cloudflare (network security and bot checks on forms).
• Book information services: Google Books and Open Library receive the ISBN or title you search for, not your personal details. Anthropic, an AI provider, receives only a book's title and language to suggest a spelling in another script, never personal data.
• Other members, as described above, when you use features that are meant to be shared.
• Authorities: the Police, courts, regulators or other authorities, where the law requires it, under a court order, or where it is necessary to protect someone's life or safety or to prevent crime.
• A successor: if BookSwap.lk is reorganised or transferred, your data may pass to the new operator, who must continue to protect it under this policy.
• Anyone else, only with your consent.

10.Data stored outside Sri Lanka

Some of our service providers store or process data outside Sri Lanka, for example in India, Singapore, the European Union or the United States. We choose providers that protect data to a standard comparable to Sri Lankan law, and transfer data only as permitted by the PDPA.

11.Cookies and browser storage

We use only cookies and browser storage that are needed for the Service to work. We do not use advertising or third-party analytics cookies.

• bs_access: keeps you signed in for the current visit (15 minutes, renewed automatically).
• bs_refresh: keeps you signed in between visits (7 days).
• bs_csrf: protects your account against forged requests (7 days).
• NEXT_LOCALE: remembers your language (1 year).
• bs_ticker and bs_promo_…: remember notices and pop-ups you have closed (24 hours to a few weeks).
• Browser storage on your device: a copy of your basic profile for faster loading, your username if you ask us to remember it, the town you picked, your favourite books, and a page counter used to time pop-ups.

If you block these cookies, signing in and some features will not work.

12.How long we keep data

• Account and profile data: for as long as your account is open.
• Verification codes: they expire after 10 minutes.
• Failed sign-in records: 24 hours.
• Reports, security logs and contact messages: as long as needed to keep members safe, handle disputes and meet legal obligations, normally no longer than 2 years after the matter is closed.
• After your account is deleted: see the next section.

13.Deleting your account

To delete your account, write to [email protected] from your account email, or use the contact form while signed in. After confirming it is you, we will delete your account within 30 days. This means:

• your name, username, email, phone number, bio and photos are removed, and your listings are taken down;
• you are signed out on all devices;
• messages you sent stay with the people who received them, and reviews, ratings and exchange history may remain in anonymous form so other members' records stay accurate;
• book details you added to the shared catalogue may remain without any link to you;
• copies in backups are overwritten in the normal backup cycle.

We may keep information we are legally required to keep, or that is needed for an open dispute, safety investigation or legal claim.

14.How we protect your data

We protect your data with encrypted connections (HTTPS), one-way hashing of passwords and verification codes, optional two-step verification, secure sign-in cookies that page scripts cannot read, limited staff access, and bot protection. No online service can be completely secure. If a personal data breach is likely to harm you, we will tell you and the Data Protection Authority of Sri Lanka as the law requires.

15.Your rights

Under the PDPA, you have the right to:

• access the personal data we hold about you;
• correct data that is wrong or incomplete;
• have your data deleted;
• withdraw consent you have given;
• object to or ask us to restrict certain processing;
• ask for a review of a decision made solely by automated means.

You can update most of your information yourself in your profile, privacy settings, signed-in devices and email preferences. For anything else, write to [email protected]. We may need to confirm your identity first. We will reply within the time the law requires, generally within 21 working days. If you are not satisfied with our answer, you may complain to the Data Protection Authority of Sri Lanka.

16.Children

BookSwap.lk is for people aged 16 and over. Members aged 16 or 17 must have a parent's or guardian's permission. We do not knowingly collect data from children under 16. If you believe a child under 16 has an account, contact us and we will delete it.

17.Other members' information

If you receive another member's personal information through BookSwap.lk, such as a phone number or meeting details, use it only to complete the exchange you arranged. Do not share it, publish it or use it for anything else.

18.Changes to this policy

We may update this policy as the Service or the law changes. The effective date at the top shows the current version. For important changes, we will tell you on the site or by email before they take effect. This policy is available in English, Sinhala and Tamil; if versions differ, the English version prevails.