Privacy
Updated September 29, 2026.
Your library is stored in this browser; the JSON backup is created here. With your separate authorization after sign-in, Drive receives a copy directly from the app. One choice in the notice controls visits, error diagnostics, interface experiments and their technical counts; submitted searches and external covers use Open Library. An optional action opens a search in Google Books.
Livro a Livro is a personal library that works in this browser. You do not need to create an account to add, edit, view, or export your books.
Your library stays on your device
Books, notes, ratings, and uploaded covers stay in the browser’s local storage. The project does not receive this data. The JSON backup is created and restored on your device and contains your private information: keep it somewhere you trust.
Clearing browser data or changing browsers or site addresses may leave your shelf empty. Installing the app does not create a backup or guarantee that records will be kept.
Google Drive is optional
If you choose “Sign in with Google”, the first step confirms your account and keeps you signed in on this browser without accessing Drive. When you return to the app, the connection may be restored without another sign-in. You can then choose “Authorize Google Drive” to allow access to Livro a Livro’s private app folder (drive.appdata). This second permission does not give the app access to your other Drive documents.
Your library and covers travel directly between the app in your browser and Google Drive. The Livro a Livro API does not receive books, notes, ratings, covers, snapshots, or backups. Uploads require the app to be open and connected; changes may wait until you return.
The authorization service, hosted on AWS, processes the technical identifier received from Google. The first step stores its own session and an opaque technical link; it does not create a Drive session or keep a Google refresh credential. Only after Drive authorization does the service store the link, sessions, and an encrypted refresh credential. It does not store your profile name or email. Short-lived access tokens stay only in the app’s memory; sign-in and authorization cookies are protected from JavaScript access.
Pausing uploads keeps the connection and local data. Signing out ends sign-in and Drive access on this browser and, after confirmation, erases books, notes, covers, preferences, and local recovery copies from this device. Changes not yet uploaded will also be lost; export a backup first if you want to keep them. Other devices and existing Drive files remain. If sign-out or local cleanup fails, the app tells you and lets you retry. Disconnecting Drive keeps you signed in, blocks the Drive link at the service, and requests revocation from Google without erasing the local library. Previously issued tokens may remain valid until revocation or expiry. You can also remove authorization in your Google Account connections. Revoking access does not automatically delete copies already stored in Drive.
Retention and removal
Authorization attempts and their cancellation controls expire within ten minutes. Sign-in and Drive sessions have a rolling lifetime of up to 30 days, renewable up to an absolute limit of 180 days from creation; a connection inactive for 180 days no longer authorizes access. These limits are enforced even if physical storage cleanup has not finished.
After disconnection, the credential may be used only to attempt revocation for up to 24 hours. A routine removes the retained credential; infrastructure failures may delay physical removal. A technical block record may remain to prevent old operations from reactivating the connection. An uncertain response from Google keeps the connection blocked until it can be resolved safely.
You can delete records in the app or remove this site’s data in your browser settings. Before doing so, export a backup if you want to keep a copy. For help with data held by the authorization service, use the contact below.
External search and covers
A search you submit queries Open Library. Displaying an external cover also makes a request to its provider. The “Search Google Books” button opens another tab and sends Google the text you entered only when you click it; those search results are not automatically copied to your shelf. These services receive the information needed for the request and connection data such as your IP address. Manual entry and local covers remain available without these requests.
Visit counting with Google Analytics
The initial notice offers one choice to count visits with Google Analytics, send technical error codes, join optional interface experiments and send their technical counts. If you decline or have not yet chosen, the app does not load the Analytics script, request the experiment catalog or send these codes and counts. Google Drive and library use work independently of this choice.
If you accept, we send visits to public pages by fixed categories such as Shelf, Data, and Book. The submitted address omits the real URL, book identifiers, query, title, note, rating, cover, and sign-in data. Google receives connection data needed for the request, such as your IP address, and may store _ga cookies in this browser for up to 30 days. Event data retention in the property is set to two months. Advertising, Google signals, and personalization are off.
This single choice is stored in this browser outside the library and backup. You can review it in Settings or on Your data. On revocation, the app stops new measurements, experiment catalog requests and count submissions, deletes Analytics cookies accessible to this site, and offers a safe reopen when possible. Already aggregated counts cannot be removed individually because they contain no identifiers. Cookies on other domains or in tabs the app cannot control may require browser controls.
Acceptance given before experiments were added is not treated as acceptance of this expanded choice. The new notice asks for an explicit decision; without it, experiments and their metrics remain off.
With this new acceptance, the app may request an interface experiment catalog. Percentage rollout and the version are chosen on this device using a random local seed, which is not sent to the API, Drive or the backup. Invalid, expired, unavailable, disabled or immediately cancelled configuration keeps the standard interface. The initial catalog does not activate variations.
If an experiment is active, the app may send the API limited counts of exposure, use, error or rollback without cookies, with app version, experiment key and revision, variant and a technical code from a fixed list. It does not send books, notes, ratings, covers, searches, identifiers, the seed, free text, URLs or precise times. The service sums counters by day without individual events or unique people; there is no public report or endpoint to query these counters. Counters remain available for up to 30 days, while physical deletion may happen later. Infrastructure receives connection data needed for the request, such as IP address, but does not store them as counter dimensions.
Optional error diagnostics
The same acceptance in the notice allows the app to send the Livro a Livro API only an area and a technical failure code from a fixed list, with limited counts. It does not send books, notes, ratings, covers, URLs, screens, identifiers, messages, stacks, or error times. The request does not use cookies. Authorizing Drive does not authorize this submission.
You can decline or review the choice in Settings; revocation cancels submissions in progress and discards counts still in memory. Offline, the app continues to work without this submission. The service and infrastructure may still receive connection data needed for the request, such as your IP address.
Infrastructure and third parties
AWS distributes the app and hosts authorization. AWS, Google, and Open Library process connection data needed for their services, subject to their respective policies. The infrastructure may process technical data for security and operation; that does not mean it receives your library. We do not use behavioral advertising or sell your library.
Application logs do not include library content, tokens, or raw request data. Minimal operational execution logs are retained for 14 days. Infrastructure services may keep administrative and security records under their own rules.
Contact
For privacy and support, contact the person responsible for Livro a Livro at ewanderson.flaviano@gmail.com. Do not send passwords, tokens, or your complete library; describe the problem first.