Privacy Policy
Last updated: September 30, 2026
UniBooks (the "Platform") respects your privacy. This policy explains what data we collect, why, how we use and protect it, and the rights you have. It is written in accordance with Taiwan's Personal Data Protection Act ("PDPA") and related regulations.
By using the Platform you acknowledge that you have read this policy. If you do not agree, please stop using the Platform.
1. Who We Are
The Platform is operated by the UniBooks development team. For any question or request about your personal data, write to services@unibooks.app.
2. What We Collect
2.1 Data you provide
| Category | Details | When |
|---|---|---|
| Account | Email, name or nickname, avatar, language preferences | Sign-up, profile edits |
| Sign-in | Password (stored only as a one-way hash); if you use Google sign-in, the Google account identifier, email, name and avatar Google shares with us | Sign-up, sign-in |
| Student verification | School, .edu.tw school email, verification time and per-semester re-verification records; for manual review, the supporting information and request notes you submit | Verification |
| Listings | Title, ISBN, price, condition grade and description, condition photos | Creating a listing |
| Transactions | Orders, order status, cancellations, completion confirmations | Ordering, meetups |
| Communications | In-app chat messages and timestamps | Messaging other users |
| Restock alerts | Books you add to alerts or your wishlist | Using restock alerts |
| Reports & appeals | Reported party, reason, attachments and handling records | Filing a report |
| Support | Content of emails you send us | Contacting us |
2.2 Data collected automatically
- Device and connection data: IP address, browser and operating system, screen and language settings, referrer and pages visited, visit times.
- Sign-in state: to keep you signed in and prevent account takeover we store sign-in credentials (refresh tokens) and their expiry.
- Cookies and similar technologies: see Section 7.
- Usage statistics: anonymous statistics (page views, feature-usage trends) via Google Analytics 4.
2.3 Data from third parties
- Google sign-in: if you choose it, we receive basic account information from Google.
- Book metadata: ISBN metadata comes from public sources such as Google Books and contains no user data.
We do not ask for or store credit-card, bank or other financial data. The Platform never handles payments between buyers and sellers.
2A. Google User Data
UniBooks offers "Sign in with Google" (Google Identity Services). This section explains how we access, use, share, protect, retain and delete Google user data. If you do not use Google sign-in, we receive no Google user data.
What Google data we access
We request only the basic sign-in scopes openid, email and profile. After you consent, Google gives us a sign-in credential (ID token), from which we receive and store:
| Data | Purpose |
|---|---|
Google account ID (sub) | Links your Google account to your UniBooks account so you can sign in with Google again |
Email address and whether Google has verified it (email, email_verified) | Creating and identifying your account; we accept only Google-verified addresses to prevent impersonation; sending account-related emails |
Given and family name (given_name, family_name) | Your default display name, which you can change in Account Settings |
Profile picture URL (picture) | Your default avatar; refreshed each time you sign in with Google |
Other basic ID-token claims (such as locale, Google Workspace domain hd, issue and expiry time) | Stored with the above as part of the account-link record only; not used for anything else |
We do not access your Gmail, Google Drive, contacts, calendar, YouTube or any other Google service, and we never receive your Google password.
How we use it
Google user data is used only for the sign-in and account purposes in the table above. We do not:
- use Google user data for advertising, including personalized or targeted ads (campus content we show by school is based on your
.edu.twstudent verification, not on Google data); - sell Google user data or give it to data brokers, ad platforms or information resellers;
- use it to build user profiles or determine credit-worthiness or lending eligibility;
- use it to develop, improve or train generalized AI or machine-learning models.
How we share it
We do not sell, rent or transfer Google user data. We share it only:
- with service providers that run cloud hosting, database hosting and email delivery for us, solely to operate the service and under contractual confidentiality;
- with other users, who see your display name and avatar on your profile and listings — your email address and Google account ID are never public;
- where required by law, or with your explicit consent.
Google user data is not sent to Google Analytics and is not given to any advertiser.
How we protect it
- HTTPS for all traffic;
- ID tokens are accepted only after the server verifies their signature against Google's public keys;
- stored in access-controlled databases with least-privilege access limited to authorized staff;
- see Section 6.
Retention and deletion
- Google user data is kept while your UniBooks account exists.
- Deleting your account: you can delete it directly in Account Settings. We immediately delete your Google account-link record (all Google data in the table above), clear the email, name and avatar on your account, and revoke all sign-in tokens.
- Revoking Google access only: you can remove UniBooks at your Google Account permissions page at any time. We can then no longer sign you in with Google and receive no further Google data from you. To also delete what we have stored, delete your account or email services@unibooks.app; we act within 15 days.
Limited Use disclosure
UniBooks' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not allow humans to read Google user data unless we have your explicit consent, it is necessary for security purposes (such as investigating abuse), it is required by law, or the data is aggregated and de-identified and used only for internal operations.
Changes in use
If we ever want to use Google user data in a way not described in this section, we will update this policy, notify you, and obtain your consent before doing so.
3. Why We Use Your Data
We use your data only for these specific purposes:
- Providing and operating the service: account creation and verification, student-status checks and semester re-verification, book search and listings, matching and chat, order flow, restock alerts.
- Notifications: verification emails, password resets, order updates, restock alerts and, if enabled, new-message emails (you can turn these off in settings).
- Safety and anti-fraud: detecting impersonation, duplicate accounts, spam, abuse and violations of our Terms; handling reports and appeals.
- Improving the product: analyzing anonymized or aggregated usage data to improve search and usability.
- Legal compliance: responding to lawful requests from authorities and protecting the rights of the Platform and its users.
- Campus content and ad slots (if any): showing campus-life content based on your school or region, using your student verification data. We never give advertisers data that identifies you, and we never use Google user data for any advertising.
We will not use your data for other purposes; if a new purpose arises we will obtain your consent or notify you as required by law.
4. Retention
- Account and listing data: kept while your account exists.
- Account deletion: when you delete your account we immediately remove your listings, delete your Google account-link record, student verification records and restock alerts, and clear the email, name and avatar on your account. To handle disputes, prevent abuse and comply with law, some transaction and report records are retained for as long as necessary in de-identified or access-restricted form, then deleted or anonymized.
- Chat messages: kept while the conversation exists; after account deletion, handled as above.
- Sign-in credentials: until they expire or you sign out.
- Server logs: kept only for a reasonable period needed for security and debugging.
- Google Analytics data: kept per the Google Analytics retention setting and not linked to your account data.
5. Sharing and Disclosure
We do not sell or rent your personal data. We share it only in these cases:
- Other users: to complete transactions, your nickname, avatar, school, listings and condition photos are visible to other users. Chat content is visible only to the participants (and to administrators where needed to handle a report). Your email address is not shown publicly.
- Service providers (processors): we use providers to process data on our behalf and require them to use it only for the Platform and to protect it appropriately:
- Cloud and network services: website hosting, content delivery, file storage and real-time chat (Cloudflare), plus backend and database hosting.
- Email delivery services.
- Google: sign-in, Google Analytics (anonymous usage statistics only — no Google user data or account data), Google Books (catalog lookups, no user data).
- With your consent.
- Legal requirements: court orders, lawful requests from authorities, or where necessary to protect someone's life, body or property.
- De-identified statistics: aggregated data that cannot identify a person (never including Google user data).
International transfers
Our providers' servers may be located outside Taiwan (for example in the United States or elsewhere), so your data may be transferred and processed abroad. We choose providers with appropriate safeguards and follow the PDPA.
6. Security
We take reasonable technical and organizational measures, including:
- HTTPS enforced site-wide;
- passwords stored only as one-way hashes, so we cannot see your original password;
- short-lived access tokens with rotating refresh tokens;
- least-privilege access to databases and the admin console, limited to authorized staff;
- uploaded images kept in managed object storage.
No internet transmission or electronic storage is completely secure. Please keep your password safe and do not share your account. If you suspect account takeover or a data leak, contact us immediately.
7. Cookies and Similar Technologies
| Type | Purpose | Can you disable it? |
|---|---|---|
| Essential storage | Keeping you signed in, language and theme preferences, security | Some features will not work without it |
| Analytics | Anonymous usage statistics via Google Analytics | Yes — via browser settings or Google's opt-out add-on |
You can delete or block cookies and local storage in your browser settings. We do not use cookies for cross-site tracking or personalized advertising.
8. Your Rights
Under the PDPA you may, regarding your own personal data:
- request access or review;
- request a copy;
- request supplementation or correction;
- request that we stop collecting, processing or using it;
- request deletion.
How to exercise them: most data can be viewed and edited in Account Settings, including notification preferences and account deletion. For other requests, email services@unibooks.app from your registered address so we can verify your identity. We respond within 15 days, and if we need more time we will tell you why.
We may decline part of a request where the law requires or business operation necessitates it (for example records needed to resolve a dispute), and will explain the reason. If you withhold required data or ask us to delete or stop using data we need, we may be unable to provide all or part of the service.
9. Minors
The Platform is for students and alumni of Taiwanese colleges and universities. We do not knowingly collect personal data from anyone under 18; if you are a minor, please use the Platform with your legal guardian's consent. If you believe we collected a minor's data without such consent, contact us and we will handle it promptly.
10. Third-Party Links
The Platform may link to third-party sites. They have their own privacy policies and we do not control their content or practices.
11. Changes to This Policy
We may revise this policy for legal, service or operational reasons. Changes are posted on this page with an updated "Last updated" date; for material changes we will notify you through an announcement or your registered email. Continuing to use the Platform after a change means you accept it.
12. Contact
Questions, comments or complaints about this policy: services@unibooks.app. See also our Terms of Service.
The Traditional Chinese version prevails if the two versions differ.