Privacy
Effective date:
Quillwort is provided by Guided Roots LLC (guidedroots.com). In this policy, “we” and “us” mean Guided Roots LLC.
Quillwort uses account information and shelf images to identify books, preserve their location in a photo, and maintain the collection choices you make.
Information we process
- Identity profile data supplied by the sign-in provider.
- Your purchases of scan credits, and every credit added to your account, used, or given back, described under “Purchases and credits” below.
- The name Quillwort shows for you, described under “Your name” below.
- Shelf photos, derived image crops, transcription evidence, and book matches. The app removes a photo’s GPS position before the photo leaves your phone. It cannot remove a position a camera maker hides in its own notes inside the photo, or one in a photo whose layout it cannot read, and it leaves in any place name, such as a city, that your camera or a photo app wrote into the photo.
- Your shelf, corrections, ownership choices, and service diagnostics. Our request logs record the city, region and country your connection’s IP address is estimated to be in (but not the address itself), in a way that can be tied to your scans, and the words of any book search you make in the app. They are kept for up to 90 days.
- The visits the app groups your photos into, so they reach your other devices: which photos each holds, when each photo was taken, any name you give a visit, and which of its books you have opened.
Retention
Your shelf photo, what was read from it, and its place in a visit, with any name you gave the visit, are kept while the scan exists. Deleting a scan or your account completes within 24 hours, apart from the records described below; a deleted photo stays recoverable in our file storage for at most 9 days, and after any deletion this policy describes, encrypted database backups keep a copy for up to 14 days.
A report you send that a book was matched wrongly outlives the scan. When you delete your account, or twelve months after you delete the scan, the report is deleted, and what it says about the book (the catalog record it was matched to, the reason you gave, and the text read from its spine) is kept in our catalog records without your account, the scan, or a date, with no time set for deleting it.
We also keep, with no time set for deleting them, the records of our catalog search: the text read from your spines, the words you type when you search for a book, and the title and first author of each book you import from Goodreads, with the catalog matches found for them. They are not deleted when you delete a scan, remove your Goodreads library, or delete your account. We keep them because what scans find helps us improve the service.
Deleting your Quillwort account does not delete your Guided Roots sign-in: the email address and password you sign in with, and any name kept with them, that Microsoft Entra keeps for Guided Roots. Other Guided Roots products may use it, so it stays until you ask us to delete it, in the app or by email to contact@guidedroots.com from that address. We delete it within 30 days, after which you cannot use it for any Guided Roots product. Microsoft keeps a deleted sign-in for 30 days, so that one deleted by mistake can be restored, and then begins erasing it for good.
After you delete your account we keep, for accounting, your purchases and credits for seven years: every purchase, every credit added to or used from your account, and what a refund took back. Credits we gave you ourselves keep the name you had in Quillwort when we gave them. With them we keep the bare record that your account existed, marked deleted and with your name removed.
We keep two other records for twelve months, so that we can look into a complaint, a credit dispute or misuse raised after you leave, and then delete them:
- The record of each scan, from the day the scan is deleted, whether you deleted it, it went with your account, or Quillwort deleted it because it was left unfinished for more than 24 hours. It keeps the photo’s file name, type, size and dimensions, when the scan was made, the work done to read it, and the titles and authors of up to eight of the books it found, but not the photo or the rest of what was found in it.
- Our internal record of actions taken on your account, from the day you delete your account.
Sharing and service providers
Quillwort uses contracted cloud, authentication, and (for personalized recommendations, described below) AI providers only to operate the service. Purchases are made through Apple and Google, as described under “Purchases and credits” below. We do not sell personal information. The Quillwort app and website contain no advertising or analytics code from other companies, and we do not track what you do on other apps or websites. Microsoft provides the sign-in (Microsoft Entra) and the cloud our systems run on (Microsoft Azure), under Microsoft’s terms for those services, which include Microsoft’s data protection addendum. Under that addendum Microsoft handles what it holds for us only on our documented instructions, to provide those services to us and for the billing and internal reporting that go with them, done without looking at the content; it may not use it to profile you or for advertising, and may not sell it; and it must give us reasonable help in responding to requests from people about it. That matches what this policy says about our own use of your information, and we rely on it for the protection your information has while Microsoft holds it. It does not make this policy bind Microsoft: how long Microsoft keeps anything is as described under Retention and in Microsoft’s own terms.
Reading the books in your photos (finding each book, reading the text on its spine, and searching the book catalog) runs on systems we operate, and what it receives and finds passes through our own file storage.
Quillwort's operators can open your scans in our internal administration tool: the photo, the record of what was read from it, and any report you sent that a book was matched wrongly.
Personalized book recommendations
Quillwort builds a taste profile from your library in Quillwort — the books you import from Goodreads and the books you save to Want to Read — and uses it to score how well a book found on a shelf is likely to match your taste. Both steps use OpenAI. We use OpenAI under its business terms, which include OpenAI’s data processing addendum. Under that addendum OpenAI handles what we send it only on our behalf and on our instructions, to provide and support its service to us; it may not sell it or share it as U.S. privacy law defines those terms; and it must give us reasonable help in responding to requests from people about it. That matches what this policy says about our own use of your information, and we rely on it for the protection your information has while OpenAI holds it. It does not make this policy bind OpenAI: OpenAI’s terms and data usage policies govern how long it keeps what we send it. Deleting anything in Quillwort, including your account, deletes our copy only; what OpenAI has already received stays under OpenAI’s control.
To build your taste profile, each time it is built or rebuilt, we send OpenAI your whole library: for every book, its title, authors, publication year, your rating or whether you read it or want to read it, and its catalog subjects (or, for a book with none, the start of its catalog description), with the start of any Goodreads review you wrote of it. Topics, authors, and what makes a book a hit or a miss for you, where you have added them yourself, and entries you have removed from an earlier profile, are sent too.
To score a shelf, each time its books are ranked, we send OpenAI your taste profile (including up to three titles from your library as examples of each kind of reading it describes, and anything you added to it yourself) and, for each book found on the shelf, its title, authors, and catalog subjects. The app ranks a scan’s books as soon as its findings are ready, unless you turn off “Rank every scan with AI” in the app’s Settings, and again whenever you ask it to.
We do not keep the export file; for each book we keep its Goodreads book number, the title, author, ISBN, format, your rating and review, your shelves, and the date you read it.
Your name
Quillwort keeps one name for you: what the app calls you, and what your friends see. It starts as the name your sign-in provider gives us or, if there is none Quillwort can use, a random one such as “Hazel Thornfield”. Your friends always see your current name, and a signed-in reader who opens a friend invitation link you made can see it while the link is unused, not withdrawn, and less than 72 hours old.
Quillwort's operators see your name in our internal administration tool, and a record of credits we give you keeps the name you had then. When you delete your account, your name is erased at once, except from those credit records; your Guided Roots sign-in keeps any name kept with it (see Retention).
Friends and your reading taste
Being friends shows each of you the other's name, the date you became friends, and whether the other lets you use their reading taste, and shares nothing else. Separately, friend by friend, you can let a friend score the books on a shelf they scan against your taste profile. It is off until you turn it on for that friend.
When they do, Quillwort sends your taste profile, as you have edited it, to OpenAI with the books on your friend's shelf, as described above for your own shelves. Your library, ratings, and reviews are not sent for it, although your profile names some of your books as examples. Your friend sees a score and a one-sentence reason for each book. Quillwort tells the model not to name a book or author from your profile and withholds reasons in which it finds one, but that check can miss a very short title or name, or one written without capital letters, and a reason can describe your taste in other words.
Quillwort keeps an internal record of each use with your friend's account. You can turn it off for any friend in the app's Friends screen, which deletes every score that friend made with your taste. Removing or blocking a friend, or deleting either account, ends it in both directions and deletes those scores too.
Invitations to Quillwort
The app's Invite page gives you a QR code and a link for handing Quillwort to someone. They are not friend invitations: they link no accounts and share nothing. They carry an invitation code made for you, which we keep with your account.
Against each code, we count how many times its link was opened, and how many times the app was first opened with it through Google Play, with the first and last time of each. If someone starts a Quillwort library with your code, we record that, and whether the code came through Google Play or was typed in. Only Quillwort's operators see who invited whom, in our internal administration tool, to understand how people come to Quillwort.
Your codes and their counts are deleted with your account. The record that someone's library was started with your code is kept until they delete their account; if you delete yours first, it stops naming you.
Purchases and credits
You buy scan credits in the app, through the App Store or Google Play. Apple or Google takes your payment; your card and other payment details do not reach us. The app gives the store our internal number for your Quillwort library, which it keeps with the purchase so that we can tell the purchase is yours, and we confirm each purchase, and any refund, with the store.
For each purchase we keep the store's transaction or order number, the pack and number of credits, the price and its currency, and when you bought it. We also keep a record of every credit added to your account, used for a scan, or given back, and of what was taken back after a refund. When we add credits ourselves, we record how many, why, and the name you had in Quillwort at the time. These records are kept after you delete your account, as described under Retention.
Who Quillwort is for
Quillwort is for people 18 or older. We do not knowingly collect information from anyone younger, and if we learn that a reader is under 18, we close the account and delete it as described under Retention. Where the law requires it, Apple or Google tells Quillwort your age range (not your date of birth) when you open the app. We use it only to check that you are an adult, keep nothing from the check, and do not share it.
Security
Information travels between the app, our systems and our providers over encrypted connections, and our file storage and databases are encrypted where they are stored.
Your choices
You can delete an individual scan or request account deletion in the app. For access, correction, or support requests, email contact@guidedroots.com.
Changes to this policy
When we change this policy, we post the new version on this page and change its effective date.