Opening the shelves…
HorrorBooks.netHorrorBooks.netEffective date: 21 September 2026
Last updated: 20 October 2026
HorrorBooks.net is operated by Thomas Humphrey and based in New South Wales, Australia. Our mailing address is 28 Bayview Boulevard, Darwin NT 0820, Australia. For privacy questions, access or correction requests, complaints, or an account and associated personal information deletion request, contact hello@horrorbooks.net. We do not currently provide an automated account-deletion control.
Passport search text, reactions, excluded books, content boundaries and correction notes stay in the current browser tab. Refreshing clears that detailed session. Completing Passport stores only a short, versioned taste summary on this device for the homepage; it cannot resume the Passport or reconstruct your answers.
Nightstand saves, followed authors and separate per-book reading notes (finished, currently reading, did not finish, want to read, not for me and optional reaction) stay in this browser’s local storage by default. If you sign in with Google, your Nightstand and followed-author lists are copied to your HorrorBooks.net account and sync across signed-in devices; the local copies remain available in this browser. Imported reading status is separate from the Nightstand and remains local in this release.
CSV import is currently paused while its complete journey is reviewed. Existing import receipts and local reading history remain on this device and are not deleted. New cloud reader profiles and history saves are paused. Account sync and recovery do not upload Passport answers, boundaries, free-text notes, imported review text or CSV contents. Service recovery email is separate from optional marketing and does not subscribe you to updates.
Older homepage saves are copied into the current Nightstand format while the original legacy copy is retained as a migration backup. Optional email recovery is live and is used only when you explicitly request it; it is separate from optional marketing and does not subscribe you to updates.
The Recommendations sign-up lets you separately request one email with your first three book picks, future editorial recommendations, horror news, and book discounts and promotions. None is preselected. The first-picks request sends a confirmation link to your verified Google account email; the three picks are emailed only after you confirm on that page. Selecting first picks alone does not opt you in to later editorial emails. The other three topics are saved as future choices and remain disabled for delivery until their email and withdrawal controls are ready. Newsletter consent is separate from an account, saved books and recovery email. We retain submitted email addresses, selected categories, consent wording versions, request source and time, and withdrawal records in Supabase. We do not treat an account or recovery request as newsletter consent. Existing subscribers can use the preferences and unsubscribe links in their email. To withdraw a future choice before launch, contact us using the address above.
Recommendations remain usable without email. Earlier three-book email requests, if any, store the submitted taste choices, selected books and fit reasons with the request so confirmation and delivery do not depend on this browser tab.
We retain consent and opt-out records to respect your choices and prevent unwanted mail. We use hashed email and network information to limit abusive requests, and retain delivery and suppression records to handle failed deliveries and complaints. We do not add your email address or newsletter confirmation links to PostHog, use email open or click tracking for this newsletter, or use newsletter consent as analytics consent. Contact us for access, correction or deletion requests.
When you send a catalogue suggestion, we store your selected tags or horror ratings, or your missing-book suggestion text, together with the book or author and section it concerns, submission time and review status in a private review queue in Supabase. An account is not required. We use this information to review potential additions and corrections before publishing them. Please leave out personal information. We use a rotating, hashed network identifier to limit abuse; we do not store your raw IP address in the suggestion record.
Sending a suggestion works without analytics consent. If you allow analytics, PostHog receives the form opening and successful submission, catalogue identifiers, section, coverage state and a submission reference, but not your suggestion text or source links. Resolved suggestion text is eligible for manual deletion after 90 days; no automatic purge is scheduled. Contact us for access or deletion requests.
Feedback from the Recommendations page is stored in the same private review queue with the page, submission time and review status. We use it to improve the site; it does not publish catalogue changes. The same abuse limits and manual deletion arrangements apply. Feedback text is not sent to analytics.
If you use Google sign-in for an existing account, Google provides an account identifier, name, email address and profile image so we can authenticate you and display your account. We do not receive your Google password and do not request access to your Google Drive, contacts, messages or other Google content.
We use this information to maintain existing account access, show your signed-in identity, protect account access, sync your Nightstand and followed authors, and respond to account or privacy requests. New cloud reader profiles are paused. We store the account profile linked to your Google identifier in Supabase, together with the account-owned Nightstand and followed-author rows described above. We do not use Google profile data for advertising.
Signing out stops account sync on that browser but does not delete your account data. You may request deletion of your HorrorBooks account and associated personal information by contacting us at hello@horrorbooks.net. We do not currently provide an automated account-deletion control.
We use Supabase for authentication and account data storage, Vercel for hosting and delivery, and Resend for requested email. These providers may process information on our behalf, including account identifiers, profile details, saved account data, and ordinary request and device information. Our primary Supabase database is configured in Sydney, Australia, and Resend’s sending region is configured in Tokyo, Japan. Our current Vercel server-function region is in the United States, with global hosting and content delivery. PostHog uses its United States endpoint for optional analytics. These are service configuration locations, not guarantees that all processing, backups, support access or subprocessors remain in those countries. These providers may process information in other countries under their service arrangements.
Google may also process information under its own terms and privacy policy when you use Google sign-in. We do not control the privacy practices of Google, retailers, publishers, authors or other linked third-party services.
We retain account profiles and account-synced Nightstand and followed-author data while your account remains active, and for as long as reasonably necessary to handle security, legal, dispute, backup and record-keeping requirements after a deletion request. Local browser data remains until you clear it or the relevant feature removes it. We do not currently run an automatic newsletter-record deletion schedule. Newsletter consent, delivery, opt-out and suppression records are retained so we can document requests, investigate delivery problems and avoid contacting people who opted out or whose address is suppressed. We review deletion requests manually; we may retain the minimum opt-out or suppression record needed to prevent further unwanted email. Analytics and infrastructure log retention is governed by provider settings and operational requirements; we do not promise a fixed deletion period.
The three-book request snapshot is eligible for a maintenance purge after 90 days. That purge is not currently scheduled, so contact us if you want access to or deletion of this request. We handle deletion requests manually and may retain the minimum consent, opt-out or suppression record needed to respect your choice.
When we complete a valid deletion request, we will delete or de-identify personal information we no longer need, subject to information we are legally required or reasonably permitted to retain. We may need to verify a request before acting.
You may ask us for access to personal information we hold about you, request correction of inaccurate information, ask questions about our handling of information, or make a privacy complaint by contacting hello@horrorbooks.net. We will take reasonable steps to respond and investigate. You may also contact the relevant Australian privacy regulator if you are not satisfied with our response.
Analytics is optional. If you allow it, PostHog receives public page and book identifiers, discovery link choices and positions, search result counts and filter counts, recommendation setup, results and feedback, signup stages and outcomes, successful Nightstand save and remove actions, catalogue suggestion actions, public author follows, tour transitions, bounded feature outcomes, approved campaign labels, a broad screen-size category, and pseudonymous browser and session identifiers. These help us understand which campaigns and discovery features lead to book views, saves and return visits. We do not link these analytics identifiers to your Google account or email. You can allow, decline or withdraw analytics in My account. Without permission, no analytics events are sent. Withdrawal stops further collection and clears the active analytics identifier on this browser; it does not delete events already received by PostHog.
We do not record sessions or automatically capture form fields. Email addresses, search text, correction notes and private email links are excluded from these analytics. When you allow analytics, your browser stores an analytics identifier and approved campaign attribution. Account, sign-in, recovery and private email pages are excluded from collection. You can clear local browser data in My account. Hosting and analytics services also receive ordinary network information, including your IP address, when handling requests.
The optional Passport JSON download contains your reactions, excluded books, boundaries, feedback and result history. Downloading does not upload it or subscribe you to anything. The file stays on your device until you delete it; only share it if you choose.