Your information Privacy Policy

1. Who we are

Bookswap is the online book-sharing service at https://www.bookswap.co.nz and https://bookswap.co.nz (“Bookswap”, “we”, “us”).

Bookswap is operated by the BookSwap Team. We do not have an NZBN or a company number. You can contact us by email at admin@bookswap.co.nz. Our Privacy Officer is the BookSwap Team, at the same email address.

Under the Privacy Act 2020, we are an “agency” and must have a Privacy Officer.

2. Scope

This policy explains how we collect, use, store, disclose, and otherwise handle personal information in connection with Bookswap. It is intended to help us meet the 13 information privacy principles (IPPs) in the Privacy Act 2020, the notifiable privacy breach rules, and information privacy principle 3A (IPP 3A), which has applied since 1 May 2026 to personal information collected from someone other than the individual concerned.

It applies to:

• adult members (including parents and guardians);
• children and young people aged 15 and under who have a child account managed by a parent or guardian;
• visitors to the public website; and
• people whose information we receive indirectly (for example, when a parent creates a child’s account, or a member rates or reports another member).

This policy does not cover other websites we link to, including Open Library and Cloudflare, which have their own policies.

3. The personal information we collect

We aim to collect only what we need to run Bookswap (IPP 1) and, where practicable, to collect it from you directly (IPP 2).

3.1 Information you give us when you create an adult account

Adult sign-up (for people 16 and over) currently asks for:

• email address (required) — we send an activation link to this address, and we use it to sign in and to contact you;
• real name (required) — this is private. It is visible to you and to Bookswap administrators, not to other members on your public profile;
• display name (required) — this is shown to other members;
• date of birth (optional);
• password (required; stored as a hash, not in plain text).

If you are 15 or under, you should not create an adult account. A parent or guardian should create their own account and add you from their Family page.

You may also later provide a profile photo, change your email address, or update your profile details.

3.2 Child accounts (ages 15 and under)

A parent or guardian creates each child account from their Family page and sets a username and password. Children sign in with that username and password. Child accounts do not have their own email address.

For a child account we may hold:

• the child’s real name and display name;
• username;
• password (stored as a hash);
• date of birth, if provided;
• a profile photo, if provided;
• the link to the parent or guardian’s account;
• the child’s listings, requests, messages, ratings, swap history, and related records, as described below.

We collect this information from the parent or guardian, not from the child, except where the child later uses the service themselves (for example, by sending a request or a message after the parent has approved).

3.3 Listings, requests, messages, ratings, and reports

When you use Bookswap we also collect and hold:

• book listings (title, and if provided author, ISBN, cover image, condition, whether the listing is Free or Swap, a description of that copy, and listing status);
• book requests, including whether a parent approved or declined a child’s request, and any short parent note;
• in-site messages once a request has been accepted (and, for a child, only after the parent has approved);
• ratings of a swap partner (thumbs up / thumbs down, and any optional comment);
• confirmation of whether a swap went well, and any feedback you send to us as the site operator;
• reports of a conversation, including the reason you give, and any administrator notes when we review the report;
• blocks you place on other members;
• in-site notices we send you;
• a history of your swaps and related events.

Parents can read their children’s conversations. If you message a member who is a child, that child’s parent or guardian may read the conversation.

3.4 Technical, security, and account information

We also collect:

• a session cookie (bookswap_sid) so we can keep you signed in;
• the date your account was created, last sign-in time, and account status (for example pending, active, or suspended);
• email activation, password reset, and email-change tokens (stored as hashes, with expiry);
• login attempt records (email or username attempted, IP address, success or failure) and rate-limit records, to reduce abuse;
• an audit log of important account and safety actions, which may include an actor, action, related record, IP address, browser user agent, and technical details;
• a Cloudflare Turnstile check on some forms (including sign-up, forgot password, and resend activation), which involves Cloudflare receiving the information needed to complete that bot check (typically including a token and technical data such as IP address).

We do not use this technical information to build advertising profiles.

3.5 Cover lookups (Open Library)

When you list a book, you type a title (and may provide other details such as author or ISBN). We look up a cover image and show it to you to confirm. That lookup is made with Open Library (openlibrary.org and covers.openlibrary.org, operated by the Internet Archive). We may cache lookup results so the same search is not repeated. We send book details for this purpose, not your password or real name. Open Library is outside New Zealand; see section 8.

3.6 Information we do not currently collect as a standard listing field

At the moment, public listings do not require a town or region, and postage is arranged between members. If we add a region or similar field, we will update this policy and the listing form so you can see what is collected and what is shown to others.

4. How we collect information, and what we tell you (IPP 3 and IPP 3A)

4.1 When we collect information from you (IPP 3)

When you sign up, use a form, list a book, send a request, message someone, rate a swap, or report a conversation, we collect that information from you. This policy, together with the wording on those forms, is how we tell you:

• that the information is being collected;
• the purpose;
• who is likely to receive it;
• our name and how to contact us (see section 1);
• that the collection is not generally required by a specific law, but that some details are required if you want to use that part of the service (for example, an email address to create an adult account); and
• that you may ask to access and correct your information (see section 10).

4.2 When we collect information from someone else (IPP 3A)

IPP 3A has applied since 1 May 2026. If we collect personal information about a person from someone other than that person, we must take reasonable steps, as soon as reasonably practicable, to make sure they are aware of the same kinds of matters, unless an exception applies (for example, they have already been told, the information is publicly available, telling them would prejudice the purpose of collection, or another exception in IPP 3A).

This is relevant to Bookswap in particular when:

• A parent or guardian creates a child account and gives us the child’s name, username, and other details. We will tell the parent or guardian, at the time they create the account and through this policy, what we collect and why. Because the child has no email address on Bookswap, we will treat the parent or guardian as the appropriate contact for notices about that child’s information while the child is 15 or under, unless we reasonably should contact the young person another way. A parent should also tell their child, in an age-appropriate way, that an account is being created for them.
• A member rates another member, or writes an optional rating comment. The rating is used to show other members whether someone has been a reliable swap partner. A member can see their own rating summary on their profile.
• A member reports a conversation that involves another person. We may not notify the reported person immediately if doing so would prejudice a fair review or the protection of others. We will take the steps that are reasonable in the circumstances.
• We receive information from a parent about a child’s request (approval, decline, or a parent note).

If you think we hold information about you that we did not collect from you, and you have not been told, please contact us (section 13).

5. Why we collect and use personal information (IPP 1 and IPP 10)

We collect and use personal information to:

• create and activate accounts, and let you sign in;
• let parents and guardians create and manage child accounts, approve or decline children’s requests, reset children’s passwords, and read children’s conversations;
• list, search, and request books, and show public profiles and shelves;
• look up and display book covers;
• operate in-site messaging after a request is accepted;
• arrange nothing more than a place for members to agree postage with each other — we do not take payment for postage and we are not a courier;
• record whether a swap was completed, and collect ratings and feedback;
• review reports, enforce our Terms of Use, and keep the service safe (including for children);
• email you about your account (activation, password reset, request and approval notices, and similar service messages);
• keep audit and security records, including bot checks and limits on failed sign-ins;
• respond to questions and complaints sent to admin@bookswap.co.nz;
• meet our legal obligations, including under the Privacy Act 2020; and
• improve and administer the service, in a way that is compatible with these purposes.

We will not use personal information for a new, unrelated purpose unless we have a lawful basis under IPP 10 (for example, you agree, or the new use is directly related to the original purpose, or another IPP 10 exception applies).

We do not currently sell personal information. We do not currently charge membership fees. If we later send optional marketing emails, we will do so in line with the Unsolicited Electronic Messages Act 2007 (including a way to unsubscribe). Service emails about your account or a swap are not marketing.

6. What other members can see

Other members can generally see:

• your display name, profile photo (if you add one), membership date, and rating summary;
• the books you have listed as available, including title, cover, condition, listing type (Free or Swap), your description of that copy, and (if shown) author or ISBN;
• messages in a conversation you are part of;
• if you are messaging a child, the child’s parent or guardian may also read that conversation.

Other members cannot see your real name, email address, date of birth, password, or the contents of reports you make, except to the extent you choose to put something similar in a public description or a message.

Administrators can see additional information needed to operate and safeguard the service, including real names, emails, reports, and audit records.

7. Children and young people

Bookswap is designed so that children aged 15 and under can take part only with a parent or guardian in charge.

• A parent or guardian must create the child’s account and is responsible for the child’s use of Bookswap.
• Every request a child makes must be approved or declined by the parent or guardian. We email the parent for this purpose.
• A child can message another member only after that approval.
• The parent or guardian can read the child’s conversations and can manage the child’s account (including password resets and disabling the account) from the Family page.

We take particular care with children’s information. We will not require more children’s information than we need, and we will not use a child’s information for marketing to that child.

If you believe a child has an account without a proper parent or guardian relationship, please email admin@bookswap.co.nz.

8. Who we share information with, and storage outside New Zealand (IPP 11 and IPP 12)

We do not sell your information. We disclose it only where that is permitted under IPP 11 — for example, where you have authorised it, it is one of the purposes of collection (or a directly related purpose), it is necessary for the conduct of legal proceedings, we believe it is necessary to prevent or lessen a serious threat to safety, or another IPP 11 exception applies.

Typical recipients are:

• Other members, as described in section 6 (public profile and listing information; messages with your swap partner; ratings).
• Parents or guardians, in relation to their own children’s accounts, requests, and conversations.
• Service providers who process information for us, including:
  • our hosting provider, GoDaddy, which hosts the Bookswap website and database on servers in Phoenix, Arizona, in the United States;
  • Cloudflare, for the Turnstile bot check on some forms. Cloudflare may process that technical information outside New Zealand, including in the United States. See Cloudflare’s own privacy documentation;
  • Open Library / Internet Archive, in the United States, for cover lookups as described in section 3.5;
  • our email delivery arrangements. We send service emails through PHPMailer on the same GoDaddy hosting account, using that account’s own mail service (not a separate third-party email company). Those emails are handled on the same United States (Phoenix, Arizona) hosting as the website and database.
• Professional advisers, or a reviewer we appoint, if needed to handle a legal, privacy, or safety issue.
• The Office of the Privacy Commissioner, Police, or other authorities, if we are required or permitted by law to disclose information, or if we believe on reasonable grounds that disclosure is necessary to prevent or lessen a serious threat, or for similar lawful purposes.

Overseas disclosure (IPP 12). Some of the providers above are outside New Zealand. Before we disclose personal information to an overseas person we must comply with IPP 12. That generally means we must believe on reasonable grounds that the information will be protected in a way that is comparable to the Privacy Act, or that you are informed of the destination (or that it is not practicable to say) and you authorise the disclosure, or that another IPP 12 exception applies.

By creating an account or otherwise using Bookswap after being given this policy, you are informed that your personal information may be stored or processed in New Zealand and in other countries where our hosting, security, and cover-lookup providers operate, including the United States (and, for our hosting and email, specifically Phoenix, Arizona), and you authorise that disclosure for the purposes in this policy.

We will not disclose more than is needed for the relevant purpose.

9. Storage, security, and retention (IPP 5 and IPP 9)

We take reasonable steps to protect personal information from loss, unauthorised access, use, modification, or disclosure. Current measures include encrypted connections (HTTPS), hashed passwords, email verification for adult accounts, session cookies that are marked secure and HttpOnly, CSRF protections on forms, security headers, bot checks on some forms, and access limited to administrators who need it.

No online service is completely secure. Please choose a strong password and keep it confidential. Parents should keep children’s usernames and passwords under their control.

We keep personal information only for as long as we need it for the purposes in this policy, or as required or permitted by law (IPP 9):

• While your account is open, we keep the information needed to run it (including listings, messages, requests, ratings, and swap history).
• When an account is closed, or you ask us to delete your information, we delete personal data within 30 days, unless we need to keep a particular record longer for a safety investigation, a dispute, or a legal obligation.
• Login-attempt records and audit records are kept for 30 days, or longer if a record is needed for a security or legal matter.
• Backup copies last only until the relevant backup cycle expires.
• Tokens for activation, password reset, and email change last until they expire or are used, and then only as residual security or audit records if needed.

You can ask us to close your account and delete your personal information, subject to the exceptions above. If you are a parent, you can also ask us to close a child account you manage.

10. Access and correction (IPP 6 and IPP 7)

You have the right to ask us whether we hold personal information about you, to access it, and to ask us to correct it if it is wrong. We will also take reasonable steps ourselves to keep information accurate, up to date, complete, relevant, and not misleading for the purposes we use it (IPP 8).

You can correct many details yourself by signing in (and, for a child, a parent can do this from the Family page). For anything else, email admin@bookswap.co.nz with the subject line “Privacy request”. We may need to verify that we are dealing with the right person. A parent or guardian may make a request on behalf of their child aged 15 or under.

We will respond as soon as reasonably practicable, and no later than 20 working days, as required by the Privacy Act 2020. If we refuse a request, we will tell you why (unless we are not allowed to), and how you can complain.

11. Cookies and similar technology

Bookswap uses a session cookie named bookswap_sid so that we can keep you signed in and protect forms. It is a necessary cookie for the service to work. We also use Cloudflare Turnstile on some forms, which may set or read cookies or similar data as described by Cloudflare.

12. Notifiable privacy breaches

A privacy breach includes unauthorised or accidental access, disclosure, alteration, loss, or destruction of personal information, or a situation where we cannot access it (for example because of a ransomware attack).

If a breach has caused, or is likely to cause, serious harm, it is a notifiable privacy breach. In that case we must:

• notify the Privacy Commissioner as soon as practicable after we become aware of it (the Office of the Privacy Commissioner expects this promptly, and uses 72 hours as a practical guide, even if our investigation is still underway); and
• notify the affected people as soon as practicable, unless a legal exception applies.

If you think there has been a privacy breach involving Bookswap, please email us immediately at admin@bookswap.co.nz.

13. Questions, the Privacy Officer, and complaints

Please contact our Privacy Officer first, by email: admin@bookswap.co.nz. The Privacy Officer is the BookSwap Team.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner:

• Website: https://www.privacy.org.nz
• Online enquiry and complaint forms are available on that site.

14. Changes to this policy

We may update this policy from time to time, including if we add features (for example a region field on listings) or change providers. The updated policy will be posted on the Bookswap website with a new effective date. If a change is material, we will take reasonable steps to let members know (for example by a notice on the site or an email to adult members).

15. How this policy maps to the 13 IPPs

This table is a plain-language aid. It does not replace the Privacy Act 2020.

Questions? Email us at admin@bookswap.co.nz.