Privacy Policy

1. Introduction

Brana Library (“Brana”, “we”, “us”, or “our”) operates the digital library platform available at brana.yohajoh.tech. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you use our services. By accessing or using Brana, you agree to the practices described in this policy.

2. Data Controller

Brana Library is the data controller for personal information collected through this platform. For privacy-related inquiries, contact us at:

3. Information We Collect

We collect the following categories of personal information:

a) Information you provide directly

• Full name and email address when you register an account.
• Student ID, year of study, department, and phone number for library membership.
• Password (stored in hashed form — never stored in plain text).
• Payment details processed through Chapa payment gateway. We do not store raw card numbers.
• Reviews, wishlist items, and reading preferences you add to the platform.

b) Information collected automatically

• IP address, browser type, operating system, and device information.
• Usage logs including pages visited, features used, and session duration.
• Borrowing history, reservation activity, and fine records.

c) Information from Google Sign-In

If you choose to sign in using Google, we receive your name, email address, and profile picture from Google as part of the authentication flow. We request only the minimum scopes necessary (profile and email). We do not access your Google account beyond what you explicitly authorize.

d) Google Calendar data (optional)

If you optionally connect your Google Calendar from Account Settings, we request the https://www.googleapis.com/auth/calendar.events scope. This allows us to create calendar events on your behalf — specifically, book due date reminders and reservation availability alerts. We:

• Only write events; we never read, modify, or delete your existing calendar events.
• Store only your OAuth refresh token, encrypted, to perform this function.
• Never share your calendar data with third parties.
• You can disconnect Google Calendar at any time from Account Settings, which immediately revokes our access.

Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How We Use Your Information

• To create and manage your library account and authenticate your identity.
• To process book rentals, reservations, and payments.
• To send transactional emails including account confirmation, borrow confirmations, overdue reminders, and reservation notifications.
• To create optional Google Calendar reminders for book due dates and reservation windows (only if you connect Google Calendar).
• To calculate and track late return fines as defined in the system configuration.
• To provide customer support and respond to your requests.
• To improve platform performance, fix bugs, and develop new features.
• To comply with legal obligations and enforce our Terms of Service.

5. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract performance: processing necessary to provide the library services you requested.
• Legitimate interests: operating, securing, and improving the platform.
• Consent: optional features such as Google Calendar integration, where you explicitly authorize access.
• Legal obligation: compliance with applicable laws and regulations.

6. Data Sharing and Disclosure

We do not sell your personal data. We share limited information only in the following circumstances:

• Service providers: third-party providers that help us operate the platform, including Neon (database hosting), Cloudinary (image storage), Resend (email delivery), Chapa (payment processing), and Render (server hosting). Each is bound by confidentiality obligations.
• Google: when you use Google Sign-In or connect Google Calendar, data is exchanged with Google in accordance with their Privacy Policy.
• Legal requirements: if required by law, court order, or to protect the rights, property, or safety of Brana, our users, or the public.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (for example, payment records for financial compliance).

Borrowing history and fine records may be retained for up to 2 years for auditing purposes.

8. Cookies and Local Storage

We use a session cookie named token to maintain your authenticated session. This is a strictly necessary cookie — without it, you cannot remain logged in. We do not use advertising, analytics, or tracking cookies.

We use browser localStorage to save your language preference. No personal data is stored in localStorage.

9. Data Security

We implement industry-standard security measures including:

• HTTPS encryption for all data in transit.
• Bcrypt password hashing — plaintext passwords are never stored.
• JWT-based session authentication with configurable expiry.
• Database access restricted to the application backend only.
• OAuth refresh tokens stored in the database — never transmitted to the frontend.

No system is perfectly secure. In the event of a data breach affecting your rights, we will notify affected users as required by applicable law.

10. Your Rights

Depending on your location, you may have the following rights:

• Access: request a copy of the personal data we hold about you.
• Correction: update inaccurate or incomplete information via Account Settings or by contacting us.
• Deletion: request deletion of your account and associated data.
• Withdrawal of consent: disconnect Google Calendar at any time from Account Settings, which immediately stops our access to your calendar.
• Data portability: request your data in a structured, machine-readable format.

To exercise any of these rights, contact us at privacy@yohajoh.tech. We will respond within 30 days.

11. Children’s Privacy

Brana Library is intended for university students and is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that such data has been collected, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or through the platform.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us: