Privacy policy

Last updated: 8 August 2026

Rotten Publishers is a review platform where authors write about their experiences with book publishers. This page explains what we collect, why, and what you can ask us to do about it.

What we collect

When you create an account

• Your name and email address. The email address is how we identify your account and how we contact you about your reviews.
• A password, if you sign up with one. We store a bcrypt hash, never the password itself. We cannot read it or recover it for you.
• Google profile data, if you sign in with Google: your name, email address, and profile picture. We request only theopenid, email, and profile scopes. We do not request access to your Gmail, Drive, contacts, or anything else in your Google account.
• Optional profile details you choose to add: a pen name, a short biography, and a website.

When you write a review

• The content of your review, your ratings, the year of your experience, and what your relationship with the publisher was.
• Every version of the review. When you edit one, we keep the previous text. This is deliberate: a publisher who has replied in public to what you wrote is entitled to have the record show what they were replying to.

When you claim a publisher listing

• Your work email address, job title, and any evidence link you supply. A moderator reads these to decide whether to approve the claim.

Anonymous reviews — read this part

You can post a review without your name appearing on it. If you do, your identity is hidden from the public, but not from us. The review record still contains your account, and our moderators can see it.

We will disclose that identity if we are legally required to — for example under a valid court order in a defamation claim brought by the publisher you wrote about. We cannot promise otherwise, and any site that promises otherwise is either misleading you or has not thought about it.

If that risk is unacceptable for your situation, please do not post the review. That is a genuine recommendation, not a disclaimer.

How we use your data

• To operate your account and keep you signed in.
• To publish your reviews, along with whatever name you chose to publish them under.
• To email you about things that happen to your content: your review being published or rejected, a publisher responding to it, a decision on a listing claim, and password resets. These are transactional messages, not marketing.
• To moderate content and investigate reports and disputes.

We do not sell your data. We do not run advertising, we do not share your data with data brokers, and we do not build advertising profiles.

Legal basis (UK and EU users)

• Contract — running your account and publishing the content you submit.
• Legitimate interests — moderating content, preventing fraudulent reviews and fake listing claims, and keeping an audit trail of moderation decisions so those decisions can be defended or reversed.
• Legal obligation — responding to lawful requests and court orders.

Who we share it with

We use a small number of processors, each doing one job:

• Google Cloud Platform — hosting and database storage (us-central1, United States).
• SendGrid (Twilio) — sending the transactional emails described above. They receive your email address and the message content.
• Google — only if you choose to sign in with Google, and only to authenticate you.

Our servers are in the United States. If you are in the UK or EU, your data is transferred there under the relevant standard contractual clauses offered by those providers.

Cookies

We set a session cookie when you sign in, and a short-lived cookie during the sign-in process itself to protect against cross-site request forgery. That is all. They are strictly necessary to operate the site, which is why you are not asked to consent to them.

We do not use analytics or tracking cookies, and we do not embed third-party trackers. Links inside our emails are not rewritten for click tracking.

How long we keep things

• Account data — until you delete your account.
• Published reviews — indefinitely, because they are the point of the site. See below for what happens when you delete your account.
• Password reset and email verification tokens — stored hashed, deleted as soon as they are used, and expiring in 60 minutes and 48 hours respectively.
• Moderation records — kept after the content itself is removed. If we take a review down, we need to be able to show why.

Your rights

You can ask us to:

• Give you a copy of the data we hold about you.
• Correct anything inaccurate.
• Delete your account.
• Object to how we are using your data.

One honest limitation on deletion. If you delete your account, we remove your profile and detach your name from your reviews. We may keep the review text itself where a publisher has already responded to it in public, or where it is subject to an active dispute — deleting one half of a public exchange leaves a misleading record. Tell us if you want the content gone too, and we will weigh that against those interests and explain our decision.

Email privacy@rottenpublishers.com to make a request. If you are in the UK you may also complain to the Information Commissioner’s Office; in the EU, to your national data protection authority.

Children

This site is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If we change this policy in a way that materially affects you, we will email registered users rather than quietly updating the date at the top.

Contact

privacy@rottenpublishers.com. See also the review policy and the dispute process.