How BookSway handles accounts and Amazon credentials.

BookSway uses Supabase for authentication and its application database. Users sign in with email and password. Each account has one role: author or creator. That role is stored on the BookSway profile and is not taken from editable browser metadata when authorizing access.

Author library, campaign management, and Amazon connection settings are available to authors. Campaign discovery and joining are available to creators. The product does not give creators access to an author Amazon connection, and it does not give authors a creator private workspace.

Authors can securely connect their Amazon Ads account. Attribution functionality is being developed subject to Amazon API access and supported capabilities.

When an author chooses to connect Amazon Ads, BookSway stores the author's advertising-profile metadata and an encrypted refresh credential so that author can manage the connection inside BookSway. BookSway does not currently retrieve Amazon Attribution reports, and it does not share Amazon credentials with creators or browsers.

Amazon access happens after the author starts Connect from BookSway and completes Amazon authorization. Authors can disconnect the Amazon Ads connection inside BookSway, which makes the stored refresh credential unusable. Disconnect does not by itself prove that Amazon revoked access on the Amazon side.

Refresh credentials are encrypted at rest with AES-256-GCM before storage. Access tokens are short-lived and are not stored as a long-lived database secret. Amazon secrets are not sent to browsers or to creator accounts.

BookSway uses account, book, campaign, membership, and Amazon connection data to operate the BookSway product those records belong to. It does not sell Amazon advertising data. Attribution reporting is not live, so BookSway is not currently processing Amazon Attribution datasets.

Use the contact page for privacy or security inquiries. Describe the issue; do not send passwords or access tokens.

BookSway does not claim SOC 2, ISO, GDPR certification, “bank-level” security, or Amazon approval. Encryption and access controls described here are the current implementation, not a substitute for a third-party audit.