Goodreads

Is Goodreads safe?

For most readers, yes, as long as you treat it as a public social network rather than a private diary. Goodreads has no known breach and few risks for a casual user. The catch is visibility. Your shelves, ratings and reviews are public by default, and Amazon, which owns Goodreads, can link what you do there to its own data about you. We score it 60/100, below Amazon's own Kindle app (67), which has no social features.

The other weak spot is the community. Goodreads has more than 150 million members, according to its App Store listing, and the same openness that makes it useful has made it a tool for pile-ons against authors.

What Goodreads shares with Amazon

Goodreads LLC is a subsidiary of Amazon.com, and its privacy notice says so in the second sentence. The data it collects falls under the Amazon Privacy Notice, with Goodreads' own notice, last updated on 27 June 2023, added on top. One line matters most: if you have an Amazon account, information Goodreads gathers "may be correlated with any personal information that Amazon.com has" and used by both companies.

Apple's label shows how much is collected. There is no "Data Used to Track You" section, so Goodreads tells Apple it does not follow you across other companies' apps. But ten categories of data are linked to you, including purchases, contacts, search history, photos and "sensitive info". Name, email, user and device IDs, product interaction, advertising data and that sensitive info are all listed under "Developer's Advertising or Marketing". Google Play adds that device IDs are shared with other companies for advertising, approximate location is collected for analytics, and sexual orientation is an optional field.

Linking Goodreads to Kindle deepens the overlap. Once the accounts are joined, Kindle books land on your Goodreads shelves, and your notes, highlights and reading-challenge progress sync between the two.

Account security: no bounty, no two-step login

We found no breach of Goodreads in Have I Been Pwned or in news reports. The protection around your account is thinner than at Amazon's other apps, though. Amazon's paid bug bounty on HackerOne covers the Kindle apps but not Goodreads, and the HackerOne page under the Goodreads name is an unclaimed directory entry, not a programme.

If you sign in with an email address, Goodreads has no two-step option. Its help centre says it emails a verification code only when someone tries to sign in from an unexpected IP address, and an alert when a new device or location signs in. If you sign in with Amazon, Apple or Google instead, that account's two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary covers Goodreads too, which is the simplest fix.

Review bombing and fake books

Goodreads' biggest safety problem is aimed at authors rather than readers. In June 2023 The New York Times reported how coordinated one-star campaigns could sink a book before publication. In November 2023 Goodreads announced steps against "review bombing", which PEN America welcomed as a response to its own recommendations. The current rating guidelines say Goodreads may hide ratings from people who have not read the book, remove harassing reviews and "temporarily limit the ability to submit ratings and reviews" when it detects unusual activity on a book.

Impostor books are another issue. In August 2023 author Jane Friedman found junk titles, most likely written by AI, listed under her name on Amazon and Goodreads. Ars Technica reported that Goodreads removed them from her author profile hours after her blog post about them went live. Removal depends on volunteer librarians, so check the publisher before you trust an unfamiliar title by a known name.

For readers, the main exposure is private messages and groups. The community guidelines ban harassment, spam and fake accounts, and you can report content, but strangers can still message you.

Regulators

We found no privacy or consumer fine or order that names Goodreads, and no regulator review of the app itself. Amazon's large US cases, including the 2025 Prime settlement, concern Prime, Alexa and Ring. Under our rules, that gives Goodreads the 85 we give apps no regulator has looked at, the same as Kindle.

How to use Goodreads more safely

1. Sign in with an Amazon, Apple or Google account that has two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary turned on, rather than a bare email and password.
2. In account settings, hide your last name and email address and decide which actions appear in your update feed.
3. Stop non-friends from commenting on your reviews if you write about sensitive or divisive books.
4. Leave the optional profile fields blank; nothing on Goodreads needs your sexual orientation or contacts.
5. Before you delete your account, export your books, because shelves and friends lists are gone for good afterwards.
6. If a book under a known author's name looks odd, check the author's own site before you buy it. Libby is a more private way to track borrowed books.

How we scored it

The regulatory record (85) is Goodreads' strongest factor, with no fine or order naming it. Privacy (48) is the weakest, because a large set of data is linked to you for marketing and can be combined with your Amazon account. Scams and harmful content (58) reflects documented review bombing and fake author listings, and security (62) is held back by the lack of a bug bounty and of two-step login for email accounts.