Privacy Policy

[YOUR LEGAL NAME OR COMPANY NAME] ("Shelved", "we", "us"), [YOUR BUSINESS ADDRESS], is the data controller for the information described below. Contact: vincible.ae@gmail.com.

We only collect data needed to operate the service:

• Account data: email address, username, display name, and a securely hashed password (we never store your password in plain text).
• Profile data you choose to add: bio, profile picture, country, and language.
• Reading activity: the books/manga/comics you log, ratings, reviews, lists, likes, comments, and follows — this is the core purpose of the service and is visible to other users unless you set your account to private in Settings.
• Payment data: if you subscribe to Pro, Stripe processes your card details directly — we never see or store them. We keep a Stripe customer/subscription reference ID so we know your account is Pro.
• Technical data: IP address, used transiently for rate-limiting login/signup attempts to prevent abuse. This is held in server memory only, is never written to a database, and is discarded automatically after a short time window.
• Local device storage: your theme and accent colour preference, and whether you've dismissed the community guidelines banner, are saved in your browser's local storage — not sent to our servers. See our Cookie Policy for details.
• Session cookie: a secure, encrypted cookie that keeps you signed in. Strictly necessary — the site cannot function without it.

We do not collect: your physical address, phone number, government ID, or precise location.

• We do not run advertising or analytics/tracking scripts, and we do not use third-party ad networks or tracking pixels.
• We do not sell your personal data.
• We do not build advertising profiles from your activity.

• Stripe — payment processing for Pro subscriptions. Stripe has its own privacy policy governing the card data it holds directly.
• Open Library, AniList, MyAnimeList (Jikan), Google Books — public book/manga catalogue and cover-art APIs. We send only the search terms needed to find a title (e.g. its title or ISBN) — never your personal data.
• GNews (optional, only if the site operator has configured it) — supplies the News & New Releases feed. No personal data is sent; it's a one-way content fetch.

We process account and activity data to perform our contract with you (running the service you signed up for) and, for rate-limiting, our legitimate interest in preventing abuse. We keep your data for as long as your account is active. If you delete your account, your profile, reviews, and activity are permanently removed, except where we are legally required to retain payment records.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can update most of your data yourself in Settings. For anything else — including account deletion — contact vincible.ae@gmail.com. We'll respond within a reasonable time and, in any case, within any timeframe required by applicable law.

Shelved is not directed at children under 13, and we do not knowingly collect data from them.

Passwords are hashed with bcrypt and never stored in plain text. Access to production data is restricted. No system is perfectly secure, but we take reasonable technical measures to protect your information.

We may update this Privacy Policy occasionally. Material changes will be reflected in the "Last updated" date above.

Questions or requests about your data: vincible.ae@gmail.com — [YOUR BUSINESS ADDRESS].