Introduction
MShelf (“we”, “us”) respects your privacy. This policy explains what personal data we process, why, and the choices you have. It is written to be readable; it is not legal advice.
What data we collect
Depending on how you use MShelf, we may process:
- Email — for account creation, email verification, sign-in, account security, and essential service communications.
- Google sign-in — if you continue with Google, Google sends us your email address and a stable Google account identifier. We store those so we can create or recognize your MShelf account. We do not request your Google profile name or photo, we do not receive or store your Google password, and we do not use Google sign-in to read Gmail, Drive, Photos, or other Google products. We do not request or receive your date of birth from Google.
- Account data — such as your display name, profile details, and settings you choose to save.
- Age confirmation time — when you confirmed that you are at least 16. We do not collect your date of birth.
- User-generated content — collection items, photos, posts, comments, Collector Comments, replies, reactions, and other content you upload or publish.
- Notification data — preferences and notification records (such as type, recipient, related actor where applicable, timestamps, and read/unread state) used to provide and manage notifications.
- Browser push subscriptions — if you enable browser notifications, technical details needed to deliver them, such as the push endpoint, cryptographic subscription keys, and limited browser information (for example a user agent).
- Security and abuse-prevention data — such as IP addresses, request metadata, authentication or security events, rate-limit information, abuse-detection signals, and related logs needed to operate and protect the service.
Age requirement
MShelf is intended for users aged 16 and older. We ask you to confirm that you meet this minimum age when you create an account, including with Google, and if an existing account has not yet recorded that confirmation. We store only the time of the confirmation. We do not collect your date of birth and we do not verify your age through Google or any other third party.
How we use data
- To sign you in — including creating an account with Google, linking Google to an existing MShelf account when the emails match and that email is already verified, and keeping you signed in with a session cookie.
- To provide and operate the service — hosting your collection, profiles, notifications, and community features you use.
- To provide and manage notifications — including in-app notifications and, if you enable them, browser push notifications, according to your preferences.
- To protect accounts and the service — for example preventing spam and automated abuse, enforcing rate limits, detecting suspicious activity, investigating security incidents, and maintaining reliability.
- To improve the product — for example understanding usage patterns, fixing bugs, and developing features (using aggregated or minimized data where possible).
Notifications
MShelf may process notification preferences and notification records so we can show you relevant activity (for example mentions, replies, and reactions) and respect the channels you choose. This may include notification type, recipient, related actor where applicable, timestamps, and read/unread state.
Browser push notifications
If you enable browser push notifications, we process the technical push subscription information required to deliver them (such as the push endpoint, cryptographic subscription keys, and limited browser information like a user agent). We use this solely to provide browser push notifications and related functionality. You can turn browser notifications off in MShelf notification preferences and/or in your browser or device settings. We do not receive or store unrelated contents of your browser or device.
Security and abuse prevention
We may process technical and security information — including IP addresses, request metadata, authentication and security events, rate-limit information, abuse-detection signals, and operational logs — to prevent spam and automated abuse, enforce rate limits, detect suspicious activity, protect accounts and the service, investigate incidents, and keep MShelf reliable. We do not use this for extensive behavioral profiling.
Google user data
We use Google only as a sign-in provider (OAuth). We request only the email scope needed for that sign-in. We do not sell Google user data, do not use it for advertising, and do not share it with other apps or for independent purposes. Processors we already use to run MShelf (for example email delivery or file storage) may handle the same account data we store after you sign in. Google’s own processing of your Google account is described in Google’s privacy policy. Deleting your MShelf account removes the stored Google account link.
Data retention
We retain your data for as long as your account is active or as needed to provide the service. If you request account deletion from your profile settings, you are signed out and your account is scheduled for removal; an administrator completes deletion. When deletion is completed, we delete your personal account data and content you created (such as posts, comments, and collection items), except where retention is required by law or reasonably necessary for security, dispute resolution, or service integrity. We do not anonymize and keep your owned content after deletion — that content is removed with the account.
Cookies and sessions
We use essential cookies or similar technologies required to operate the service (for example authentication and session management).
International data transfers
Your data may be processed in countries outside your country of residence. We take appropriate safeguards to protect your data in such cases.
Storage and third parties
We store data using industry-standard safeguards. Some processing is done by trusted service providers: Google (sign-in), email delivery, and file storage. They process data only on our instructions and for the purposes described here, except Google’s own handling of your Google account.
Your rights
Where applicable (including under the GDPR), you may have the right to:
- Access — request a copy of or information about the personal data we hold about you.
- Deletion — request deletion of your account and associated personal data, subject to legal exceptions.
- Other rights — such as correction, restriction, or portability, depending on your location and the situation.
You can request account deletion from your profile or account settings when that option is available. After you submit a request, you are signed out and cannot sign in until an administrator completes removal (or cancels the request). For other requests, contact us using the details on the Contact page.
Contact
Questions about this policy or your data? See our Contact page.