Privacy Policy

Shelf is operated personally by Ajmal Aand.

Shelf is a bookstore and reader. You can browse books and read approved samples without an account.

Reader account information

We keep your email address, optional display name, sign-in method, email-verification time and account timestamps. For authentication we store a password hash when you use a password, hashed Google or Apple sign-in identifiers when linked, an encrypted Apple refresh token when supplied for authorization revocation, and hashed, expiring sign-in and email-action tokens. We never store plaintext passwords or Google ID tokens. Google profile photos, contacts, date of birth, address and phone number are not collected.

Email/password and, when enabled and configured, Google or Apple sign-in are available. Apple sign-in is currently disabled. Google processes its own sign-in interaction under its privacy policy. Shelf checks Google identity tokens on the server. The app stores its Shelf sign-in token in protected device storage. Signing out revokes the account's active Shelf sign-in tokens.

If you choose an account photo, Shelf stores it privately for your account; replacing or removing it removes the previous stored photo. It is not a public profile.

Email and service operation

We send verification, password-reset, sign-in confirmation and deletion-confirmation emails through our hosting provider from noreply@shelf.services. Hosting infrastructure may process request metadata, such as IP addresses, times and diagnostic logs, to deliver and protect the service. These are not reader profile fields. We do not use advertising SDKs or sell personal data. We do not maintain a reading-progress history profile or use your book requests for advertising. RevenueCat processes purchase information and purchase analytics as explained below.

Searches and service requests

Catalogue searches and filters are sent to Shelf to return matching books. Requests also identify the book, content or media you ask to access. Hosting infrastructure may retain request URLs (including search queries and book/filter identifiers), IP addresses, request times and diagnostic errors to operate and protect the service. Shelf does not save a separate search-history profile. Reader settings and locally saved reading state are not uploaded as a reading-history profile.

Books and purchases

Books, author credits, covers and available audio are managed by the owner. Creating an account does not unlock books. Real checkout is currently disabled. Google Play and Apple App Store purchase support is used only for separately authorized owner testing through RevenueCat; Apple sandbox checkout is currently disabled. The applicable store processes payment details. RevenueCat processes your Shelf reader identifier and purchase information for purchase verification, restoration and purchase analytics. Shelf keeps per-book transaction, sale and refund records; Shelf does not collect payment-card details. Access is confirmed by the server for your specific reader account. A refunded or revoked download is removed at the next successful check; offline access requires a successful check at least every 30 days.

Deletion and retention

You can request deletion in Shelf's Account screen or on our account-deletion page. Confirm the email link to remove your reader profile, credentials, sessions and book access. Owner administration is separate. We retain only necessary purchase, refund, accounting and recovery evidence, without your profile name or email.

Our approved policy is to retain accounting and tax-supporting records for three years after the relevant tax return is actually filed, and longer for affected records required by applicable law, unresolved disputes or unpaid author balances.

Only the minimum purchase proof needed for continuing purchased-book recovery rights is to remain after financial detail can be safely removed. Automatic financial expiry is not implemented: existing financial and recovery records currently remain retained. The 90-day log and backup periods do not apply to financial history.

A new account does not automatically receive deleted-account purchases. Contact support for owner-assisted recovery: we verify the claimant and original store transaction; matching emails alone is insufficient. Refunded or revoked purchases cannot be recovered. Support-assisted recovery after account deletion is currently implemented for verified Google Play purchases only; Apple deleted-account purchase recovery is not yet available.

Routine security logs are kept for 90 days. Documented incidents may require reviewed exceptions. Local backups retain 14 copies; encrypted OneDrive backups normally expire after 90 days. The last verified recoverable set is protected when expiry would remove it, and that exception is reported. Pre-policy logs are conservatively dated when archived. Protected minimal deletion records cover retained backups, independently of the restored database. Deletions must be reapplied before reopening a recovered service; recovery stops if those records are unavailable.

RevenueCat account metadata removal is queued for retry and checked through provider read-back; a queued request is not proof that removal has completed. Necessary pseudonymous purchase/refund evidence remains for refunds and approved recovery. Provider failures or immutable metadata require review; we do not delete purchase history to conceal an unresolved exception. Google Play and Apple retain their own store records under their policies; Shelf does not promise to erase store orders. Your device token and account downloads are removed when Shelf next checks the deleted account. Offline access cannot be remotely removed while a device is disconnected; the existing 30-day server-verification limit still applies.

Security and contact

We use HTTPS, password hashing, limited authentication attempts, expiring email links and restricted administration. Contact editor@hindara.com for privacy or deletion help, including if you no longer control your account email.