Privacy Policy

ShelfKeepr is operated by Cog Code ("we", "us"), a UK business, and is the data controller for the personal data described here. Contact: [email protected].

This policy explains what we collect when you use ShelfKeepr, why, who we share it with, how long we keep it, and the rights you have under UK GDPR and the Data Protection Act 2018.

What we collect

Account data. When you create an account we store your email address and, if you sign in with Google, Discord or Microsoft, the stable account identifier that provider gives us plus the display name and avatar it shares. If you sign up with a password we store a salted hash of it — never the password itself. We also record whether your email address has been verified.

What you track. The books you add to your hunt list or shelf, the price ceilings and conditions you set, the collections you create, and any listings you dismiss. This is the product — without it there is nothing to show you.

Verification codes. One-time codes and links sent to confirm your email or reset your password. They are stored hashed and expire within an hour at most.

Technical data. Your IP address is used in memory to rate-limit sign-in and sign-up attempts; it is not written to our database. Standard server logs may include IP address, user agent and the pages requested, and are retained for a short period for security and debugging.

Analytics. We run a self-hosted, first-party Umami instance. It sets no cookies, does not fingerprint you, and reports aggregate page views and clicks only. It is not shared with any third-party analytics vendor.

Cookies. We use one encrypted session cookie to keep you signed in, one to remember your light/dark preference, and one to remember which dashboard tab you were on. There are no advertising or tracking cookies.

Why we process it

• To run the service (contract): store your account, your hunt list and shelf, search marketplaces for matches, and show you the results.
• To notify you (contract / legitimate interest): email you when a listing matches a book you are hunting, and send account emails such as verification codes and password resets. You can stop hunting a book at any time, which stops its notifications.
• To keep the service secure (legitimate interest): rate limiting, abuse prevention, and error logging.
• To improve the product (legitimate interest): aggregate, cookieless analytics.

We do not sell your data, and we do not use it for advertising.

Who we share it with

• Sign-in providers — Google, Discord and Microsoft, only when you choose to sign in with them. They tell us who you are; we tell them nothing about your use of ShelfKeepr.
• Marketplaces — we query eBay's public Browse API for listings that match the books you track. Your account details are never sent to eBay; only the book title, ISBN and search terms are. Links to eBay listings may carry an eBay Partner Network affiliate tag, from which we may earn a commission at no cost to you.
• Email delivery — transactional email is sent through Cog Code's own email service using Amazon Simple Email Service (AWS, EU region). Your email address and the message content pass through it for delivery.
• Hosting and network — Railway (application and database hosting) and Cloudflare (DNS, CDN and DDoS protection). Data may transit outside the UK under standard contractual clauses or the UK's adequacy regulations.

We do not share your data with anyone else except where the law requires it.

How long we keep it

Your account and everything in it is kept for as long as your account exists. Verification codes and reset links are deleted once used or expired. If you ask us to delete your account we remove your account row and everything linked to it (hunt list, shelf, collections, dismissed listings) within 30 days; server logs age out on their own schedule.

Your rights

You can ask us to access, correct, export or delete the personal data we hold about you, to restrict or object to its processing, and to withdraw consent where processing relies on it. Email [email protected] and we will respond within one month. You also have the right to complain to the Information Commissioner's Office.

Children

ShelfKeepr is not aimed at children and you must be at least 16 to create an account. If you believe a child has created an account, contact us and we will delete it.

Changes

We will post any changes here and update the date at the top. If a change materially affects how we use your data we will email account holders first.