Privacy Policy

ShelfLife is operated by Fisherbird LLC ("Fisherbird", "we", "us", or "our"). This Privacy Policy explains what personal information we collect when you use ShelfLife (the "Service") — through our iOS app, Android app, web app, or marketing website — how we use it, who we share it with, how long we keep it, and the rights you have over it.

By using the Service you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Service.

1. Who we are and how to reach us

The data controller for personal information processed through the Service is Fisherbird LLC. You can reach our privacy team at admins@theshelflifeapp.com.

We have not appointed a statutory Data Protection Officer because we are not required to under GDPR Article 37, but the privacy mailbox above is monitored and we respond to rights requests within the timelines described in Section 9.

2. Information we collect

We collect personal information in three ways: you give it to us, it is generated by your use of the Service, and a small amount is generated automatically when your device connects to our servers.

For California residents, this Section together with Section 3 ("How we use personal information") and Section 5 ("Disclosure of personal information") constitutes our Notice at Collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

2.1 Information you provide

• Account information — email address, password (stored only as a hash managed by Amazon Cognito; we never see the plaintext), display name, and chosen handle.
• Profile information — optional avatar, bio, and pronouns.
• Reading data — the books you add to shelves, your ratings, written reviews, reading status, dates started and finished, and the books you pin to your Top 12.
• Spine images — photos you upload of book spines so the Service can render them on the shelf canvas. These are processed to extract a silhouette, palette, and (where permitted) a stylized render.
• Library import files — if you import a library from another service (for example a Goodreads, StoryGraph, or LibraryThing CSV export), we keep the file you uploaded for a short time, not only the books we read out of it. The file is stored privately; it is what we read your ratings, dates, and reviews from when you confirm the import, and it lets us investigate if you report a problem with the import. It is deleted automatically about ten days after upload, and immediately if you delete your account. See Section 7.
• Social graph — the accounts you follow and the accounts that follow you.
• Support correspondence — messages you send us by email and any attachments you choose to include.
• Waitlist submissions — if you join the waitlist on our marketing site, your email address, any optional survey responses, and — only if you tick the optional box — your consent to receive occasional marketing emails from Fisherbird LLC about our other products. This consent is separate from the invitation email the waitlist itself sends you, and you can withdraw it at any time using the unsubscribe link in those emails or by emailing us.
• Newsletter opt-in — if you tick the optional newsletter box at sign-up (or during onboarding), we record that choice — your email address, the answer, and when and where you gave it — so we can send you the occasional ShelfLife newsletter. The box is never pre-ticked, saying no changes nothing about your account, and you can withdraw at any time using the unsubscribe link in any newsletter or by emailing us.

2.2 Information generated by your use of the Service

• Activity events — when you add a book, change reading status, finish a book, post a review, update your Top 12, or create a shelf, we record an activity event. These events are used to build your home feed and the home feeds of accounts that follow you.
• Aggregate review statistics — per-book averages and rating distributions are derived from individual reviews.

2.3 Information collected automatically

• Operational metadata — IP address and basic request metadata (user-agent, timestamp, route) are processed transiently by our hosting providers for rate-limiting, abuse prevention, and to deliver the response. We do not retain raw access logs containing IP addresses for longer than 14 days.
• Local storage on your device — we store an authentication token (Amazon Cognito refresh token) in your device's secure storage (iOS Keychain, Android Keystore, or the browser's localStorage) so that you stay signed in. We do not use third-party advertising cookies or cross-site tracking pixels.
• Account platform history — when you use the Service while signed in, your requests identify the ShelfLife platform making the request: iOS, Android, or web. We keep the set of platforms observed on your account so we can operate and support the Service. We do not use this record to identify a physical device, and it does not include a device identifier, model, manufacturer, device name, or operating-system version. This account-linked record is separate from the random per-install mobile usage events described below.
• Crash and error diagnostics — when the app hits an unexpected error or crash, a diagnostic report is sent to our error-monitoring provider so we can fix it. It contains the error message and stack trace, the app version, your device or browser type and operating-system version, and the screen or route where the error happened. We configure this provider not to collect your IP address and do not attach your account identity to these reports. See the Sentry entry in Section 5.1.
• App usage events. In our mobile and web apps we record which features are used (for example, completing an import, scanning a spine, or tapping a tip card) together with device type, operating system version, and app version. We never record what you are reading, what you write, or what you search for — no book titles, no review or comment text, no search terms.

While you are signed in, these events are linked to your account through an identifier we derive from your account by a one-way calculation. We can reverse that link from our side — and we must be able to, so that deleting your account also deletes this data — but our analytics provider holds only the derived identifier and cannot connect it to you, your name, or your email. Signed out, the events carry only a random identifier.

You can turn this off at any time under Privacy → Share usage data in the app. See Section 9 for your right to object.

• Marketing-site usage events — marketing site only. This bullet applies only to our public marketing website (theshelflifeapp.com) and nothing else. On the marketing site we record the page visited, referring site, campaign source, medium, and campaign name, scroll milestones, and selected calls to action and outbound links. We also use PostHog's session replay, heatmap, and autocapture features there: session replay creates a visual, screen-recording-style playback of a visit (mouse movement, clicks, scrolling); heatmaps aggregate click and mouse-movement locations across visitors; and autocapture records clicks and page interactions we have not individually coded an event for. Text typed into form fields is masked before it leaves your browser and is never included in a replay or autocapture event. Because these features need real browser storage to work, we ask for your consent first if you're visiting from the EU/EEA, the UK, or Switzerland — see "Opt-in consent banner" in Section 11. Everywhere else, this analytics runs by default, using PostHog's privacy-preserving server-side visitor identifier rather than the sale/advertising identifiers used by ad-tech cookies. If you decline (or opt out) where a banner is shown, we still count your visit using a cookieless, storage-free method, without session replay, heatmaps, or autocapture.

Our iOS app, Android app, and web app never do any of this. Session replay, heatmaps, and autocapture are used on the marketing website only. The mobile and web app usage events described above remain deliberate, individually-coded events — no screen recordings, no click heatmaps, and no automatic capture of interactions we haven't explicitly chosen to track.

Our web app (the signed-in product at app.theshelflifeapp.com) still writes nothing to cookies or browser storage for analytics: the identifier described above is derived from your sign-in session each time, not stored in your browser. The only thing we save there is your own choice if you turn usage data off, so that we can keep honoring it.

We do not knowingly collect precise geolocation data, contacts, or microphone audio. We do not collect biometric data; see Section 2.4 below for the specific way biometric unlock works on your device.

2.4 Biometric authentication

ShelfLife offers an optional biometric-unlock feature on devices that have Face ID, Touch ID, fingerprint, or another on-device biometric method enrolled with the operating system. You can turn this on or off at any time from Account in the app; it is off by default.

When the feature is enabled, biometric verification is performed entirely by your device's operating system — Apple's Local Authentication framework on iOS, and the Android BiometricPrompt API on Android. We receive only a yes/no result from the operating system, indicating whether verification succeeded.

We do not collect, receive, transmit, or store any biometric identifier or biometric information about you. Specifically, we do not have access to any fingerprint scan, facial geometry, voiceprint, retina or iris scan, hand-geometry scan, or any other unique biological pattern or characteristic. No biometric template ever leaves your device. Nothing biometric is transmitted to our servers, to Amazon Web Services, or to any third party.

The only thing the app stores in connection with this feature is a boolean preference, kept in your device's secure storage, that records whether you opted in. Disabling the feature deletes that preference; deleting the app removes it along with everything else the app stored locally.

Because no biometric identifier or biometric information ever reaches us, we do not engage in conduct regulated by the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act, the Washington Biometric Privacy Act, or the biometric provisions of comprehensive state privacy laws — all biometric handling occurs in your device's secure enclave under the operating system's policies, not ours.

3. How we use personal information

We use personal information to:

• Operate, maintain, and improve the Service, including rendering your shelves, delivering your home feed, and showing profiles of accounts you follow.
• Understand aggregate feature use, marketing traffic, and download conversion so we can improve the Service and its public website.
• Authenticate you and keep your account secure.
• Operate and support the Service across iOS, Android, and web, including understanding which ShelfLife platforms an account has used.
• Detect, investigate, and prevent fraudulent, abusive, or unlawful activity, and enforce our Terms of Service.
• Send transactional communications such as account verification, password reset, security alerts, policy updates, and confirmations of actions you took (for example, account deletion).
• Send the ShelfLife newsletter to readers who opted in (consent, which you can withdraw at any time);
• Respond to your support requests, rights requests, and other correspondence.
• Comply with our legal obligations, including responding to lawful requests by public authorities and preserving evidence where required.

We do not use your personal information to serve third-party advertising, to build cross-site advertising profiles, or to sell it to data brokers.

4. Legal bases for processing (UK and EEA users)

If you are in the United Kingdom, the European Economic Area, or Switzerland, we rely on the following legal bases under the UK GDPR and EU GDPR:

• Performance of a contract (Article 6(1)(b)) — to provide the core Service to you under our Terms of Service. We cannot operate your account without processing the data described in Section 2.1 and Section 2.2.
• Legitimate interests (Article 6(1)(f)) — to keep the Service secure, prevent abuse, debug operational problems, and protect our rights. Where we rely on legitimate interests, we have weighed those against your privacy interests; you can object at any time (see Section 9).
• Consent (Article 6(1)(a)) — where required by law for cookies and similar technologies that are not strictly necessary, and for any optional marketing communications. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Legal obligation (Article 6(1)(c)) — when we must process data to comply with a legal requirement, such as responding to a valid court order.

We do not engage in solely automated decision-making with legal or similarly significant effects on you (Article 22).

5. Disclosure of personal information

We disclose personal information only in the following circumstances:

5.1 Service providers (sub-processors)

We use a small number of vendors to operate the Service. They process personal information on our behalf under written agreements that bind them to confidentiality and security obligations.

• Amazon Web Services, Inc. — application hosting, database (DynamoDB), object storage (S3), authentication (Cognito), email delivery (Simple Email Service), and serverless compute (Lambda). Processing region: us-east-2 (Ohio, United States).
• 650 Industries, Inc. (d/b/a Expo) — push-notification delivery. When we send you a notification (such as a Book Signal response or a new follower), we pass a device push token and the notification's contents to Expo's push service, which relays it to Apple (APNs) or Google (FCM).
• Cloudflare, Inc. — Cloudflare Turnstile, an anti-bot challenge used on our waitlist form, and Cloudflare Web Analytics, a cookie-less pageview/referrer analytics tool on our marketing site.
• Functional Software, Inc. (d/b/a Sentry) — application error and crash monitoring for our web and mobile apps. When the app encounters an error, a diagnostic report (error message, stack trace, app version, device/browser type, and the URL of the screen where it happened) is sent to Sentry so we can fix it. We configure Sentry not to collect your IP address and do not attach your account identity to these reports.
• PostHog EU B.V. (d/b/a PostHog) — product analytics for our mobile and web apps, and usage analytics, session replay, heatmaps, and autocapture for our marketing site only (theshelflifeapp.com — not the iOS app, Android app, or web app), hosted in the European Union. App feature-usage events never include replay, heatmaps, or autocapture. While you are signed in they are labelled with an identifier derived from your account by a one-way calculation, which PostHog cannot connect back to you; signed out, a random identifier is used. Marketing-site visitors from the EU/EEA, UK, or Switzerland are asked for consent before any cookie-based tracking or replay/heatmap/autocapture runs; everyone else gets it by default, tied to PostHog's privacy-preserving identifier rather than an advertising identifier; anyone who declines is still counted using a cookieless, storage-free method. We never send your name, email address, account identity, book titles, review or comment text, search terms, waitlist survey responses, or the contents of form fields, and we do not use this data for advertising.
• Open Library / Internet Archive — public book metadata lookups. We send a book identifier (such as an OLID or ISBN). We do not send any data that identifies you to Open Library.

We will publish an up-to-date list of material sub-processors at theshelflifeapp.com/subprocessors before any general public launch and will give at least 30 days' notice of changes that materially affect the categories of data processed.

5.2 Publicly visible content

Some information you provide is, by design, visible to others:

• Your handle, display name, avatar, and bio are visible to anyone who views your profile.
• Reviews you post are publicly visible alongside the book.
• Shelves you create are visible to followers and, depending on your privacy setting, may be visible to other signed-in users.
• Spine photos you upload may appear in the community spine pool for the same book, where other users can choose them for their own shelves.

5.3 Legal disclosures

We may disclose personal information if we believe in good faith that disclosure is necessary to (a) comply with a subpoena, court order, or other valid legal process; (b) protect the safety of any person; (c) investigate, prevent, or respond to suspected fraud, security, or technical issues; or (d) enforce our Terms of Service.

5.4 Business transfers

If Fisherbird is acquired, merges with another entity, or sells substantially all of its assets, your information may be transferred as part of the transaction. We will notify you (by email and an in-app notice) before your information becomes subject to a different privacy policy.

We do not sell personal information for monetary or other valuable consideration, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act.

6. International data transfers

We are based in the United States and our servers are located in the United States (AWS us-east-2). If you access the Service from outside the United States, your personal information will be transferred to, stored, and processed in the United States. The sub-processors listed in Section 5.1 (including our error-monitoring provider, Sentry) are likewise located in the United States, with the exception of PostHog EU B.V., which stores and processes its analytics data in the European Union.

For transfers from the United Kingdom, the European Economic Area, or Switzerland to the United States, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and, for transfers from the UK, the UK International Data Transfer Addendum to those clauses. Where required, we conduct transfer impact assessments and apply supplementary safeguards (encryption in transit and at rest, restricted access, no government data-sharing programs that we are aware of). You can request a copy of the relevant safeguards by emailing the privacy contact in Section 1.

7. Retention

We keep personal information only for as long as we need it for the purposes described in this Policy or as required by law.

• Account and reading data — kept until you delete your account.
• Spine images and stylized renders — private cropped images and their stylized renders are kept until you delete your account or we remove them. Non-private cropped images submitted for community review and their stylized renders may remain after account deletion, without a connection to your account. Temporary uploads in the tmp/ prefix that were never finalised are deleted seven days after upload.
• Library import files you uploaded — kept for about ten days after upload so your import can be completed and, if you report a problem with it, investigated against the file you actually sent; then deleted automatically, or sooner if you delete your account. The books imported from the file remain in your library as ordinary reading data and are kept until you delete your account.
• Per-follower home-feed inbox copies — 90 days (the source-of-truth activity log on the actor is retained until the actor deletes their account).
• Database point-in-time recovery backups — 35 days on a rolling basis.
• Access logs containing IP addresses — no more than 14 days.
• Crash and error diagnostic reports — retained by our error-monitoring provider for up to 90 days, then automatically deleted.
• App usage events — retained by our analytics provider for the standard retention period of our plan with them, and in any case no longer than we keep your account. When you delete your account, the events linked to it and the derived identifier described in Section 2.3 are deleted as part of the deletion process. If you turn off Share usage data, no further events are recorded from that device or browser.
• Support correspondence — up to two years from the date of the last message, then deleted.
• Waitlist submissions — until you ask us to remove them, or for two years from submission if the public launch has not occurred by then.
• Publicly posted reviews and non-private community image submissions on a deleted account — the user identifier is replaced with deleted_user and uploader lookup keys are removed so the content is no longer linked to your account. The content itself may remain available to preserve public book discussions and the shared community spine library.

If you would prefer that public reviews you posted be deleted rather than pseudonymized, you can ask us by emailing the privacy contact and we will honor the request within the timelines in Section 9.

8. Security

We protect personal information with technical and organizational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.2 or higher) for all traffic between your device and our servers, and between our servers and our service providers.
• Encryption at rest for the database and object storage.
• Strict access controls. Only a small number of administrators have production access, gated by multi-factor authentication.
• Separation of password hashing (Cognito) from application logic.
• Continuous monitoring, automated patching of dependencies, and a dependency-scanning pipeline in continuous integration.

No service can guarantee perfect security. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in line with Articles 33 and 34 of the GDPR.

9. Your rights

Subject to applicable law, you have the following rights over the personal information we hold about you.

9.1 Rights available to everyone

• Access — request a copy of the personal information we hold about you.
• Rectification — correct inaccurate information. Most fields are editable directly in the app (profile, reviews, reading data).
• Erasure — delete your account and the personal information associated with it. You can start the process in the app at Account → Data → Delete account. Some information may be retained in backups for up to 35 days, in access logs for up to 14 days, and as pseudonymized public content as described in Section 7.
• Portability — receive a copy of your reading data in a structured, machine-readable format. An in-app export feature is in development; in the meantime, email the privacy contact and we will provide an export within 30 days.
• Objection — object to processing based on our legitimate interests. For usage analytics you can exercise this yourself at any time, without asking us: turn off Privacy → Share usage data in the app. That setting applies to the device or browser you set it on, so set it on each one you use, or email the privacy contact and we will apply it for your whole account.
• Restriction — ask us to restrict processing while we consider an objection or rectification request.
• Withdraw consent — where we rely on consent, withdraw it at any time.

9.2 California residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights above and the additional right to know the categories of personal information we collect, the categories of sources, the business purposes for which we collect or share it, and the categories of third parties with which we share it (all described in this Policy).

We do not sell personal information and we do not share personal information for cross-context behavioral advertising. Because we do not sell or share in that sense, we are not required to offer a "Do Not Sell or Share My Personal Information" link, and we have no financial incentive program to offer.

Sensitive personal information. The only category of "sensitive personal information" as defined by Cal. Civ. Code § 1798.140(ae) that we collect is your account log-in credentials (your email address together with your hashed password). We use this category only for the purposes that the CCPA exempts from the right to limit — namely, performing the services you reasonably expect, verifying or maintaining the quality or safety of the Service, and detecting, preventing, or responding to security incidents (Cal. Civ. Code § 1798.121(a) and the corresponding regulations). We do not use sensitive personal information to infer characteristics about you. Because we use it solely for those exempt purposes, the right to limit the use of sensitive personal information does not apply.

You may exercise your rights by emailing the privacy contact in Section 1. You may use an authorized agent to make a request; we will verify the agent's authority and your identity before responding. We will not discriminate against you for exercising your rights.

9.3 Other jurisdictions

If you live in Colorado, Connecticut, Utah, Virginia, Texas, Oregon, Montana, or another US state with a comprehensive privacy law, you have substantially the same rights described above, exercised in the same way.

If you live in Canada, Australia, New Zealand, the United Kingdom, the European Economic Area, or Switzerland, the rights described in Section 9.1 apply to you under the law of your jurisdiction.

9.4 How to exercise your rights, and our timelines

Email admins@theshelflifeapp.com. We will respond within 30 days for GDPR/UK GDPR requests and within 45 days for CCPA requests, with one extension where the request is complex. We may need to verify your identity before acting.

9.5 Right to complain

If you believe we have not handled your personal information properly, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with your local data protection supervisory authority — for example, the UK Information Commissioner's Office or your country's national data protection authority in the EEA.

10. Children

ShelfLife is not directed at children under 13, and we do not knowingly collect personal information from children under 13 — within the meaning of the US Children's Online Privacy Protection Act or otherwise. Where local law sets a higher minimum age for using the Service (see Section 1 of our Terms of Service), we do not knowingly collect personal information from children under that higher age. If you become aware that a child below an applicable minimum age has provided personal information to us, please contact the privacy address and we will delete the information promptly.

11. Cookies and similar technologies

The web app uses localStorage to store an authentication token and a small number of UI preferences, and a session-scoped CSRF token cookie where required. These are strictly necessary to operate the Service and do not require consent under the EU ePrivacy Directive. The marketing site uses Cloudflare Turnstile, which sets a short-lived first-party cookie strictly necessary to perform the anti-bot challenge.

Our web app does not use analytics, advertising, or social-media-tracking cookies. It does use PostHog for product analytics (see Section 2.3), but that integration sets no cookies and writes nothing to localStorage or sessionStorage. While you are signed in, the identifier it uses is recalculated from your sign-in session on each visit rather than saved in your browser; signed out, it is a random identifier held in memory for a single page-load. This does mean that while you are signed in we can recognize you as the same reader across visits and devices, which we use to count how many people come back. That is why no consent banner appears in the web app: with no analytics storage on your device, the EU/UK/Swiss ePrivacy consent requirement described below does not apply.

The one exception is your own choice: if you turn off Share usage data, we save that preference in localStorage so we can keep honoring it. Storing a preference you have expressly asked us to remember is strictly necessary to provide what you requested, and needs no consent.

The marketing site uses Cloudflare Web Analytics, which operates without analytics cookies or cross-site tracking, and PostHog to measure pageviews, referral sources, on-page actions, session replay, heatmaps, and autocapture (see Section 2.3). Unlike Cloudflare Web Analytics, our marketing-site PostHog integration does use analytics cookies and browser storage for visitors who see it run by default or who explicitly accept it via the banner described below; visitors who decline, and visitors we never ask, are counted with a cookieless method that sets no cookies and uses no localStorage or sessionStorage. Our mobile app uses PostHog for product analytics only — no cookies, no session replay, no heatmaps. Usage events there are associated with an identifier derived from your account while signed in, or a random per-install identifier otherwise; never with your name or email address, and never used for advertising or shared for cross-app tracking.

Opt-in consent banner (marketing site)

Because session replay and heatmaps rely on browser storage, we show a consent banner on the marketing site to visitors we detect (by browser time zone, a heuristic — not precise geolocation) as likely being in the EU/EEA, the UK, or Switzerland. If you accept, we run marketing analytics with cookies as described in Section 2.3. If you decline, or before you answer, we fall back to the cookieless method described above: no cookies, no session replay, no heatmaps, no autocapture — only an anonymous visit count. Visitors elsewhere are not shown this banner and get the cookie-based experience by default, consistent with US privacy law, which (unlike the EU/UK/Swiss ePrivacy rules) does not require opt-in consent for this kind of analytics cookie.

Opt-out preference signals (Global Privacy Control)

A growing number of US state privacy laws require businesses to honor universal opt-out preference signals — most commonly the Global Privacy Control (GPC) browser signal — as a valid request to opt out of the sale or sharing of personal information for cross-context behavioral advertising. Because we do not sell personal information and do not share personal information for cross-context behavioral advertising in the first place, a GPC signal does not change how we process your data. If we ever begin practices that would qualify as "sale" or "sharing" under those laws, we will treat a GPC signal from your browser as a valid opt-out without requiring any further action from you, and we will update this Policy first.

We do not respond to legacy "Do Not Track" signals because there is no industry consensus on what they require, but our practices already meet the common intent: we do not engage in cross-site tracking.

12. Third-party links

The Service may contain links to third-party websites (for example, Open Library pages for books). We are not responsible for the privacy practices of those websites. We encourage you to read their privacy notices before providing them with any personal information.

13. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will:

• Update the Effective date at the top of this document;
• Increment the version identifier; and
• Notify you by email and in-app notice at least 30 days before the changes take effect.

Continued use of the Service after the new effective date constitutes acceptance of the updated Policy. If you do not agree, you may delete your account before the new date.

14. Contact

For any question, request, or concern about this Policy or our handling of personal information, contact:

admins@theshelflifeapp.com