Introduction
MShelf (“we”, “us”) respects your privacy. This policy explains what personal data we process, why, and the choices you have. It is written to be readable; it is not legal advice.
What data we collect
Depending on how you use MShelf, we may process:
- Email — for account creation, sign-in, security notices, and essential service messages.
- Google sign-in — if you continue with Google, Google sends us your email address and a stable Google account identifier. We store those so we can create or recognize your MShelf account. We do not request your Google profile name or photo, we do not receive or store your Google password, and we do not use Google sign-in to read Gmail, Drive, Photos, or other Google products.
- Account data — such as your display name, profile details, and settings you choose to save.
- User-generated content — items, photos, posts, comments, and other content you upload or publish.
How we use data
- To sign you in — including creating an account with Google, linking Google to an existing MShelf account when the emails match and that email is already verified, and keeping you signed in with a session cookie.
- To provide and operate the service — hosting your collection, profiles, and community features you use.
- To improve the product — for example understanding usage patterns, fixing bugs, and developing features (using aggregated or minimized data where possible).
Google user data
We use Google only as a sign-in provider (OAuth). We request only the email scope needed for that sign-in. We do not sell Google user data, do not use it for advertising, and do not share it with other apps or for independent purposes. Processors we already use to run MShelf (for example email delivery or file storage) may handle the same account data we store after you sign in. Google’s own processing of your Google account is described in Google’s privacy policy. Deleting your MShelf account removes the stored Google account link.
Data retention
We retain your data for as long as your account is active or as needed to provide the service. When you delete your account, we delete your personal data within a reasonable period, except where retention is required by law.
Cookies and sessions
We use essential cookies or similar technologies required to operate the service (for example authentication and session management).
International data transfers
Your data may be processed in countries outside your country of residence. We take appropriate safeguards to protect your data in such cases.
Storage and third parties
We store data using industry-standard safeguards. Some processing is done by trusted service providers: Google (sign-in), email delivery, and file storage. They process data only on our instructions and for the purposes described here, except Google’s own handling of your Google account.
Your rights
Where applicable (including under the GDPR), you may have the right to:
- Access — request a copy of or information about the personal data we hold about you.
- Deletion — request deletion of your account and associated personal data, subject to legal exceptions.
- Other rights — such as correction, restriction, or portability, depending on your location and the situation.
You can delete your account from your profile or account settings when that option is available. For other requests, contact us using the details on the Contact page.
Contact
Questions about this policy or your data? See our Contact page.