Legal
Last updated 18 August 2026
Shelfmates is currently in beta. This policy describes, honestly and specifically, what we collect through the app as it exists today, why we collect it, who we share it with, and what happens to it if you delete your account. It isn't filler text and it isn't a placeholder.
Account information. Your email address and password (handled entirely by our authentication provider, Supabase — we never see or store your password ourselves), your display name, handle, bio, profile photo, and any social link you add. This is what lets you sign in and lets other readers recognise you.
Reading activity. Books you mark as read, want-to-read, or favourite, your star ratings, written reviews and comments, your reading goal, and the reading tags you pick (used to personalise recommendations and the groups shown to you). If you import a CSV export from Goodreads or StoryGraph, we read the title, author, ISBN, shelf, rating, review text, and date fields from that file to populate the same data.
Groups and events. Groups you create or join, your membership and join requests, events you host or RSVP to.
Messages and photos. Direct messages and group chat messages you send, including any photos and voice notes you attach. Messages are only visible to the people in that conversation or group.
Connections. Connection requests you send or receive, and their status (pending, accepted, declined), and any users you block.
Payment information, if you subscribe. Shelfmates+ subscriptions are processed entirely by Stripe. We never see or store your card details — we only store whether your subscription is currently active, so we know whether to apply the free-tier connection limit.
Technical and abuse-prevention data. Your IP address is used briefly, in memory or in a short-lived rate-limit counter, to enforce limits on public forms (search, contact, newsletter signup) and is not retained as part of your profile. If the app errors or crashes, our error-monitoring tool (Sentry) may capture the error details, the page you were on, and technical context like your browser and IP address, to help us fix the bug.
Publisher submissions. If you use a publisher account, we store the book details and links you submit for moderation review.
We don't sell your data. We don't use your reading activity or messages for advertising. We don't share your direct messages or group chats with anyone outside that conversation, ever, other than the limited moderation access described below.
Before a profile photo or a group/event cover photo is uploaded, it's run through an automated nudity/explicit-content classifier that runs entirely on your own device, in your browser. The image itself is not sent to a third party for this check; the check either passes (and the photo uploads normally) or fails (and the photo is never uploaded at all). This is a best-effort filter, not a guarantee.
We use a small number of service providers ("subprocessors") to run Shelfmates. Each only receives the data it needs to do its specific job:
We may also disclose information if required by law, or to protect the safety of our users, in line with the moderation and enforcement practices described in our Terms of Use.
Reports you submit about a user, comment, or review are visible to our staff moderation team so they can review and act on them. Publisher submissions are visible to staff for the same reason. Staff access is restricted to accounts we've specifically designated, and is scoped only to what's needed to moderate the platform.
Choosing "Delete account" is real and permanent, not a soft deactivation. It removes your login, your profile, your reviews and comments, your reading activity, your messages, your connections, and your uploaded photos and voice notes from our systems.
There are a small number of deliberate exceptions where we keep shared content that other readers' own data depends on, rather than destroying it out from under them:
Your handle is also freed up for someone else to use once your account is deleted.
You can access and correct most of your own information directly in the app, under Edit profile. You can export a copy of your reading history as a CSV file at any time from the same screen. You can request deletion of your account and data at any time, as described above. If you have questions about your data that aren't answered here, get in touch through our contact page.
Shelfmates is intended for people aged 16 and over. We don't knowingly collect data from children under this age.
Our service providers may process and store data outside your own country, including in the United States and the European Union. Each provider we use maintains its own safeguards for handling data across borders.
Shelfmates is actively being built, so this policy may change as features change. We'll update the date at the top of this page when it does.
Questions about this policy or your data can be sent through our contact page.
