Privacy policy

1. Who operates Shelfstead

Shelfstead is operated by LDM Co LLC. This policy covers our apps, website, account service, and synchronization service. Shelfstead is currently a pre-release service; features available to testers may differ by platform and version.

2. Account and reading information

We process your account email, profile, authentication identifiers, and session records to provide and protect your account. Apple or Google sign-in supplies an identifier and the information permitted by the sign-in flow. We do not receive your Apple or Google password. Email authentication uses verification and recovery records; passwords are stored as protected hashes, not plain text.

We process library entries, book identifiers, organization, reading sessions, progress, annotations, settings, and other information you choose to save or synchronize. A private library is not made public merely because you create an account or join a circle.

3. Reading circles and sharing

Circle ownership, invitations, membership, shared progress, and messages are used to provide the circles you choose to use. Members can see information shared with their circle. Exports and other sharing actions send information to the destination you select. Recipients can retain independent copies or screenshots.

Circle safety features store your acceptance of the rules and blocked-reader relationships. A report includes the reporter and reported account identifiers, its reason, and the reported message or circle title so authorized operators can review it. Closing a circle does not erase a pending report. Resolving a report removes its captured content; deleting either involved account removes the account-linked report and block records from the active service.

When you delete your account, we remove your membership and account-linked circle information from the active service. Circles you own close rather than delaying your account deletion for an ownership transfer. Copies already retained independently by recipients are outside our control.

4. Technical and support information

Website and API requests involve technical information such as IP address, request time, browser or app details, and the requested resource. We use operational records to deliver the service, investigate failures, and prevent misuse. If you contact us, we receive your message and attachments. Do not send passwords, private notes, or complete library exports unless necessary for your request.

5. Purposes and processing grounds

We use account and reading information to provide the features and synchronization you request. Where a legal basis is required, processing objectively necessary to provide the agreed service relies on performance of our contract with you.

Proportionate security and reliability processing relies on our legitimate interests in operating a secure service, subject to your rights. Support processing relies on our contract where necessary, or our legitimate interest in answering inquiries. We rely on legal obligations where they require particular processing and on consent where the applicable optional processing requires it. You can withdraw consent without affecting earlier lawful processing. A device permission is not blanket consent to unrelated processing.

6. Devices, synchronization, and providers

The apps maintain local information for supported offline features. Account synchronization sends the information needed for that feature to our account service. Supported iOS storage also uses an iCloud Drive mirror when available through your Apple account and device configuration. Local data, iCloud copies, and account-server data are separate stores. New app versions omit unverified catalog descriptions from exports and can pause synchronization when older saved descriptions need review. Reading notes and reviews are retained. Account snapshot files are excluded from new operating-system backups; existing device or cloud backups are not erased by updating the app.

Hosting and infrastructure providers process information to operate the service for us. Cloudflare delivers and protects the website. Zoho handles support email. Brevo delivers account-related email when that delivery service is used. Apple and Google process their sign-in interactions under their own privacy terms; choosing a sign-in provider does not send it your entire library.

Google Sign-In on iOS may process contact information, account and device identifiers, approximate location inferred from an IP address, and usage or other technical data for authentication, fraud prevention, and SDK analytics, as described in its privacy disclosures. This does not give Shelfstead your Google password or send Google your reading notes.

Android scanning and text recognition use Google ML Kit. Recognition images are processed on the device; Shelfstead does not include those image bytes in account snapshots or library exports. The SDK can send device and app information, installation or device identifiers, feature events, error codes, and performance metrics to Google over HTTPS for diagnostics and usage analytics. On-device image processing does not mean that the SDK sends no technical data. See Google’s ML Kit data disclosure and Google’s iOS sign-in disclosure.

7. Catalog searches

New catalog searches use Open Library bibliographic metadata. Search terms, book identifiers, and normal connection information reach Open Library when results are requested. Supported app versions display Open Library covers on demand, sending the cover identifier and normal connection information to its image service. These versions do not keep a persistent downloaded-cover cache. The app makes no new Google Books content requests. Opening an external book-source link contacts that provider. Their privacy notices govern their independent handling of these requests. Do not put private notes into a public catalog search field.

8. Free service and affiliate book links

Shelfstead is free to use. We do not sell your reading history. Where an eligible book-shopping link is available, choosing it opens an independent retailer’s website or app. The link may identify the book and contain an affiliate identifier, allowing us to receive a commission on a qualifying purchase.

The retailer or affiliate network may process your visit and purchase under its own privacy notice. We disclose affiliate relationships near the links. Purchases are optional; the retailer handles the sale, payment, delivery, returns, and refunds.

9. Retention and deletion

Active account and reading data are kept while needed to provide your account and the features you use. You can request deletion at [email protected]. We verify ownership and obtain your confirmation, then remove active account data promptly without a recovery window. Circles you own close with your account.

Our retention policy for ordinary support messages and attachments is 12 months after resolution. Specific information needed for an applicable legal obligation or active legal claim may be retained longer, restricted to that purpose.

Security and operational records are retained according to the need to investigate failures or abuse, protect the service, and meet applicable legal requirements. Backup copies are separate from the active database and are removed through backup replacement and expiration procedures; active-account deletion does not mean every backup copy is erased immediately. Contact us for information about records retained in connection with your request.

Copies in your own device or cloud account, exports, and independent recipient copies require separate handling. Account deletion does not delete books purchased from retailers or their order records. Our account-deletion page explains the request process and these limits.

10. Your choices and regional rights

You can review and change supported account information, export supported library data, choose what to share, manage device permissions, and request deletion. Contact [email protected] if you cannot use a control or need help exercising a right.

Depending on applicable law, you may request access, correction, deletion, restriction, or portability; object to processing based on legitimate interests; and withdraw consent where we rely on it. Brazilian users also have applicable rights to confirmation of processing, information about sharing, and anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data.

We verify identity only as reasonably necessary and respond within the applicable legal period. We explain any lawful refusal or extension. You can complain to your EU supervisory authority, the UK Information Commissioner’s Office, Brazil’s ANPD, or another competent authority. Contacting us first is not required where the law allows a direct complaint.

11. International processing

LDM Co LLC is based in the United States. Our providers may process information in other countries where they operate. Contact us for details about recipients, locations, and safeguards applicable to your information. Where a transfer is restricted by applicable law, an appropriate legal transfer mechanism is required; this notice does not replace that requirement. Independent providers describe their own processing and safeguards in their privacy notices.

12. Age eligibility

Shelfstead is intended for people aged 13 or older, subject to higher regional requirements and required parent or guardian involvement. It is not directed to children under 13. Do not use an account or feature if required consent or legal capacity is absent. Contact us if a child has provided information in circumstances requiring its removal.

13. Security and changes

We use access controls, protected credentials, and encrypted transport to safeguard information, but no service can guarantee absolute security. Report suspected unauthorized access to support. We update this notice when practices change and provide additional notice or obtain consent where required. A revised notice does not itself authorize processing that requires consent.

14. Contact

For ordinary help or terms questions, contact [email protected]. For privacy and deletion requests, contact [email protected].

Customer and privacy correspondence: LDM Co LLC, PO Box 83, Manchester, PA 17345, USA. Registered-agent address for legal process: 502 W 7th ST STE 100, Erie, PA 16502, USA. The registered-agent address is not our customer-mail address.

Privacy policy · Terms of service · Account deletion