Privacy Policy

1. Who we are; scope; interim notice

Shelf (“myshelflib”, “we”, “us”) provides a personal study library and related tools. Privacy contact: hello@shelf.study.

This Privacy Policy (“Policy”) explains how we collect, use, store, share, and protect personal data when you use our websites, apps, APIs, and related services (the “Service”). It is a thorough interim notice intended to cover product reality and common Indian (DPDP Act 2023 / DPDP Rules), GDPR/UK GDPR, and CCPA/CPRA topics until a lawyer customizes it for your entity. It is not legal advice.

It applies to personal data we process as a Data Fiduciary / controller for consumer accounts. If we process data solely on a school or company’s documented instructions under a separate DPA, that DPA may allocate roles differently.

Related documents: Terms of Service (/legal/terms), Copyright (/legal/copyright).

2. Personal data we collect

We collect data you provide, data generated by your use, data from integrations you enable, and limited data from your device/browser.

• Account & profile: name, email, password hash (email signup), Google ID / Telegram ID & username, avatar URL or uploaded image, role, study goal, plan/subscription flags, coin/affiliate balance, link codes for Telegram, timestamps.
• Authentication events: OTP send/verify for register and password reset; login method; session/JWT usage (token stored in your browser).
• Library & study materials: folders/collections, topics, pages; file bytes in object storage (PDF, imports, notebooks, Docs); titles/slugs; highlights, notes, pen strokes; stars; reading progress and last-read positions (synced and local); citations; share settings and tokens.
• Derived processing: HTML conversions, OCR text, embeddings/vector chunks for search and Tutor, processing status.
• Planner: tasks/events, notes, due dates, recurrence, completion state, optional links.
• Tutor: thread titles, messages, attachments, library/relevancy scope, tool-call traces needed to run tools, token/quota counters, model-mode selections.
• Quizzes: configuration, questions, answers (including uploaded working images), scores, timers, practice vs proctored flags, end reasons (e.g. tab/fullscreen/timer).
• Sharing: invitee emails, roles (viewer/editor), link-share tokens, “shared with me” relationships.
• Telegram: linkage status; files you forward to the bot; outbound share metadata when you send from Shelf.
• Payments: processor (e.g. Razorpay) identifiers, order/subscription status, plan period, coupons/affiliates—generally not full card PAN/CVV (handled by the processor).
• Communications: contact-form and support emails; transactional email logs (delivery metadata).
• Technical & security: IP address, user-agent, device/browser type, approximate location from IP, request logs, error/diagnostic traces, rate-limit signals, abuse signals.
• Analytics (if enabled): product-analytics identifiers and event properties (e.g. PostHog-compatible tools) such as feature usage, referrers, and coarse device info.
• Local device storage: localStorage (token, theme, reader workspace, greetings, Spotify recent URLs, etc.) and IndexedDB caches (e.g. PDF byte cache). Controlled by your browser; may remain after server deletion until you clear site data.

3. Sources of data

• Directly from you (forms, uploads, chats, settings).
• Automatically from devices/browsers when you use the Service.
• From identity providers (Google, Telegram) when you choose those sign-in methods.
• From payment processors for billing status.
• From people who share library items with your email, if you accept/use them.
• From public Learn ingestion pipelines for catalog materials (not your private library).

4. Purposes of processing

• Create and secure accounts; authenticate; recover passwords; prevent fraud and abuse.
• Provide library storage, reading, sync, search, indexing, OCR, and processing pipelines.
• Operate Tutor, quizzes, planner, sharing, and integrations you enable.
• Personalize UX (study goal, continue reading, greetings, suggestions).
• Bill Premium plans, apply coupons/affiliates, and send invoices/receipts via processors.
• Send transactional messages (OTP, security, service changes). Marketing only with consent or as otherwise permitted, with opt-out where required.
• Monitor reliability, debug, improve features, and produce aggregated/de-identified statistics.
• Comply with law, enforce Terms, handle takedown/legal requests, and protect rights and safety.

5. Legal bases (GDPR/UK and similar)

Where GDPR/UK GDPR or similar regimes apply, we rely on: (a) contract performance—to provide the Service you request; (b) legitimate interests—security, fraud prevention, product improvement, network integrity (balanced against your rights); (c) consent—where required (e.g. certain non-essential cookies, optional marketing, certain sensitive processing); (d) legal obligation—tax, accounting, lawful requests.

Under India’s DPDP Act, we process personal data for specified purposes with consent or other lawful grounds recognized by that Act (such as employment is generally N/A here; legitimate uses specified in law). You may withdraw consent where processing is consent-based, without affecting prior lawful processing.

6. AI processing notice

When you use AI Features, prompts, selected text, retrieved library snippets, images, and related metadata are processed by us and by model/tool providers to generate responses and run tools (including optional web search/URL fetch). Do not submit data you are not allowed to share with such processors.

Providers may process data in other countries. We configure vendors under their enterprise/API terms where available; training-on-your-data policies vary by vendor and plan—assume prompts may be logged by vendors for abuse monitoring unless a zero-retention contract is in place. Ask us if you need current vendor details for a diligence questionnaire.

AI outputs can be inaccurate. See Terms for disclaimers.

7. Sharing; categories of recipients

We do not sell your personal information for money. We do not share it for cross-context behavioral advertising as a business model. We disclose data to:

• Infrastructure: cloud hosting, Postgres, object storage (e.g. S3/R2/MinIO), CDNs, email delivery, vector databases.
• AI and tooling providers used for Tutor, OCR-adjacent pipelines, quiz vision grading, and similar.
• Auth/social: Google, Telegram when you use those features.
• Payments: Razorpay or successors for checkout and subscriptions.
• Analytics/error monitoring if enabled in the environment.
• Professional advisors (legal, accounting) under confidentiality.
• Authorities when required by law or to protect vital interests, security, or our legal rights.
• A buyer or successor in a merger, acquisition, financing, or sale of assets, subject to continuity of protections.
• Other users you explicitly share with (invitees or anyone who has your link token).

8. International transfers

Your data may be processed in India and in other countries where our processors operate (commonly including the US, EU, or other regions for AI/cloud). Where required, we use appropriate safeguards such as contractual clauses, vendor DPAs, and transfer assessments. Cross-border transfers remain subject to Indian DPDP rules and any government restrictions as they come into force.

9. Retention

We retain personal data only as long as needed for the purposes above. When you delete content in-product, associated vectors and derivatives are removed as jobs complete; residual copies may briefly remain in backups.

• Account and library data: for the life of the account, then deletion/anonymization within a reasonable operational window after account deletion (often days to weeks for primary stores; backups longer).
• Security and server logs: typically shorter rolling windows unless needed for investigations.
• Payment/tax records: as required by financial law.
• Legal holds: longer if needed for disputes or lawful requests.
• Local device caches: until you clear them or uninstall/clear site data.

10. Security measures

We implement reasonable technical and organizational measures appropriate to risk, which may include TLS/HTTPS in transit, access controls, hashed passwords, least-privilege admin access, isolation of customer objects in storage keys, and monitoring. No method is perfectly secure. You must use strong unique passwords, protect your devices, and log out on shared computers.

If we become aware of a personal data breach affecting you, we will take steps required by applicable law, which may include notifying the Data Protection Board of India / regulators and affected users without undue delay (commonly discussed as within about 72 hours for certain regimes where mandated), describing nature, likely impact, and measures taken—subject to law-enforcement delays.

11. Cookies, local storage, PWA, analytics

Essential storage: authentication tokens, CSRF-adjacent state if any, theme, reader workspace, feature flags needed for core UX. These are necessary for the Service.

Functional: preferences such as study-goal UI state, recent Spotify URLs, offline queues.

Analytics cookies/identifiers: used only if analytics is configured, to understand feature usage and improve the product.

You can block cookies in browser settings; blocking essentials may break login. Clearing site data removes local PDF caches and offline drafts. Progressive Web App installs may keep caches until removed.

We do not currently respond to browser “Do Not Track” signals in a special way beyond the controls in this Policy.

12. Children and teens

The Service is not directed to children under 13 (or a higher age required for digital consent where you live). We do not knowingly collect personal data from children below that age. Under Indian DPDP rules, processing children’s data may require verifiable parental consent and restrict tracking/ads—Shelf is not designed as a child-directed product.

Users 13–17 should have guardian permission per our Terms. If you believe a child provided data without required consent, contact us and we will delete or restrict as required.

13. Your rights (overview)

Depending on your location, you may have some or all of the following rights regarding personal data we hold about you. To exercise rights, email the contact below from your account email (or verify identity another way we reasonably request). We may ask for information to confirm identity and will respond within timelines required by law (often about 30 days under GDPR; DPDP Rules may set specific grievance timelines). In-product controls include: edit profile, delete pages, revoke shares, unlink Telegram, cancel Premium, and delete account from Profile.

• Access / know what we process and obtain a copy.
• Correction / completion of inaccurate or incomplete data.
• Deletion / erasure (subject to legal retention exceptions).
• Portability / export of data you provided, where applicable.
• Restriction or objection to certain processing (including legitimate-interests balancing).
• Withdraw consent where processing is consent-based.
• Appeal or lodge a complaint with a supervisory authority / Data Protection Board.
• Nominate (where DPDP allows) another person to exercise rights on your behalf in case of death or incapacity—contact us for process when available.

14. India — DPDP Act rights & grievance

If you are in India, you are a Data Principal under the Digital Personal Data Protection Act, 2023. You may request access, correction, erasure, and withdrawal of consent for consent-based processing, and you may nominate as the Act allows.

Grievance / Data protection contact: hello@shelf.study. Please include “Privacy grievance” in the subject, your account email, and a clear description. We will acknowledge and work to resolve within applicable timelines. If unresolved, you may approach the Data Protection Board of India as that mechanism becomes available for your complaint type.

Consent for account creation is collected via an unchecked checkbox linking to these Terms and this Policy. You can stop using the Service and delete your account to end most processing.

15. European Economic Area / UK

If GDPR/UK GDPR applies, our legal bases are described above. You may contact your local data protection authority. Where we rely on legitimate interests, you may object. Where we use processors, they are bound by Article 28-style contracts where required. International transfers use appropriate safeguards.

We do not generally make solely automated decisions that produce legal or similarly significant effects about you without human involvement; AI study tools are assistive and user-directed.

16. California and other US state laws

If you are a California resident, the CCPA/CPRA may grant rights to know, access, correct, delete, and to be free from discrimination for exercising privacy rights. We do not sell personal information or share it for cross-context behavioral advertising as those terms are commonly defined in our consumer Service. Sensitive personal information (if any) is used only for permitted purposes such as providing the Service you request.

You may submit requests via the contact email. We will verify and respond as required. Authorized agents may submit requests with proof of authority. Other US state privacy laws (Virginia, Colorado, etc.) may provide similar rights—contact us and we will handle in line with applicable law.

Global Privacy Control (GPC): if we deploy sale/share opt-out signals in future advertising contexts, we will describe them here; today our consumer Service is not ad-tech oriented.

17. Sensitive and special-category data

Please avoid uploading government IDs, biometric templates, health records, precise financial account numbers, or special-category data unless necessary and lawful. If you do, you acknowledge the risk and instruct us to process it only to store/display it as part of your library or AI request. We do not require such data for basic use.

18. Third-party sites and embeds

Learn links, YouTube/Spotify embeds, payment pages, and OAuth screens are operated by third parties with their own policies. We are not responsible for their practices. Review their privacy notices before authenticating or uploading there.

19. Soft proctoring and exam integrity signals

In proctored quiz mode we may record client-side events such as leaving fullscreen or switching tabs to auto-submit and label an end reason. We do not currently capture webcam video, microphone audio, or continuous screen recording for proctoring. Institutions should not treat Shelf soft proctoring as certified remote invigilation.

20. Automated processing and profiling

We may use limited profiling for product personalization (e.g. continue-reading, study-goal UX, quota enforcement, abuse detection). This is not credit scoring or employment screening.

21. Changes to this Policy

We may update this Policy and will revise the “Last updated” date. Material changes may also be notified by email or in-product banner. Continued use after the effective date acknowledges the updated Policy. If you disagree, delete your account and stop using the Service.

22. Contact

Privacy, DPDP grievances, and data-subject requests: hello@shelf.study.

Security issues: hello@shelf.study with subject “Security”.

Postal address and company legal name will be added when finalized by counsel / business registration details—until then email is the primary channel.