Privacy Policy

The short version

Backshelf stores the minimum needed to run your account. Nothing is sold, shared or handed to advertisers, and there is no tracking or analytics.

What we collect

• Email address - to identify your account, let you sign in, and send password-reset or verification messages.
• Username - your public name on Backshelf.
• Profile picture - only if you upload one. You can remove it at any time.
• Password - never stored as text. It is hashed with bcrypt, so nobody, including us, can read it.
• Basic account records - the date you joined, your account status, and the invite code you signed up with.

We do not use tracking cookies, advertising pixels or analytics. The only thing stored in your browser is the session token that keeps you signed in, plus your interface preferences.

Where your data lives

Everything is kept on a private server operated by us in the European Union. Traffic is encrypted in transit (HTTPS), and daily encrypted-at-rest database backups are retained for two weeks so an account can be restored after a failure.

Backshelf does not use third-party processors for storage or analytics. Email delivery is handled by a mail provider, which necessarily receives the recipient address for messages you trigger, such as a password reset.

Why we are allowed to hold it

Under the GDPR the legal basis is performance of a contract (article 6(1) (b)) - the data is what makes an account work. There is no processing for marketing or profiling, so there is nothing extra to consent to.

How long we keep it

For as long as your account exists. When you delete it, the record and any uploaded picture are removed from the live database immediately, and disappear from backups as those rotate out within 14 days.

Your rights

You can, at any time:

• See and correct your data - your username and picture are editable in account settings.
• Get a copy - ask us and we will send you everything we hold about you.
• Delete your account - do it yourself in Settings, under Security. The account, your shelf, your categories, tags and any uploaded picture are removed immediately. You can still write to us instead if you would rather.
• Complain - if you think we are mishandling your data you can raise it with your national data-protection authority. In Poland that is the President of the Personal Data Protection Office (UODO).

Contact

For anything on this page, including data or deletion requests, write to privacy@backshelf.eu.

Changes

Backshelf is in private beta and still changing. If what we collect changes, this page is updated and the date at the top changes with it.