Privacy Policy

We collect only what the service needs to work: your account details, the content you choose to share and a few technical logs. We do not sell your data and we do not show advertising. This policy follows Québec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's PIPEDA.

Account data: email address, password (stored hashed, never readable by us), full name, username, profile photo, bio, favourite genres, reading pace and yearly goal.

Activity data: the books on your shelves, your reviews, ratings, posts, comments, likes, follows, club memberships, events and messages.

Preferences: language, day or night mode and notification settings.

Technical data: IP address, browser type and timestamps in server logs, kept for security and debugging for at most 30 days.

To run your account and show your shelf, reviews and clubs to the people you share them with.

To send you the emails you asked for: account confirmation, password reset and, if you enabled them, notifications.

To keep the service safe: preventing abuse, spam and unauthorised access.

We do not use your data to build advertising profiles and we do not make automated decisions that have a legal effect on you.

Your profile, shelves, reviews and public posts are visible to every signed-in member. Club posts are visible to the club's members. Direct and group messages are visible only to their participants. Your email address is never shown to other members.

Your data is hosted by Supabase (database, authentication and file storage) and the application runs on Vercel. Transactional email is sent through Resend. Book information is fetched from Open Library. These providers process data on our behalf under their own privacy and security commitments; some of their servers are outside Québec and Canada, which means your data may be subject to the laws of those countries.

We keep your data for as long as your account exists. When you delete your account we erase your profile and personal data within 30 days. Backups are overwritten within 90 days. Messages you sent remain visible to the other participants, without your name.

You can see and change most of your data from Settings. You can also ask us to give you a copy of your personal data, correct it, delete it or stop using it for a given purpose. You can withdraw your consent at any time; some features will then stop working.

To exercise these rights, or to complain about how we handle your data, write to the person in charge of personal information at privacy@noshelfcontrol.ca. We answer within 30 days. You can also file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

We use only cookies that the service needs: your session (so you stay signed in), your language and your theme choice. There are no tracking or advertising cookies, so there is no cookie banner.

Data travels over HTTPS, passwords are hashed and database access is restricted by row-level rules. If a confidentiality incident creates a risk of serious injury to you, we will notify you and the Commission d'accès à l'information as the law requires.

We will post any change to this policy here and update the date above. For material changes we will ask you to accept the new version when you next sign in.