Privacy

Operator and contact

Sourceflow LLC operates Shelf. For support, privacy questions, or account-deletion requests, contact support@shelfapp.cc.

Information Shelf processes

• Account profile data, including a display name, email address, optional phone number, internal user ID, and linked Apple or Google authentication-provider identifiers.
• Saved URLs, supported public-page content, text shared from pages you can access in Safari or a paired browser extension, user-imported readable PDFs and DRM-free EPUB books, notes, and highlights associated with an account.
• A generated inbound newsletter address is associated with the account. When Cloudflare Email Routing sends a raw RFC 822 message through the configured Email Worker and authenticated Convex route, its sender, subject, message identifier, and cleaned content become an account-scoped newsletter article.
• When membership is configured, the native purchase and restore flow uses Adapty and Apple App Store/StoreKit. Convex stores provider profile and access-level identifiers, membership status, product and store values, and purchase and verification timestamps. Referral codes and reward state are also account data.
• Account and reading-library data stored and synchronized through Convex when the authenticated service is configured.
• With explicit remote-audio consent, article text is sent through the authenticated Convex service to Shelf's self-hosted Pocket TTS service for speech generation. This includes uncached playback and background audio preparation. Inference runs on Shelf's server rather than a Kyutai-hosted speech API. Generated audio can be cached on the device. Consent can be withdrawn in Settings to stop new synthesis; cached audio can still play.
• Import data supplied by the user and exports generated from that user's library.

Authentication and account deletion

Shelf supports existing password accounts and Apple or Google authentication. Provider assertions identify an account; matching email addresses do not merge accounts.

The app provides account deletion. The current deletion path removes the account and account-scoped articles, including browser-extension captures and newsletter articles, highlights, extension credentials and pairing codes, text-to-speech admission windows, commerce membership records, owned referral records and the deleted account's redemption links, verification codes, sessions, refresh tokens, and verifiers. When Shelf holds an Apple revocation token, it revokes the grant before finalization. If that token is missing, deletion can still complete and Shelf explains how to remove its access in Apple account settings. It keeps an opaque completion receipt so a client can finish local cleanup. A surviving referral counterparty keeps its earned ledger entry without the deleted account's redemption link. Some email and phone verification rate-limit records are intentionally retained because the current path cannot associate them with an account. The deletion path does not erase provider-side Adapty, Apple/App Store, Cloudflare Email Routing/Workers, or Convex records outside this account path; retention for those records, the receipt, backups, logs, and any text-to-speech upstream is not stated here.

Content boundary

Shelf extracts supported public pages, captures text already available in a page you choose to share, and imports supported documents you provide. It does not obtain publisher credentials or bypass publisher authentication, access controls, or document encryption. Scanned PDFs without extractable text are unsupported. This page makes no no-tracking claim because that posture has not been independently verified for release.