Privacy policy

This policy explains which personal data Nubico processes when providing myShelf, for what purposes and how long, as well as your choices and rights. It covers the app, its associated services and communications you send us about them.

myShelf does not display advertising, sell or rent personal data, or use the advertising identifier to track you across apps or websites.

Data controller

Legal name

Nubico Software Technologies, S.L.

Spanish tax ID (NIF)

B13749221

Registered office

San Antonio Kalea 11, 1º, 20016 Donostia-San Sebastián (Gipuzkoa), Spain

Company registration

Commercial Register of Gipuzkoa, section 8, company sheet SS-45818

Contact

hola@nubico.tech

For data protection enquiries or requests, contact hola@nubico.tech with the subject “myShelf privacy”, or write to the registered office. This policy provides information under the General Data Protection Regulation (GDPR) and applicable Spanish law.

What we process and why

Local library and account backup

Your library, notes, quotes, ratings, sessions, goals, decorations and photographs are stored on your device. Versions that support audio notes also store those recordings. When you sign in, your account backup includes library data, notes — including their audio when that feature is used — sessions and settings. Photos of book covers and spines are not included in this backup.

The purpose is to preserve and restore your library. Processing on our servers is based on performing the service you request (GDPR Article 6(1)(b)). Enabling social mode does not publish your private library: only the data described in the visibility section is shared.

Account and sign-in

You can sign in with Apple, Google or email and password, and link methods to the same account. We process a stable account identifier, linked methods and their identifiers, and linking and usage dates to authenticate you, maintain sessions and associate backups, purchases and social features. The stable identifier may be the one Apple assigns to this app if you created the account with Apple; otherwise, we generate our own.

• Apple: its identifier for myShelf and, where obtained, the token needed to revoke authorisation. The name and email Apple provides are retained on your device, except for information you separately choose to publish in your social profile.
• Google: the account identifier and email address. The name Google provides is retained on your device unless you choose to publish it in your profile.
• Email: your address and a protected representation of your password produced with a salted password derivation function. We do not store readable passwords. Verification and recovery codes are stored as hashes, not readable text.

We send emails needed to verify addresses, recover access, link methods and warn of attempts to use an already registered address. The legal basis is performance of the service and, for preventing unauthorised access and protecting accounts, our legitimate interest in security (Article 6(1)(f)).

Social profile, @handle and relationships

If you choose an @handle, we associate it with your account. If you enable social mode, we process your public name, avatar, handle, shared reading activity and progress, published ratings and reviews, associated dates, follows and audience settings. Uploaded avatar photographs are resized and stripped of camera and location metadata.

This processing provides the community features you request and is based on performance of the service. Follows are relationships within myShelf: we do not import your device’s address book.

Suggestions, comments and support

Feature suggestions and comments include their text, author’s account, handle, dates, status and team replies. Votes are associated with an account to manage totals and prevent duplicates. These features are shared with other users and are provided on the basis of performance of the service.

Private support messages and feedback include your message, any contact details you provide, app version, operating system, language and source screen; when signed in, they also include your account identifier and handle. We use them to respond, resolve issues and improve the service, based on its performance and our legitimate interest in handling enquiries and fixing problems. Your library is not automatically attached.

Blocking, reports and moderation

We process blocks, report reasons and notes, and information needed to review content. A profile report preserves a snapshot of the profile at that time: name, handle, avatar reference, books and reviews. The avatar reference is not a copy of the image file. Reports of suggestions or comments include a snapshot of the reported text.

If we remove a review, we retain the book reference; if we remove an avatar, we retain an image fingerprint. Social suspensions include the reason, date and duration. To prevent account deletion and recreation from bypassing these measures, we use pseudonymous identifiers derived from sign-in methods and, where linked, the relationship between them.

The legal basis is our and our users’ legitimate interest in preventing abuse, maintaining blocks and protecting the community, as well as compliance with legal obligations where applicable (Article 6(1)(c)). Pseudonymisation is not anonymisation: it allows a returning identity to be recognised, and these records remain subject to data protection law.

Usage, diagnostics and searches

• Usage: events about screens and features, a random device identifier, your account identifier if signed in, app version and operating system. These events do not include the text of your notes, reviews or library book titles.
• Diagnostics: error reports and technical information to investigate faults, such as stack trace, screen, version and device model. The diagnostic configuration excludes IP addresses, console logs and screen recordings.
• Searches: the query text or ISBN and a pseudonymous connection fingerprint that changes daily. Search records are not associated with your account identifier.

Searches are processed to return results as part of the service. Usage and diagnostic records are processed in our legitimate interest in understanding technical performance, correcting errors and improving the app. You may object to processing based on legitimate interests as described in the rights section. Transmitting traffic requires connection data; infrastructure providers may participate in this processing.

Purchases and device permissions

We process purchase identifiers, history and subscription or access status, dates and account association to enable and restore purchased access. The legal basis is performance of the contract and, where applicable, compliance with legal obligations. The store processes payments; Nubico does not receive your full card details.

RevenueCat also derives an approximate country from the connection IP address for purchase management and statistics, alongside the transaction country where available. According to its documentation, it retains the country and discards the IP address after determining it. This does not involve GPS or precise location.

The camera, photos, microphone and notifications are used when you activate the relevant features and grant the permissions required by the operating system. You can revoke permissions in your device settings. Optional features requiring consent rely on that consent (Article 6(1)(a)); withdrawing it does not affect the lawfulness of earlier processing. A device permission does not authorise uses beyond those described here.

What other people can see

Social mode is optional. When enabled, your public name, handle and avatar identify your profile. You can separately control who sees current reads, finished books and reviews: everyone, friends — mutual follows — or nobody. The initial setting for these categories is “everyone”; review it before sharing. A review’s visibility also depends on the visibility of its finished book.

Depending on those settings, activity may appear in Friends or Community. Private notes, quotes, recordings, book photographs and decorations are not part of the social profile. Suggestions and comments belong to a separate shared feature: turning off social mode does not delete them.

Avoid publishing sensitive information or other people’s personal data. Others may retain copies of information they saw before you changed its visibility or removed it.

How long we retain data

• Account and sign-in methods: for as long as the account exists or the method remains linked. The stable identifier remains until account deletion, even if the original sign-in method is removed.
• Email codes: they expire after 15 minutes and are purged within one or two days. Unverified registrations are removed with their pending data.
• Library backup: until you delete it in the app or request erasure. Deleting the account removes the backup.
• Social profile, avatar and follows: until removed, social mode is disabled or the account is deleted, except for report evidence described below.
• Handle after account deletion: reserved for the same identity for 30 days, then released.
• Suggestions and comments: removing them hides them from the community but does not immediately erase the server record. They are deleted with the author’s account, as are its votes. Reports about a suggestion or comment are deleted when that record is deleted; if only the reporting account is deleted, its identity is detached.
• Support and feedback: while handling the enquiry and for as long as necessary to resolve issues and improve the service. Account deletion removes the account identifier and handle, but the message or contact details you wrote may still contain personal data. You may request their erasure.
• Usage, diagnostics and searches: up to 90 days.
• Purchases: during the validity of purchased access and for periods required to fulfil legal obligations and address claims. Apple and Google retain their own records under their respective policies.

Specific community safety retention

Evidence from received profile reports and records of removed reviews or avatars may remain for the lifetime of the service, including after account deletion, linked to pseudonymous identifiers. Received blocks remain until the person who set them removes them or deletes their account. A reporter’s identity is detached when they delete their account.

Suspensions stop applying when they expire or are lifted, but their history remains until removed. These safety records do not currently have a general automatic expiry. Retention does not prevent you from requesting erasure or objecting: we will assess each request in light of the record’s necessity, affected people’s rights and applicable obligations.

Recipients and service providers

Data is accessible to authorised Nubico personnel and the providers needed for each feature. Published information is shown to the relevant audience. Data may also be disclosed to authorities where required by law.

• Apple and Google: authentication and, through the App Store or Google Play, payments and subscriptions. Their own terms and policies also apply to their accounts and stores.
• Brevo (France): delivery of verification, recovery and security emails. It receives the address and email content, not your password or library. Brevo privacy information.
• RevenueCat (United States): purchase and subscription status management. It receives the account identifier and necessary purchase data; we do not send your name, email or library content for this purpose. RevenueCat privacy information.
• ISBNdb, Google Books and Open Library: bibliographic lookups. Search requests originate from our server; we do not send them your myShelf account identifier.
• Cloudflare and hosting providers: infrastructure traffic, security and availability, using the connection and service data needed for those purposes.

Account, library, usage and diagnostic data is hosted on infrastructure managed by Nubico. Diagnostics use a self-hosted Sentry installation.

International transfers

International providers, particularly RevenueCat and Cloudflare infrastructure, may process data outside the European Economic Area. Their data processing agreements provide safeguards for restricted transfers, including European Commission Standard Contractual Clauses, depending on the destination and service: RevenueCat agreement and Cloudflare agreement.

You can request further information about recipients, locations and safeguards applying to your data, and a copy of those safeguards, by contacting us about privacy. Using a store or identity provider also involves processing for which that provider is independently responsible.

Account and data deletion

In Profile › Delete account, you can delete the account, sign-in methods, sessions, library backup, social profile, avatar, follows, blocks you set, suggestions, comments and votes. Retention exceptions are described above: safety records, support messages, temporary handle reservation, technical records until expiry and purchase records subject to applicable obligations.

Account deletion attempts to revoke linked Apple access. For Google, the app revokes access where that sign-in is available on the device; otherwise, you can remove it from your Google account. You can also review authorisations directly in your Apple or Google account.

Deleting the account does not erase the local library on your device or cancel a subscription. Use Profile › Delete all data for local data, and your purchase store to cancel subscriptions. You can request deletion without the app: see the account deletion instructions.

Your rights

Subject to applicable law, you may request access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests and withdraw consent where it is the legal basis, without retroactive effect. The app provides library export options; contact Nubico for other data.

Email hola@nubico.tech, identifying your request and the account concerned. We will only request additional identity information where necessary and proportionate. We generally respond within one month; if complexity or the number of requests requires a lawful extension, we will explain its reasons within that first month.

You may lodge a complaint with the Spanish Data Protection Agency or the competent supervisory authority. We do not use your data to make solely automated decisions that produce legal or similarly significant effects.

Children and security

myShelf is not directed at children under 14 and does not knowingly collect their data. If you believe we have received such information, contact us so we can investigate and erase it where appropriate.

We use HTTPS for service traffic, access controls and credential protection measures. Security fingerprints reduce exposure of original identifiers but do not make data anonymous. No system eliminates all risk; report security incidents through our contact email.

Updates to this policy

The current version is published on this page with its update date. Significant changes will be communicated appropriately, including through the app where relevant. If a new processing activity requires consent, we will request it specifically before carrying it out.