Privacy Policy

Effective date: 14 October 2026

Shelfnook is a home-library app for keeping an inventory of the books you own and, if you wish, sharing it with friends. The app and the web version at shelfnook.app are operated by Özge Özmen. This policy explains which data we process, why, and what your rights are.

Contact: help@shelfnook.app

Data we collect

• Account details: your e-mail address or mobile phone number (whichever you sign up with). Your password is never sent to the server; a one-way digest of a key derived from your password on your device is stored instead.
• Phone number (optional): if you sign up by phone or add a number under Settings, it is stored after being verified with a code (sent via WhatsApp, SMS or a voice call). Your number is never shown to other users.
• Display name (optional): if you use the friends features, the name you choose is visible to your friends and to people who send you requests.
• Library content: the books and edition details you add, your bookcase and shelf layout, copy notes, reading status, classifications and, optionally, the cover photos you take.
• Friendship and loan records: friend requests you send and accept, people you block, borrow requests and their status, and reports you submit.
• Technical data: a digest of a session key and a device/browser description to recognise your session. Temporary attempt counters tied to your IP address and phone number are kept to prevent abuse. Our hosting provider, Cloudflare, keeps standard service logs.
• Sign-up source: if you create your account through an announcement or ad link (for example on Instagram), the campaign tag in that link (e.g. “instagram/reklam/kurucu-okur”) is stored with your account. It is used only to count, in aggregate, how many people joined from each announcement; no advertising IDs, tracking cookies or third-party analytics are used.

Contacts (address book)

In the iPhone or Android app, when you tap “Find from my contacts” and grant the contacts permission, the phone numbers in your address book are converted on your phone into SHA-256 digests (hashes). Only these digests are sent to the server; names and numbers are not. The digests are used at that moment solely to find matches among Shelfnook users who chose to be discoverable, and are not stored. We never contact the people in your address book, never message them, and never use contacts data to build a database of people. You can revoke the contacts permission at any time in your phone's settings (iPhone: Settings › Shelfnook › Contacts; Android: Settings › Apps › Shelfnook › Permissions).

For other people to find you from their contacts, you must explicitly choose to be “discoverable” on the Friends screen; this setting is off by default.

Sharing and visibility

Your library is private by default. If you turn on “Share my library with my friends”, only the friends you have accepted can see the title, author, publisher, year, ISBN and source cover image of your books. Your shelf locations, notes, reading status and the cover photos you took yourself are never shared. You can turn sharing off, remove a friend or block a person at any time.

How we use data

Your data is used only to provide the service: storing your library, syncing it between your devices, looking up book details and running the sharing and borrowing features you choose to use. The Shelfnook app contains no ads, and no tracking or third-party analytics tools are used. Your data is not sold and not used for marketing.

Service providers

• Cloudflare: the application server and database run on Cloudflare infrastructure.
• Twilio (phone verification): when you sign up by phone, add a number or reset your password by phone, your number is passed to Twilio to send and check the verification code (via WhatsApp, SMS or a voice call). Twilio generates the code; we never see it.
• Google Books and Open Library: when looking up book details, only the ISBN or the search text you typed is sent to these services. No account data is sent.
• Anthropic (AI): if you use “Photograph the copyright page” or “Search the web by ISBN” for a book that was not found in the sources, the photo you took or the ISBN is sent to Anthropic's Claude AI service to read or find the details. AI is also used to suggest a classification from a book's description. The copyright-page photo is used only to be read and is not stored on our server. No account data is sent. Anthropic does not use data sent through its API to train its models.

Camera

The camera is used only to scan barcodes and, if you choose, to photograph the copyright page and the cover. Barcode images are processed on your device and are not saved.

Reporting and blocking

If you see an inappropriate name, content or behaviour, you can report and block the person from the menu on their page. Reports are reviewed within 24 hours; if necessary the name is removed or the account's friends features are disabled. Reports are not shown to the person reported.

Retention and deletion

Your data is kept until you delete your account. You can delete your account at any time in the app or by signing in at shelfnook.app via Settings › Account › Delete account (details: How do I delete my account?). This immediately and permanently deletes your account, phone number, library, friendships, blocks and loan records. Reports you previously submitted may be kept in anonymised form. Deleted data may remain in technical database backups for up to 30 more days. You can also send a deletion request by e-mail.

Your rights

Depending on where you live, data-protection law (such as the GDPR in the EU/EEA and the UK, or the Turkish Personal Data Protection Law no. 6698) gives you the right to access your data and to ask for it to be corrected or deleted. You can download your entire library as CSV or JSON under Settings › Export & backup. For any other request, write to the address above.

Security

All connections are encrypted with HTTPS. Each user's data is kept separate; other users can only see what you explicitly share. Code sending is protected against abuse with country and rate limits.

Children

Shelfnook is not directed at children under 13 and does not knowingly collect data from them.

Changes

Changes to this policy are published on this page with an updated effective date.