Last Updated: May 12, 2026
Controller and contact
See the Contact page and the Legal Notice.
App
The BookShelves app stores your library locally and, optionally, in your personal iCloud account. We do not receive that data.
The app sends anonymous crash and error reports to Sentry. You can disable this in Settings > Analytics Opt-Out. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fixing bugs).
Website (getbookshelves.app)
Google Analytics runs only after you accept the cookie banner. Consent stored for 365 days. Legal basis: Art. 6(1)(a) GDPR (consent).
Feedback portal (feedback.getbookshelves.app)
If you submit feedback, comment, vote, or sign in, we process:
- Your email address (not publicly visible).
- Your Apple or Google account identifier, if you choose social sign-in.
- Your IP address, used solely for spam rate-limiting (kept for 48 hours).
- The content you submit (titles, bodies, comments, votes — publicly visible).
- Functional cookies strictly necessary for sign-in and abuse defence. No advertising or cross-site tracking cookies.
Legal bases: Art. 6(1)(b) GDPR (you initiated the request) and Art. 6(1)(f) GDPR (preventing abuse).
Recipients
- Apple — App Store, iCloud, Sign in with Apple. Privacy Policy
- Google — website analytics and Sign in with Google. Privacy Policy
- Cloudflare — Turnstile anti-bot challenge on the feedback portal. Privacy Policy
- Amazon Web Services — feedback portal hosting. Privacy Notice
- Sentry — app crash reporting. Privacy Policy
- Open Library — book metadata (no personal data sent). Open Library
Retention
- App data: until you delete it from your device or iCloud.
- Sentry error data: 90 days.
- Feedback portal posts, comments, votes, and account identifier: until you request deletion.
Your rights (GDPR / CCPA)
You have the right to access, rectification, erasure, restriction of processing, data portability, objection, and to withdraw consent at any time. To exercise these rights, contact us via the Contact page. We respond within 30 days.
You can also lodge a complaint with a data protection authority (Germany: BfDI).
Children
We do not knowingly process data of children under 16.
Changes
Material changes will be reflected by updating the “Last Updated” date above.