Privacy Policy

Last updated November 10, 2026

Shelf is an iPhone app for saving posts and links from other apps and getting them back at the right moment. It’s built and run by an independent developer, referred to here as “Shelf”, “we” or “us”. This policy covers the Shelf iOS app, its share extension, and this website.

The short version

We collect what you save, the settings you choose, and the minimum account details needed to sign you in.

Saved content is sent to two AI providers, Anthropic and Voyage AI, so Shelf can sort it and find it again. You can turn this off in Settings → AI features.

No ads, no analytics or tracking SDKs, and no data brokers. We don’t sell your data.

You can delete your account in the app at Settings → Delete account. Everything is permanently erased within 30 days.

What we collect

Your account

You sign in with Apple, Google, or an email address. Sign-in is handled by our authentication provider, Clerk, which stores your email address and, if Apple or Google shares it, your name. If you use Sign in with Apple’s “Hide My Email”, Clerk only receives the relay address.

Shelf’s own database doesn’t store your email or name. It stores an account ID issued by Clerk and links your saves to that ID.

What you save

When you share something to Shelf, we store:

The link, plus any text the other app shared along with it.
Your note, if you add one.
Information from the page. Our server opens the link and reads its title, description, preview image and, for some posts, the post text and every image in the post. We keep copies of those images in our storage so they keep showing up after the original changes or disappears.
Text found in images. If a post’s images contain text (a recipe card, a slide), we extract that text so you can search for it, and add it to the save’s description.

What Shelf works out from your saves

To sort and resurface your saves, Shelf generates:

a category (Read, Watch, Try, Buy, Remember or Share), topic tags, and details mentioned in the content, such as a place name, an event date or a price
a short phrase describing the save, used in notifications
a numeric representation of the save’s text (an “embedding”), used to find related saves and rank results

Place names come from the pages you save. Shelf never accesses your device’s location.

Your choices and feedback

Settings: your time zone, quiet hours, notification preferences, weekend style, and whether AI features are on.
Corrections you make (for example, changing a save’s category) and feedback such as “don’t remind me about this”.

Notifications

If you allow notifications, we store your device’s push token so we can deliver them. We keep a record of each notification we send (when, which saves, the text, and whether you opened it) so we don’t over-notify you. We also keep internal records of how Shelf decided what to send, and delete them after 90 days.

How you use Shelf

We record a small set of in-app events tied to your account: when you open the app, when you open a saved item’s original source, when you tap a notification, and when you correct a save. Shelf uses these to stop notifying you about things you’ve already dealt with and to measure whether notifications are useful. We don’t use any third-party analytics SDK.

Subscriptions and limits

If you subscribe to Shelf Pro, Apple processes the payment. Our subscription provider, RevenueCat, tells us which plan you’re on, whether it’s active, and when it renews or ends. We never see your payment card or billing details. We also count how many saves you make each month to apply the free plan’s limit.

Search

Your search terms are used to find matching saves. We don’t store them.

Server logs

Our servers keep operational logs to run and secure the service. A log line can include your Shelf account ID, the ID of a save, the part of the app you used, whether the request worked, and how long it took. Shelf’s code doesn’t log IP addresses, search terms, or the links you save. Our hosting and network providers may process your IP address to deliver traffic to our servers.

On your device

The share extension briefly keeps a save (link and note) on your device until it reaches our server. Your sign-in credentials are stored in the iOS Keychain, and images are cached on your device. All of this is removed when you delete the app.

This website

This website uses no cookies, no analytics and no tracking scripts. If you join our launch waitlist, your email address goes to our newsletter provider, Buttondown. You confirm it by email, we use it once to tell you Shelf has launched, and you can unsubscribe at any time. Emails you send to support@shelf.winprn.dev pass through Cloudflare Email Routing to our inbox.

What we don’t collect

Shelf doesn’t access your location, contacts, photo library, camera, microphone or health data. It doesn’t use the advertising identifier, doesn’t track you across other companies’ apps or websites, and has no ads.

How we use it

To run Shelf: store your saves, show them, sort them, search them, and remind you about them.
To send the notifications you’ve allowed, within the quiet hours you set.
To apply the free plan’s limit and unlock Shelf Pro.
To answer your support requests.
To keep the service secure and working, and to fix bugs.
To improve how Shelf sorts and resurfaces saves, using your corrections and feedback.

We don’t use your data for advertising and we don’t sell it. We don’t use your saves to train AI models.

AI processing

Shelf sends parts of your saves to two AI providers. They process the data to return a result to us:

Anthropic (Claude) sorts each save and reads text in post images. It receives the saved link, the page’s title and description, any text shared with the link, your note, and the post’s images.
Voyage AI creates embeddings for search and resurfacing. It receives the save’s title, description (including any text read from images) and your note. It doesn’t receive the link or the images.

Neither provider receives your email address, your name or your Shelf account ID. How long they keep the data is governed by their commercial API terms.

You can turn AI features off at any time in Settings → AI features. While they’re off, nothing is sent to Anthropic or Voyage AI. Saves are then sorted using only the website they come from, and related-save ranking doesn’t use embeddings. Turning AI features back on applies to new saves.

Opening links for you

To read a page’s title, description and images, our server visits the link you saved. The site sees a request from our server, not from your device, and doesn’t learn who you are. Shelf can only read what the site shows publicly. Private or login-only content isn’t accessible.

Notification content

A notification can include a short phrase about the saved item, like “the ramen spot in Shibuya”. Notifications are delivered through Apple Push Notification service, so their text passes through Apple’s servers, and it can appear on your lock screen depending on your iOS settings. You can turn Shelf’s notifications off in the app or in iOS Settings.

Who processes your data

We use these service providers. Each one receives only what it needs to do its job for Shelf:

Provider	What it does for Shelf	What it receives
Cloud hosting provider	Runs Shelf’s servers and database	Everything stored in our database, and server logs
Clerk	Sign-in and account management	Email address, name (if shared), sign-in details
Anthropic	Sorting saves; reading text in images	Saved content, as described under AI processing
Voyage AI	Embeddings for search and resurfacing	Title, description and note of each save
Cloudflare	Image storage (R2), website hosting, support email routing	Copies of post images; website requests; support emails
RevenueCat	Subscription status	Your Shelf account ID and Apple purchase records
Apple	Sign in with Apple, push notifications, App Store payments	Notification text and push token; purchases
Google	Sign in with Google, if you use it	Sign-in details
Buttondown	Launch waitlist email	Your email address, if you join the waitlist

These providers may process data in the United States and other countries. Where the law requires it, we rely on appropriate safeguards for international transfers, such as the providers’ standard contractual clauses. We may also disclose information if the law requires us to, or to protect the safety of our users or the service.

How long we keep it

While your account exists, we keep your saves, settings and related data so Shelf works.
Deleting a save removes it from your Shelf right away. Its stored record is permanently erased when you delete your account.
Records of how Shelf chose notifications are deleted after 90 days.
Server logs and any backups are kept only as long as needed to run and secure the service, then deleted.
Waitlist email addresses are kept until you unsubscribe or we’ve sent the launch email.

Deleting your account

Go to Settings → Delete account in the app. When you confirm:

You’re signed out on every device, and your sign-in account at Clerk is deleted straight away.
Your subscription record at RevenueCat is deleted. Deleting your account doesn’t cancel an App Store subscription; cancel it in your Apple ID settings to stop being charged.
If you use Sign in with Apple, we ask Apple to remove Shelf from your Apple ID’s Sign in with Apple list. You can also remove it yourself in iOS Settings.
Your saves, notes, images, settings and all related data are permanently erased within 30 days.

If you sign in again later, you start with an empty Shelf. If you can’t access the app, email us at support@shelf.winprn.dev and we’ll delete your account for you.

Your rights

Depending on where you live, including the EU, the UK and California, you may have the right to access, correct, delete or receive a copy of your personal data, and to object to or restrict how we use it. To make a request, email support@shelf.winprn.dev from the address you sign in with. We’ll answer within 30 days. You can also complain to your local data protection authority.

If you’re in the EU or UK, these are our legal bases:

Contract: to provide Shelf, including storing your saves, notifications and subscriptions.
Consent: for sending saved content to our AI providers. You can withdraw it in Settings → AI features.
Legitimate interests: to keep Shelf secure, fix problems, and improve how it sorts and resurfaces saves.

We don’t sell or share personal information for cross-context behavioral advertising, as California law defines those terms.

Children

Shelf isn’t intended for anyone under 16, and we don’t knowingly collect data from them. If you believe someone under 16 has created an account, email us and we’ll delete it.

Security

Data travels to and from our servers over encrypted connections. Every request is checked against your signed-in account, and saved images are served through short-lived signed links. No system is perfectly secure, but we work to protect your data and limit who can access it.

Changes to this policy

When we change this policy, we’ll update the date at the top. If a change materially affects how we use your data, we’ll tell you in the app before it takes effect.

Contact

Questions or requests: support@shelf.winprn.dev