Plain-language summary: we collect what's needed to run Shelfie, we never sell it, private content is private by design, and you can delete everything from inside the app.

1. Who we are

Shelfie is made by Stackset Technologies Inc. ("Stackset", "we"), a company incorporated in Ontario, Canada and based in Markham. This policy covers the Shelfie mobile app, shelfie-app.ca and our support channels. It is written to comply with Canada's PIPEDA and, where applicable, Quebec's Law 25, the GDPR and the CCPA. Our company-wide policy lives at stackset.io/privacy; this version is specific to Shelfie.

2. What we collect

You give us: email and username at sign-up; optional display name, bio and avatar; your collections, posts, reels, comments, reviews and messages; a beauty profile (skin type, concerns, goals, routine, ingredient preferences) if you complete it; product requests you submit; and messages to support.

Collected automatically: device model, OS and app version; crash reports; coarse usage events (which screen was opened, which feature was used); push notification tokens; IP address in server logs. Location is collected only if you enable location personalisation. Location metadata is stripped from photos you upload.

From Apple or Google if you sign in with them: a verified identity token and, with your permission, name and email. Never a password, never your contacts.

3. How we use it

To run Shelfie: show your shelf, deliver messages, send notifications you opt into, keep your account secure.
To personalise: your beauty profile, collections and activity drive the For You feed, your signature brand and ingredient, and INCI flags for avoided ingredients. You can clear your beauty profile at any time.
To improve: aggregated, de-identified usage and crash data.
To communicate: sign-in codes and security notices; product news only if you opt in.

We do not sell personal information. We do not use your content to train third-party AI models. The INCI analyzer runs on rules, not on your data.

With other users, as you choose: public collections and posts are visible to anyone; followers-only and private content is limited by your settings; group collections are visible to their members. With service providers under contract (cloud hosting and database, object storage, push and email delivery, crash reporting) who may use the data only on our instructions. With authorities when the law requires; we tell you unless prohibited. With retailers: never. Tapping a buy button takes you to their site; what you do there is governed by their policy.

5. How we protect it

The app never holds a database credential; it reaches data only through authenticated integration endpoints. Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Row-level security policies restrict every record to its owner. Internal consoles require single sign-on with multi-factor authentication. See the security page. If we learn of a breach affecting you, we notify you and the Office of the Privacy Commissioner of Canada as required.

6. Retention and deletion

We keep your data while your account is active. Delete your account in the app (Menu → Account → Request account deletion) or by emailing privacy@stackset.io. Deletion removes your profile, content and messages from production within 7 days and from backups within 30 days. Messages you sent to others may remain in their threads, marked as from a deleted account. Server logs are kept for 90 days. Aggregated statistics that cannot identify you may be retained.

7. Your rights

You can access, correct, export and delete your personal information, withdraw consent and object to certain processing. Most of this is in the app; for the rest, email privacy@stackset.io. We respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada or your local authority.

8. Age

Shelfie is for people aged 16 and over. We do not knowingly collect personal information from children under 13 (or the applicable age in your region). If you believe a child has an account, contact us and we will remove it.

9. Where data lives

Production data is hosted in North America. Some providers may process data elsewhere under contractual safeguards.

10. Changes and contact

We post changes here and, for material changes, notify you in the app or by email. Questions: privacy@stackset.io, or Stackset Technologies Inc., Markham, Ontario, Canada.

Privacy policy