Security & privacy
Private by architecture.
Shelfie holds personal things: your routine, your photos, your messages. This page explains, in plain language, how we keep them yours.
Core security infrastructure
Your shelf is yours. Our database is nobody's.
Shelfie runs on Stackset's hardened platform. The app on your phone never holds a database connection; it talks to a narrow set of integration service endpoints that authenticate, authorise and shape every request. The internal database has no public address at all.
Integration service endpoints, not tables
The app asks for intents ("add this product to my collection"), never rows. Each endpoint validates input, checks who you are and what you're allowed to do, and returns only what that screen needs. A malicious agent probing our edge finds no database to connect to.
Single sign-on for the team, passwordless for you
Every internal console the Shelfie team uses sits behind SSO (OpenID Connect) with enforced multi-factor authentication and role-based access. You sign in with Apple, Google, or a one-time email code. We never store a plaintext password.
Containerised applications
Each service runs in its own container: non-root, read-only filesystem, pinned dependencies, explicit egress allow-list. The worker that reads a store link you paste is isolated from anything that holds user data.
Row-level security as the last line
Even behind the gateway, the database enforces per-row policies tied to your account. A private collection, a followers-only post or a DM cannot be read by a bug in another feature.
Secrets that rotate
Credentials are minted at deploy time, scoped to one service and rotated automatically. Nothing sensitive lives in the app bundle, a repository or a laptop.
Encrypted and auditable
TLS 1.3 in transit, AES-256 at rest, immutable signed releases, and audit logs for every privileged action. Photos are stripped of location data before they're stored.
Controls in your hands
What you decide.
Who sees what
Every collection is Public, Followers or Only me. Posts and reels follow their collection. A private account hides your shelf from non-followers entirely.
Who can reach you
Block, mute and report from any profile or chat. Blocked people vanish from your feeds and can't message you.
What we send
Per-type notification toggles. Mute a chat and its pushes stop. We never email marketing without an explicit opt-in.
What the app can access
Photos and camera only when you pick or take a picture. Location only if you turn on location personalisation. No contacts, ever.
Your sign-in
Sign in with Apple, Google, or a six-digit email code. No password to leak. Sessions are short-lived and refreshed silently.
Leaving
Menu → Account → Request account deletion. Removed from production within 7 days and from backups within 30. No email, no phone call.
Responsible disclosure
Found a vulnerability? Tell us first.
Email security@stackset.io with steps to reproduce. We acknowledge within 2 business days and credit researchers who want it. Please don't access other people's data or degrade the service. Machine-readable policy: /.well-known/security.txt. Shelfie's infrastructure is operated by Stackset Technologies.