Privacy Policy

When you create an account we store your email address (held by our authentication provider) and a profile record containing a display name, optional username, optional avatar reference, country, preferred currency and shelf visibility preference. Your password is never visible to us; authentication is handled by our hosting platform's managed auth service.

The volumes you mark owned, ordered or wanted, the editions you save, and your series wishlist are stored against your account. Optional fields you may add — purchase price, purchase date, retailer, condition and personal notes — are stored with them.

This data is private by default. Database row-level security restricts every one of these records to your own account. Operators cannot browse an individual person's wishlist or shelf; internal demand reporting only ever uses aggregate counts.

If you report a catalog problem or request a series, we store your message and the records it refers to so we can fix the catalog. Operators can read these, because a report cannot be actioned without reading it.

We record first-party, server-side product events (for example: a page viewed, a search performed, a retailer link followed) to understand which parts of the catalog need work. These events may carry your account identifier while your account exists. We do not use Google Analytics, advertising pixels or cross-site trackers.

Ordinary server request logs and error reports are retained for operational and security purposes.

We use browser storage for two purposes only: keeping you signed in (a session token issued by our authentication provider) and remembering your interface preferences such as light or dark theme. There are no advertising or cross-site cookies.

If you sign in with a third-party provider, that provider tells us your email address and basic profile information so we can create or match your account. We do not receive your password, and we do not post anything on your behalf.

Buy links send you to third-party retailers through a redirect on our own domain. We record that a redirect happened so we can measure which links are useful. Some retailer links may earn us a commission at no extra cost to you. Once you arrive at a retailer you are subject to that retailer's own privacy policy; we do not receive your order details.

Catalog records — series, editions, volumes, ISBNs, publishers and release dates — are shared reference data, not personal data. Cover images are served through our own proxy rather than hot-linked, and are sourced from publisher, distributor and bibliographic records. Attribution and sources are listed on our data sources page.

Signed-in users can download a machine-readable copy of their personal data — profile, shelf, wishlist, saved editions and submitted reports — from Settings → Privacy & data. The export never contains other people's data or internal system records.

You can delete your account yourself from Settings → Privacy & data. Deletion is irreversible. It removes your profile, shelf, saved editions, wishlist and account roles, and permanently unlinks your identity from analytics events, retailer-click records and any catalog reports you submitted. Anonymized catalog reports are kept because removing them would re-break the catalog for other readers; they no longer reference you in any way. Shared catalog data is unaffected.

Account and shelf data is retained until you delete your account. Anonymized analytics and anonymized catalog reports are retained indefinitely as aggregate operational data. Server logs are retained for a limited operational period.

Tanko Shelf is not directed at children under 13, and we do not knowingly collect their personal data.

Privacy questions, access requests and deletion help: tanko.shelf@proton.me.