Privacy Policy

ShelfToWorld operates the website you are using. For privacy questions email support@shelftoworld.com.

Other people can see your display name, city, and state, your published listings (title, condition, format, replacement value, photos you publish), and your lender and borrower rating averages. Street address, email, and full shipping name are not on the public profile.

When you register we store your email, a password hash (not the password itself), display name, optional bio, city, state, and a US shipping address: name on packages, street, optional apartment, city, state, and ZIP. Country is fixed to the United States. A password reset link is stored only as a hash, expires after one hour, and is single-use. To limit repeat requests we keep hashes of the email and the requesting IP, not the raw address.

The street address is used to print outbound and prepaid return stubs after a lender accepts. Both people on that rental can see it while the loan is active. It is masked again after complete or cancel. We do not offer in-person pickup or geolocation.

We store the rental quote (fees, postage, insurance, refundable hold, oversize surcharge, lender bounty or share), status, dates, and any tracking numbers you type. Thread messages are visible to the borrower, the lender, and the system notes we post. We do not ask for phone numbers.

Star ratings and notes are stored with the rental. A reported note is hidden from the person it was written about.

Membership, à la carte checkout, insurance, and refundable holds are sent to Stripe Checkout when a test-mode key is configured. Lender payout setup uses Stripe Connect Express, also in test mode. Stripe receives whatever you type on Stripe’s test pages. We store Stripe customer ids, checkout session ids, subscription ids, and Connect account ids so we can tell whether a test Checkout finished and whether a test payout account is ready. We do not store full card numbers. We do not run live charges or live payouts.

Live secret keys are rejected. A Stripe test charge, if you complete one, is still handled by Stripe under their terms. It is not a charge to a real customer card in this beta.

Ledger lines (bounties, shares, hold notes) stay on your Earnings page. They are not a bank statement and they are not a live payout.

If you upload cover, spine, or shelf photos, we compress them and store them with the import batch and, when you publish, on the listing. Images are kept as data on the listing record so the app can show them without a separate file host.

When a Google Gemini API key is configured, the high-detail crop is sent to Google to suggest a title, category, and format. You can correct the suggestion before publish. Without that key, the photo is still saved and you type the title yourself. We do not upload photos you did not choose, and we do not scrape other people’s shelves.

Optional cover art looked up after publish comes from public catalogs (for example iTunes Search, Open Library, Wikipedia, Cover Art Archive). Those requests use the title you confirmed, not your street address.

A session cookie keeps you signed in. It is an http-only cookie signed with the site secret. Paid-path events are written as server logs (product type and Stripe ids), not a marketing profile. Aggregate visits, when analytics is configured, are described under Usage analytics.

If error monitoring is configured, Sentry may receive error reports from checkout. Those reports are limited to product type and checkout session id — not your email or Stripe secret keys.

When analytics is turned on for this site, we use Umami Cloud, a cookieless privacy-focused analytics service, to collect aggregate usage data: pages visited, referrer, browser and device type, and country. Umami does not set cookies and does not follow you across other websites. We do not sell this data. Umami’s privacy policy is at umami.is/privacy.

A few product events (an account was created, a listing was published, a rental was requested, checkout started, a membership started) may include a catalog category, a postage service, or whether the checkout was membership, a guest rental, or member extras. Those events do not include your email, name, street address, or account id. We do not record page views of admin, account settings, your rentals, inbox, earnings, a listing you are editing, checkout return pages, or the forgot-password and reset-password pages. A product event counted from one of those pages is sent as a visit to the home path, without the query string and without an id. A password reset token is not sent. If the analytics id is not set, the tracker is not loaded.

We do not sell personal information. We do not show your street address on browse or on your public profile. We do not use your photos to train a model we operate. Service providers that process data for the product are Stripe (payments and Connect), Umami Cloud (aggregate usage, only when configured), and, only if you use photo detection and a key is set, Google Gemini.

Account, listing, and rental records stay while the beta needs them to run loans, payouts, and disputes. Email support@shelftoworld.com to ask for an account deletion. We may keep a rental record where we still need it for a payout, a buyout, or a dispute. Demo seed accounts exist so the mail path can be tried; they are not real customers.

ShelfToWorld is for people who can form a contract and ship media. Do not create an account for a child.

If this policy changes, the date at the top of the page changes with it. The current version is always at /privacy. Related: Terms of Service and Contact / Support.