What Shelf-Lives knows about you

Shelf-Lives keeps your email address, the name you chose, and the games you put on your shelf. It runs no tracking scripts, it never sees your card details, and nothing about you is sold or handed to an advertiser. If you want all of it gone, there is a page for that, linked at the foot of this one.

Your email address, stored in lower case, and the name you type.

If you join with a password, we never store the password. We store an argon2id hash of it, which is a one-way scramble. Nobody can read your password back out of it: not us, and not somebody who steals the whole database.

If you sign in with Google or Facebook instead, we store which provider it was and the stable id that provider uses for you. We never store the tokens the provider hands over during sign-in. There is no column for them. We keep the email address the provider showed us at the moment you linked the account, as a note about how the link was made; it is not kept in step with the provider afterwards, and we cannot use it to reach back into your Google or Facebook account for anything.

A session is a long random token. Your browser holds the only usable copy; what we store is a SHA-256 hash of it. Password reset links work the same way: the link in the mail carries the only usable token, the database holds a hash that can be spent once, and it expires.

A job runs once a day and deletes expired sessions and expired reset tokens. It is housekeeping rather than a safety net. Both were already refused at the door the moment they expired; this just stops dead rows piling up.

• The session cookie, so the game knows you are you. HttpOnly, SameSite=Lax, and marked Secure whenever the site is served over https.
• A small cookie remembering whether you asked for the phone layout or the desktop one, so the choice sticks for the visit.
• During a Google or Facebook sign-in, a ten-minute cookie that exists only to check that the sign-in coming back is the one you started. It is gone when the handshake finishes.

There is no fourth cookie. None of them are for advertising or measurement, and none of them belong to anybody but us.

• Your shelf: one per account, and when it was made.
• Your collection: which games from the catalogue you own, how each one arrived, whether you have started or finished it, and when.
• Your Ghost Boxes: the games you are tracking toward owning, and how far each one has got.
• Your honors: which achievements you have been awarded, when, and whether you have seen them yet. Earned stays earned. There is no code that takes one back.
• Your feedback: if you rate a Ghost Box that has just become real, or type something in the box under it, we keep the rating and your words exactly as written.
• A small funnel record each time you add a game to your shelf or a Ghost Box changes state.

That last one deserves to be specific, because most sites cannot afford to be. A funnel record holds the kind of event, the game or Ghost Box it was about, the state it moved from and the state it moved to, a trace id we use when chasing a bug, and the time. It holds no IP address and no user agent. Not redacted, not truncated: there is no column for either one.

Anything you post in the community channel is kept as you wrote it, next to the name you were using at the moment you posted. Change your name later and the old lines keep the old name, because a transcript that rewrote itself would not be a transcript. Please post accordingly.

The channel also keeps one small presence row per person: the name you go by and when you were last seen there, so the room can show who is around.

The name you claim is held once, community-wide, so that two people cannot answer to the same one. It is the name other players see. Your email address is never shown to another player anywhere in the game.

Payments happen at Ko-fi, not here. We never see your card, and there is nowhere in this database that a card number could go.

When Ko-fi tells us a payment happened, we write a receipt holding four things: Ko-fi’s transaction id, when it arrived, what kind of payment Ko-fi called it, and what we decided to do about it, as a single word from a fixed list. No amount. No payer name. None of the payer’s words. If you typed a lovely message with your coffee, it stayed at Ko-fi; we never stored it.

If the payment named an email address that no account here was using yet, we hold that address on its own so the shirt is waiting when you do sign up. It waits 180 days and is then swept away. Your account itself records only that you are a supporter, when the grant was made, which channel it came through, and the note whoever granted it typed.

When you sign in, sign up or ask for a new password, we read your IP address to count attempts, so nobody can sit there guessing at other people’s accounts. That count lives in memory for fifteen minutes to an hour and then it is gone. It is never written to the database and never written to a log.

We also read your browser’s user agent string once per page, to decide whether to draw the phone layout or the desktop one. That answer is used and discarded. It is not stored either.

What we cannot speak for is the machinery underneath us: our host keeps its own request logs, the way every host does, and those will contain addresses. We do not read them for anything but a broken deploy, and nothing there is joined up with your account.

• No third-party analytics, ever. There is no Google Analytics, no pixel, no ad tag, no session recorder, no heatmap, no A/B service. Not one line of somebody else’s script runs on these pages, and a test in our own build fails if one ever appears.
• No advertising profile. Nothing here is sold, rented, shared or traded. There is no arrangement with anybody that would let that happen.
• No payment details. No card, no bank account, no billing address, no amounts.
• No contacts, no photos, no location. We never ask, so we never have them.

A few durable event rows sit behind the scenes so that work which was started always finishes, even if the server falls over halfway. Each one names the kind of event, an internal id for the account it concerned, and when. There are no names in them and no content.

Being exact, because this is the sort of detail a policy usually glosses: these rows are not attached to your account in the database, so deleting the account does not carry them off with it. What is left points at ids that no longer exist. The deletion page lists this with the rest of what stays behind.

• Vercel runs the site and stores the box art.
• Neon holds the database, in the United States (US East).
• Ko-fi handles payments, and holds everything about them that we deliberately do not.
• Google and Facebook are involved only if you choose to sign in with one of them, and only for as long as that sign-in takes.

There is one more thing we should say rather than leave you to discover: the product has no mail service connected yet. Mail we would send, such as a password reset, is written to our own logs instead of being delivered. That is a gap we are closing, and until it is closed, the lost-key path will not reach you.

If you are reading this from outside the United States, note that using Shelf-Lives means your data is stored there.

Your account and everything on your shelf stay until you delete them. Expired sessions and reset tokens are swept daily. An unclaimed supporter grant expires after 180 days. Everything else lasts as long as the account does, which is another way of saying that the length of time is yours to decide.

You can ask for a copy of your Shelf-Lives data, and you can ask for the whole account to be deleted. The deletion page says exactly what goes, exactly what stays behind and why, and how to ask.

The date at the top is the date this page last changed. If we ever start collecting something new, this page changes in the same commit that collects it. That is a rule we hold ourselves to in the build, not a promise we are making in prose.

We have not published a contact address yet. That is a gap we know about and it is being fixed; until it is here, this page cannot tell you where to write, and we would rather say so than print an address that goes nowhere.