Privacy

Operator and contact

Sourceflow LLC operates Shelf. For support, privacy questions, or an account-deletion request, email [email protected].

Information Shelf handles

• Account details such as your display name, email address, optional phone number, Shelf user ID, and the identifiers Apple or Google provides when you use those sign-in methods.
• Your library, including saved URLs, extracted or shared page text, supported PDF and DRM-free EPUB imports, notes, highlights, reading state, and the original source details kept with a saved item.
• Newsletter messages sent to your Shelf inbox. The sender, subject, message identifier, and cleaned readable content become an article in your library.
• Membership and referral information, including membership status, product and store identifiers, purchase and verification times, referral codes, and earned reward state.
• Article text you choose to turn into speech after giving remote-audio consent. Shelf may keep generated audio in a cache on your device.
• Data kept on your device, including article and audio caches, playback positions, reader and theme preferences, and the bounded iPhone Share queue.

Chrome extension pairing and saves

Pairing starts with the exact Shelf server URL and one-time code shown in the signed-in app. Chrome asks for permission to contact that server, and the extension sends the code only to the server you entered. After Shelf accepts the code, Chrome's local extension storage holds the selected server URL, an expiring extension-only credential, and a local pairing identifier. Shelf stores a hash of the credential on the paired server rather than the credential itself.

When you choose to save a public HTTP or HTTPS page, the extension reads the active page's URL, title, and browser-visible body text. It first stores the selected server, pairing identifier, URL, title, and visible text as a pending save in Chrome. It then sends the URL, title, and text to the selected paired Shelf server with the extension credential.

A successful save or confirmed duplicate removes the pending copy from Chrome. If extraction fails, the pending record keeps the URL, title, and a failure marker, but no page text, so you can retry extraction. A retryable transfer failure leaves the pending URL, title, and captured text in Chrome so you can retry. Pairing a new session discards an older pending save. Invalid or mismatched pending data is also discarded. If the paired server rejects an expired or revoked credential, the extension removes that credential and its matching pending save after the rejection.

Disconnecting the extension in Shelf Settings revokes the server-side credential and any unused pairing codes. It does not directly erase Chrome's local extension storage. The extension removes expired or rejected credentials when it next validates or uses them. Clearing the extension's data in Chrome removes its local pairing and pending save.

Services used to provide Shelf

Convex hosts Shelf's account, authentication, library, and sync services. Apple and Google handle the sign-in methods you select. Apple App Store and Adapty handle membership purchase, restore, and verification flows when those features are available. Cloudflare Email Routing and a Shelf Email Worker deliver messages addressed to your Shelf newsletter inbox. With your consent, requested article text goes through Shelf's authenticated service to Sourceflow's self-hosted Pocket TTS server for speech generation.

Your choices

• Delete individual saved items from your library.
• Export your library from the signed-in app.
• Revoke a paired browser extension from Shelf Settings.
• Withdraw remote-audio consent in Settings to stop new speech generation. Audio already cached on your device can still play.
• Delete your Shelf account from the signed-in app.

Account deletion

Account deletion removes your Shelf account and its active account-scoped data from Shelf's Convex records. This includes saved articles, browser-extension captures, newsletter articles, imported document text, highlights, extension credentials and pairing codes, speech admission records, membership records, owned referral records, verification codes, sessions, refresh tokens, and sign-in verifiers. When Shelf holds an Apple revocation token, it also revokes that Apple grant. If it does not, Shelf explains how to remove access in your Apple account settings.

Shelf keeps a random completion receipt so the app can confirm that deletion finished. A referral participant can keep a reward they already earned, but Shelf removes the deleted account's redemption link. Some email and phone verification rate-limit records cannot be matched to an account and remain.

Account deletion cannot reach into Chrome to remove the extension's local credential or a pending save. It also does not by itself erase records held independently by Apple, Google, Adapty, Cloudflare, or Convex outside Shelf's account-scoped deletion path.

Content boundary

Shelf saves supported public pages, text already available in a page you choose to share, and supported documents you provide. Shelf does not obtain publisher credentials or bypass authentication, paywalls, access controls, or document encryption. Image-only PDFs without extractable text are not supported.