Privacy Policy

Giovanni Fonseca Alves, operator of ShelfMee, is the controller of the personal data described in this policy. For any privacy question or request, including those addressed to our data protection officer (“Encarregado” under the LGPD), contact us at privacy@shelfmee.com.

Account data. Your email address and password when you sign up with email. Passwords are stored only as secure hashes by our authentication provider; we cannot see them. If you sign in with Google, we receive your name, email address, profile picture and Google account identifier. We do not receive your Google password or access to your Google content.

Profile data. The display name, avatar, bio and other profile blocks you choose to add, and your city and country.

Location data. Your country, postal code and, where it improves precision, your street name (never your house number). We turn this into approximate coordinates that are stored privately on our servers and are never shown to other users or sent to your browser. If you choose “Use my location”, your browser asks for your permission and rounds the position to about 100 meters on your device before sending it; we use it only to suggest your postal code and then discard it.

Collection and activity data. The games on your shelf and their arrangement, games you hide, plays and wins you record, corrections and suggestions you submit to the game catalog, bug reports (including any screenshot you attach and your browser’s user agent), Mee coins and virtual items, and the date and time of these actions.

Invites. Every account has a random invite code. If you sign up through an invite link, we record which account the invite came from, to understand how ShelfMee grows. The code stays in your browser until the account is created.

Connected accounts. If you connect BoardGameGeek, we store your BoardGameGeek username. If you connect Ludopedia, we store the access token Ludopedia issues to us so we can import your collection. Tokens are kept only on our servers. You can disconnect at any time.

Technical data. IP address, browser and device type, pages requested, error reports and server logs. We use these to keep the Service working and secure, to limit abuse (for example rate limits per IP) and to fix bugs.

Usage analytics (only with your consent). If you accept analytics cookies, Google Analytics records the pages you visit, how you arrived (for example a search or a shared link), your device and browser type and approximate location (city or country, derived from your IP address), and Microsoft Clarity records how you interact with pages (clicks, scrolling, mouse movement) as anonymised session recordings and heatmaps, with typed text masked. We send page addresses without query strings, never your name or email, and turn off advertising features.

Data we do not collect. We do not collect government ID numbers, payment card data, precise GPS tracking or sensitive personal data (such as health, religion or political opinions), and we ask you not to include such data in your profile or bug reports.

• To provide the Service — create and secure your account, save and display your shelf, import your collection, compute distances in Radar and show collectors near you (performance of a contract, LGPD art. 7, V; GDPR art. 6(1)(b)).
• To keep the Service safe — prevent fraud, spam, automated sign-ups, multiple accounts and abuse, enforce our Terms and protect users (legitimate interests, LGPD art. 7, IX; GDPR art. 6(1)(f)).
• To improve the Service — fix bugs, understand which features are used and improve the game catalog, using aggregated or de-identified data where possible (legitimate interests).
• To communicate with you — account confirmation, password resets, security notices, important changes to the Service or these documents, and replies to the messages and reports you send us, in the app and by email (performance of a contract; legal obligation).
• To tell you what’s new — occasional emails about new features, your Mee coins, ways to contribute to the catalog and facts about your collection, at most one a week (legitimate interests, LGPD art. 7, IX; GDPR art. 6(1)(f)). They are on for account holders, and you can turn them off at any time in your profile (Mee → emails) or through the unsubscribe link in each one. Turning them off does not affect the account emails above.
• Optional features — device location and analytics cookies (Google Analytics, Microsoft Clarity) rely on your consent, which you can withdraw at any time (LGPD art. 7, I; GDPR art. 6(1)(a)). We do not send third-party advertising by email.
• Legal reasons — comply with laws, court orders and requests from authorities, and establish or defend legal claims (LGPD art. 7, II and VI; GDPR art. 6(1)(c) and (f)).

We do not use your personal data for automated decisions that produce legal or similarly significant effects on you, and we do not use it to train third-party AI models.

• Public room. Rooms are private by default. If you make your room public, anyone with the link — including people without a ShelfMee account — can see your display name, avatar, city and country and the games on your shelf (except games you hide).
• Radar. Other signed-in users looking for a game may see that you own it, together with your public profile, your city and an approximate distance and direction. Distances are computed from a randomized point inside an area of about 1 km around your approximate location, and very short distances are shown only as “less than 500 m”, so your address cannot be derived from them.
• Catalog contributions. Corrections you submit may be published in the shared game catalog without your name.

Anything you make public can be viewed, copied or shared by others, and we cannot control what they do with it. Please do not put information you want to keep private in your profile.

We do not sell or rent your personal data, and we do not share it for cross-context behavioral advertising. We share it only as follows:

• Service providers that process data on our behalf under contracts with confidentiality and security obligations: Lovable (application platform and hosting), Supabase (database, authentication and file storage), Cloudflare (DNS, content delivery, bot protection, security and storage), Mailgun (delivery of account and product emails), Google (sign-in, if you choose it, and Google Analytics, if you accept analytics cookies) and Microsoft (Clarity, if you accept analytics cookies).
• Address lookup services (OpenStreetMap Nominatim, ViaCEP and BrasilAPI), which receive a postal code or street name to validate it — never your name or email.
• Services you connect (BoardGameGeek, Ludopedia), to fetch your collection at your request. Their own privacy policies apply to your accounts there.
• Authorities and legal claims, when required by law or a valid order, or when necessary to protect the rights, safety or property of users, the public or ShelfMee.
• Business transfers — in a merger, acquisition or sale of assets, under this policy or one at least as protective, with notice to you.

Our providers may process data in countries other than yours, including the United States and countries of the European Union. When we transfer personal data internationally, we rely on safeguards recognized by applicable law, such as standard contractual clauses (LGPD art. 33; GDPR chapter V) and our providers’ security commitments.

• Account, profile and collection data: while your account is active.
• After you delete your account or ask us to: removed from our active systems within 30 days and from backups within a further 90 days.
• Security logs and technical data: for as long as needed for security, usually no more than 6 months, unless needed to investigate abuse.
• Catalog contributions: may be kept in the shared catalog without any link to you.
• Data we must keep to comply with the law or to establish or defend legal claims: for the period required — for example, access logs for 6 months under the Brazilian Civil Rights Framework for the Internet (Lei nº 12.965/2014, art. 15).

We use encryption in transit (HTTPS), access controls, row-level security in our database, server-only storage for connection tokens and private location data, rate limits and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security incident creates a relevant risk to you, we will notify you and the competent authorities as required by law.

Depending on where you live, you have the right to:

• confirm whether we process your data and access a copy of it;
• correct incomplete, inaccurate or outdated data;
• request anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• receive your data in a portable format;
• delete your account and the data processed based on your consent;
• know with whom we share your data;
• withdraw consent at any time and be told the consequences of not giving it;
• object to processing based on legitimate interests, such as product emails;
• lodge a complaint with a data protection authority.

To exercise any of these rights, email privacy@shelfmee.com from the address linked to your account. We may need to confirm your identity before acting. We answer within 15 days (LGPD) or within one month (GDPR), and we will not treat you differently for exercising your rights. You can also complain to the Brazilian data protection authority (ANPD) or to the authority where you live.

How to delete your account. Email privacy@shelfmee.com from the address linked to your account, with the subject “Delete my account”. Once we confirm the request is yours, we delete the account and everything tied to it — profile, shelf and collection, box customizations, photos and files you uploaded, and the Ludopedia or BGG connections — within the periods in section 7. Contributions already part of the catalog stay there, with no link to you and no credit with your name.

California residents. We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we do not use sensitive personal information to infer characteristics about you. You may exercise your rights to know, correct and delete by contacting us.

The Service is not directed to children under 13, and you must be at least 13 (or older if your country requires it) to create an account. If you are under 18, you may use the Service only with the consent of a parent or legal guardian. If we learn that we hold data of a child without the required consent, we will delete it. Parents or guardians can contact us at privacy@shelfmee.com.

Your browser keeps your sign-in session and a few temporary settings (for example, an import in progress) in local and session storage; these are strictly necessary for the Service to work. Our hosting platform (Lovable) also sets first-party cookies used to serve the right version of the site and to count visits in aggregate (pages viewed, referrer, device type and approximate country), which we use only to understand how the Service is used. A cookie named shelfmee-locale remembers the interface language you chose. On the sign-in page, Cloudflare Turnstile checks that you are not an automated bot; it processes technical signals from your browser for that purpose only.

Analytics cookies are optional and load only if you click “Accept” on our cookie notice: Google Analytics (cookies such as _ga, kept up to 14 months) and Microsoft Clarity (cookies such as _clck and _clsk, kept up to 1 year). If you click “Reject”, they are never loaded. You can change your choice at any time with “Cookie settings” at the bottom of this page; withdrawing removes those cookies. We do not use advertising cookies or sell this data. If we add other non-essential technologies, we will update this policy and ask for your consent first.

The Service links to and shows content from third parties such as BoardGameGeek and Ludopedia. We are not responsible for their privacy practices; please read their policies.

We may update this policy as the Service evolves. We will post the new version here with a new effective date and, for material changes, notify you in the Service or by email before they take effect.

Giovanni Fonseca Alves — privacy@shelfmee.com