Privacy Policy

ShelvedUp (“ShelvedUp”, “we”, “us”) is a personal collection tracker for movies, TV box sets, music and books, provided by Boxed Up. You scan or look up the barcodes on things you own and ShelvedUp builds a catalogue of your collection. This policy explains what data we handle across the iOS app, the web app at shelvedupapp.com and the ShelvedUp browser extension, who we share it with, and how you can delete it. We do not use advertising or tracking SDKs, and we do not sell your personal information.

Information we collect

• Your account. The email address you sign up with, used to create and secure your account and to sync your collection across your devices. If you sign in with Google or Apple we receive the email address and account identifier those services share with us, and nothing else. Passwords are stored only in hashed form.
• Your collection. The items you add, the formats and editions you own, what you paid and when (if you choose to record it), and any ratings and reviews you write.
• Usage events. A small number of in-product events, such as “scan succeeded” or “search run”, tied to your account and stored in our own database. We use these to see which features work. They contain no device identifiers and are never shared with an analytics company.
• Technical. Standard app and server logs needed to operate and secure the service. Our abuse limits key on a one-way hash of your network address, which cannot be reversed to identify you.

What we do not collect

We do not collect your contacts, your precise location, or your advertising identifier, and the app contains no third-party advertising or analytics SDKs. We do not track you across other companies’ apps and websites. The browser extension does not collect your browsing history: see the section below for exactly what it reads.

Camera and barcode scanning

With your permission, the app uses your device camera to read a barcode you point it at. Barcode detection happens on your device. We do not record, upload, or store photos or video from the camera. Only the resulting barcode number is sent to our servers to identify the item.

The browser extension

The ShelvedUp extension for Chrome answers one question while you shop: is the disc, record or book on the page already on your shelf? Here is precisely what it does.

• Where it runs. Only on product pages of the retailers listed in the extension’s manifest (currently Amazon, eBay and Discogs). It has no access to any other website.
• What it reads. The product page’s structured data and product-details text, locally in your browser, to find the barcode (UPC, EAN or ISBN) of the item being sold and its category (film, music or book). Nothing else on the page is read, and the page is not modified other than to show the ShelvedUp card.
• What it sends. The barcode number and, if you are signed in, your session token, to our servers. We do not receive the page URL, the product title, the price, the seller, or anything about your browsing. If you click “Add to shelf”, the barcode is recorded as a holding on your account, exactly as if you had scanned it in the app.
• What it stores. Your sign-in session, in the extension’s own local storage on your computer, so you stay signed in. Nothing is stored about the pages you visit. Signing out removes the session.
• Signed out. The extension works without an account, in which case it can only say whether a barcode is in the shared catalogue. No session exists and nothing is recorded.

How we use your information

• To provide ShelvedUp: identifying items, syncing your collection across devices, warning you about duplicates and upgrades, showing estimated values, and displaying reviews.
• To operate and secure the service: authentication, abuse prevention, and debugging.

Reviews are visible to other users

ShelvedUp includes a community layer. If you write a rating or review, it is visible to other ShelvedUp users on that item’s page, shown without your email address or name. Please do not include personal information in a review that you would not want other people to read. You can edit or remove your review at any time, and deleting your account removes your reviews.

Service providers and third parties

We share the minimum data necessary with the services that run ShelvedUp for us or that we query to identify items:

• Supabase — hosting, database and authentication. Your account and collection are stored here.
• Vercel — hosts this website and the web app.
• Google and Apple — sign-in, only if you choose “Continue with Google” or “Continue with Apple”.
• TMDB — film and TV metadata and artwork. We send the title or barcode-derived product name, never your personal information. This product uses the TMDB API but is not endorsed or certified by TMDB.
• UPCitemdb — barcode-to-product lookup for discs we have not seen before. We send only the barcode number.
• MusicBrainz, Cover Art Archive and Apple (iTunes Search API) — music metadata and cover art. We send only the search text or barcode number.
• Open Library — book metadata and covers. We send only the ISBN or search text.
• DeepSeek — when a barcode is seen for the first time and our own parser cannot read the retail product title returned by the barcode lookup, that product title is sent to DeepSeek’s API to extract structured edition details (format, edition name, disc count). Only the product title is sent. No personal information is included, and nothing you write in the app is ever sent. DeepSeek is based in China and processes this request there.
• eBay — market-value estimates. We send only item and format details.

These providers process data on our behalf or as independent controllers under their own privacy policies. We do not sell or rent your personal information to anyone.

Estimated values

Value figures shown in ShelvedUp are rough estimates derived from third-party listing data and are provided for general information only. They are not appraisals, offers, or guarantees of resale price.

Data retention and deletion

We keep your account and collection data for as long as your account is active. You can permanently delete your account and all associated personal data at any time from inside the app: open the account menu, choose Delete account and confirm. This removes your account, your shelf, your usage events and your reviews. You may also email enquiries@boxedupapp.com to request deletion.

Anonymous catalogue records about editions themselves, that a particular barcode corresponds to a particular release, are not personal data and remain in the shared catalogue after deletion.

To remove the browser extension’s stored session, sign out from the extension or uninstall it from your browser’s extensions page.

Security

Data is encrypted in transit. Access is enforced at the database level so that you can only read and write your own collection, and passwords are stored only in hashed form.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can delete everything yourself in the app, or contact us and we will respond within a reasonable period.

Children’s privacy

ShelvedUp is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

International users

Our service providers operate in the United States, China, and elsewhere, so your information may be processed outside your country of residence.

Changes to this policy

We may update this policy as ShelvedUp evolves. Material changes will be reflected here with an updated date, and within the app.

Contact

Questions about privacy? Email enquiries@boxedupapp.com.