Privacy Policy

Shelf is the controller of the personal data described here. We process it in line with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data and, for visitors in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR). You can reach us about anything in this policy at legal@shelftools.org.

• Account data. When you create an account: your email address, an optional display name, and your password (stored only as a secure hash by our authentication provider; we never see it).
• Saved tools. The tools you save to your collection, linked to your account.
• Tool submissions. When you submit a tool: the details of the tool and the email address you give us, so we can follow up on the review.
• Newsletter. If you subscribe: your email address, the date, and where on the site you signed up.
• Usage data. We count how often each tool page is viewed. These counts are anonymous totals and are not linked to you.
• Technical data. Like any website, our hosting provider receives your IP address, browser type and the pages you request, and keeps short-lived server logs for security and debugging.

• To create and run your account, keep you signed in and show your saved tools — to provide the service you asked for (performance of a contract).
• To review tool submissions and contact you about them — at your request.
• To send the newsletter — with your consent, which you can withdraw at any time.
• To keep the site secure, prevent abuse and fix problems — our legitimate interest in running a safe service.
• To meet legal obligations, such as answering lawful requests from authorities.

We do not use your data for automated decision-making or profiling, and we do not sell or rent it to anyone.

We rely on a few service providers that process data on our behalf, under their own security and data-protection commitments:

• Supabase — database, authentication and file storage. Stores your account, saved tools, submissions and newsletter sign-ups, and sends account emails such as sign-up confirmations.
• Vercel — hosts the website and serves every page, which means it receives technical request data.
• Google — some tool logos are loaded from Google’s favicon service, so your browser contacts Google directly when it displays them, sharing your IP address and browser details with Google.

These providers may store or process data outside Morocco, including in the European Union and the United States. Where data leaves Morocco, we rely on the providers’ contractual safeguards, and on the authorisations or exemptions provided for by Law No. 09-08, to protect it.

• Account data and saved tools: for as long as your account exists. When you ask us to delete your account, we delete it within 30 days.
• Tool submissions: for as long as needed to review them and keep a record of the decision, then deleted or anonymised.
• Newsletter: until you unsubscribe.
• Server logs: kept by our hosting provider for a short period, typically days to a few weeks.

Under Law No. 09-08 you have the right to be informed, to access your data, to have it corrected or deleted, and to object to its processing for legitimate reasons. If the GDPR applies to you, you also have the rights to restrict processing, to data portability, and to withdraw consent at any time without affecting earlier processing.

To use any of these rights, email legal@shelftools.org from the address linked to your data. We answer within 30 days. If you are not satisfied, you may complain to Morocco’s data-protection authority, the CNDP (cndp.ma), or to the supervisory authority where you live.

We use only the cookies needed to keep you signed in. There are no advertising or analytics cookies. See the Cookie Policy for details.

Data is encrypted in transit (HTTPS), passwords are hashed, and access to the database is limited by row-level security rules so that you can only read and change your own account data. No system is perfectly secure, but we work to protect your data and will tell you without undue delay if a breach is likely to affect you.

Shelf is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the site changes. We will change the “last updated” date above and, for significant changes, let account holders know by email or on the site.