Privacy policy

Plain-language summary: we collect what's needed to run Shelfie and our other products, we never sell it, your private content stays private by design, and you can delete everything from inside the app.

1. Who we are and what this covers

Stackset Technologies Inc. ("Stackset", "we") is a software company incorporated in Ontario, Canada, based in Markham. This policy covers stackset.io, shelfie-app.ca, the Shelfie mobile app, and support channels. It is written to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec's Law 25, the GDPR and the CCPA.

2. Information we collect

You give us: an email address and username when you create an account; an optional display name, bio and avatar; the collections, posts, comments, messages and reviews you create; a beauty profile (skin type, concerns, goals, routine, ingredient preferences) if you choose to complete it; and anything you send to support.

Collected automatically: device type, OS and app version, crash reports, coarse usage events (for example, that a screen was opened), push notification tokens, and IP address in server logs. We do not collect precise location unless you turn on location personalisation, and we strip location metadata from photos you upload.

From third parties: if you sign in with Apple or Google we receive a verified identity token and, with your permission, your name and email. We receive no passwords and no contacts.

3. How we use it

To run the service: show your collections, deliver messages, send notifications you've opted into, and keep your account secure.
To personalise: your beauty profile and shelf drive recommendations inside the app. You can clear it at any time.
To improve: aggregated, de-identified usage and crash data help us fix bugs and prioritise features.
To communicate: transactional email (sign-in codes, security notices) and, only if you opt in, product news.

We do not sell personal information, and we do not use your content to train third-party AI models.

With service providers who process data on our behalf under contract (cloud hosting and database, object storage, push delivery, email delivery, crash reporting), all bound to use it only for our instructions. With other users, to the extent you choose: public collections and posts are visible to anyone; followers-only and private content is limited by the settings you pick. With authorities when legally required, and we will tell you unless prohibited.

5. Security

Client apps never hold database credentials; they reach data only through authenticated integration endpoints. Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Row-level security policies restrict every record to its owner. Internal systems require single sign-on with multi-factor authentication. See our security overview for the full architecture. No system is perfectly secure; if we learn of a breach affecting you, we will notify you and the Office of the Privacy Commissioner as the law requires.

6. Retention and deletion

We keep your data while your account is active. You can delete your account in the app (Menu → Account → Request account deletion) or by emailing privacy@stackset.io. Deletion removes your profile, content and messages from production within 7 days and from backups within 30 days. Aggregated statistics that cannot identify you may be retained. Server logs are kept for 90 days.

7. Your rights

You can access, correct, export and delete your personal information, withdraw consent, and object to certain processing. Most of this is available inside the app; for anything else, email privacy@stackset.io. We respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada or your local authority.

8. Children

Shelfie is for people aged 16 and over. We do not knowingly collect personal information from children under 13 (or the applicable age in your region). If you believe a child has created an account, contact us and we will delete it.

9. Where data lives

Production data is hosted in North America. Some providers may process data in other countries under contractual safeguards. By using our products you consent to this transfer, subject to applicable law.

10. Changes and contact

We will post changes here and, for material changes, notify you in the app or by email. Questions: privacy@stackset.io, or Stackset Technologies Inc., Markham, Ontario, Canada.