OctaShelf

Privacy

Last updated [date]

OctaShelf works entirely on your device unless you turn on sync. If you never pair a device, we hold no data about you at all — not an account, not a record, not a log line.

If you do turn on sync, the honest summary is this: we can read your documents. Your PDFs and the names you give things are stored so that we can serve them back to your other devices, and they are not encrypted in a way that locks us out. The rest of this page is the detail behind both of those sentences.

[DECIDE: the controller.] LGPD requires the controlador to be named, with a legal identity. This is the pessoa física / ME decision in docs/going-live-brazil.md §8, which is still open. Fill in the name, the tax id and the address before publishing.

If you never turn on sync

Nothing leaves your device. The app has exactly one place in its code that can make a network request, and it is unreachable until you have paired the device to a library. There is no analytics, no crash reporting, no usage measurement and no automatic update check. Your documents, their titles, your tags and everything else live in a database and a folder on your own storage.

This is not a setting we ask you to trust us about — it is how the app is built. A never-paired device has no library on our servers, so there is nothing for us to hold.

If you turn on sync

Pairing creates a library: a space on our servers identified by a random id, which your devices authenticate to with a credential stored in your device's keychain. There is no email address, no password and no account. We never ask for your name.

What we store

Your documents. The PDF files themselves, stored as you gave them to us.
The information you add to them. Document titles, file names, tags, collections, document types, the names of properties and the values you put in them, notes on versions and on collection entries, and the text of any saved search.
Which app you annotated in. When a document comes back changed, the version record notes the editor it came from.
A name for each paired device. By default this is your device's own name as your operating system reports it — which on many phones includes your first name. You can change it when you pair, and rename it afterwards.
A per-device identifier that the app generates at random. It is not your advertising id, your hardware serial or any device fingerprint, and it changes if you clear the app's data.
Whether the library has a subscription, and how many bytes it is storing.

What never leaves your device, even with sync on

The page you are on in a document, and your reading history.
Which external apps you open documents in, and what the app has learned about how each one behaves.
Your search index and sort order.
The files on your device, and which documents you have chosen to keep offline.
Your thumbnails — your other devices draw their own rather than fetching yours.
Older versions of a document. Only the current version of each document is uploaded; previous versions stay on the device that made them.

What we do not collect

No analytics. No crash reports. No usage telemetry. No advertising identifier, no device fingerprint, no contact list, no location. The app asks your device for no permissions at all at runtime. The document scanner and the QR scanner run inside Google Play services rather than inside OctaShelf, which is why the app never needs access to your camera.

Our servers do not store your IP address, and there is deliberately no record of when a device last read your library.

Can you read my documents?

Yes, technically we can. Your files are encrypted in transit and encrypted at rest by our hosting provider, but they are not end-to-end encrypted: we hold the keys, so we are capable of reading them. We chose that deliberately rather than by accident, because features that need the server to understand your library — viewing a document in a browser, searching it there, and categorizing imports automatically — are impossible otherwise.

What we do with that capability: nothing, beyond storing and serving your files back to your own devices, and what is needed to keep the service running or to comply with a legal obligation. We do not read your documents for any other purpose, we do not use them to train anything, and we do not sell or share them.

If that trade-off is not one you want to make, the app is fully usable with sync turned off, and your files remain ordinary PDFs in a folder on your device.

Who else is involved

Cloudflare stores your files and your library and serves every request. Cloudflare's own platform logs retain request metadata — including IP addresses — as part of operating the network, under their terms, independently of what our code stores.
Google Play services provides the document scanner and the QR code scanner on Android. These run in Google's process, not ours; we receive only the finished scan.
Google Play, if you subscribe through the app, processes the payment. We never see your card details.

This page itself loads no fonts, scripts, analytics or images from anyone else. Visiting it tells nobody but Cloudflare that you did.

Why we are allowed to process this

[DECIDE: the legal basis.] LGPD requires a stated basis per purpose. The likely answer is performance of a contract (art. 7, II) for storing and syncing what you ask us to, and legitimate interest (art. 7, IX) for keeping the service secure and working — but say it explicitly, and name the basis for each purpose rather than listing both at the bottom.

Deleting it

Any paired device can delete the library from our servers. That removes your files, the record of your devices and every credential for the library, including the recovery code — after which no device can reach it again. Your devices keep their own copies; they simply report themselves no longer paired.

Three honest caveats, because "deleted" should mean what it says:

Deleting a single document frees its storage after a delay of at least seven days, which exists so that a mistake can be noticed before the bytes are gone.
The record that a document was deleted persists in your library's change history until that history is next compacted, so that your other devices learn about the deletion.
Our hosting provider's operational logs are outside our control and expire on their schedule.

[DECIDE: retention.] How long an unused library is kept before it may be removed, and how long operational records are kept. Today there is no automatic removal of an abandoned library at all — reclaiming one is a manual decision — so either say that plainly or commit to a window and build it.

Your rights

Under LGPD you can ask us to confirm what we hold, to give you a copy, to correct it, to delete it, or to explain what we do with it. Most of that you can do yourself from the app without asking. For anything else, write to us.

[DECIDE: the contact address, and how fast you answer.] Use a role address on this domain rather than a personal mailbox — Cloudflare Email Routing forwards one for free. LGPD expects a response without undue delay; name a number you can actually meet.

Children

OctaShelf is not directed at children, and we do not knowingly collect anything from them.

Changes

If this policy changes in a way that affects what we collect or what we do with it, we will say so in the app rather than only here.