Privacy Policy

Who is responsible

NightShelf is operated by [TO CONFIRM: legal entity name], [TO CONFIRM: registered address]. For any question about this policy or your data, contact support@nightshelf.pt.

What is collected

Account information you provide when you register:

• Your email address, used to identify your account and sign you in.
• Your display name, if you set one.
• Your password, stored only as a bcrypt hash. The original password is never written down and cannot be recovered from the hash.
• An avatar selection, chosen from a fixed set of built-in artwork.

Content you create by using the service:

• Your library: the titles you add, their status, your rating, your progress, and any notes attached to them.
• Custom lists you build and the order of items within them.
• Your queue, including when items were added, started or removed.
• Discovery feedback — which suggestions you swiped toward or away from, which is what makes later recommendations more relevant.
• Your display and discovery preferences.

Technical information generated automatically:

• Product usage events — for example that a suggestion card was shown, or that a deck ran out. These record what happened, not who you are: they hold only counters and positions.
• A daily count of discovery sessions, used to apply plan limits.
• Your IP address, held briefly in rate-limiting counters to stop automated abuse of sign-in and registration. These expire automatically and are not used to build a profile of you.

What is not collected

NightShelf does not use advertising trackers, does not sell or share your data with data brokers, does not build advertising profiles, and does not access your location, contacts, camera or microphone.

Why it is used

Your account details are processed to provide the service you signed up for. Your library, lists and queue exist because they are the product. Discovery feedback is used to rank future suggestions for you. Technical information is processed on the basis of legitimate interest in keeping the service working, secure and free from abuse.

Who it is shared with

NightShelf relies on a small number of processors. It does not sell your data to anyone.

• Vercel — application hosting and delivery.
• Supabase — the managed PostgreSQL database where your account and library are stored.

To show catalogue information such as cover art, descriptions and release dates, NightShelf queries TMDB (films and TV), Google Books (books) and Jikan/MyAnimeList (anime). These lookups are made by our servers, not by your browser or device. Your identity is never included in them — the providers receive a search term or a catalogue id and nothing that identifies you.

How long it is kept

Your account and everything in it is kept until you delete it. Deletion is immediate and permanent, not a scheduled or reversible soft delete.

Rate-limiting counters expire within hours. Product usage events are retained in anonymized form after account deletion — the link to your account is removed, leaving records that cannot be traced back to you — and are kept for [TO CONFIRM: retention period] for aggregate product analysis.

Your rights

You can export everything NightShelf holds about you at any time from Account → Your data, as JSON, or as CSV for your library alone. The export runs immediately and requires no request.

You can permanently delete your account from Account → Delete account. If you cannot sign in, see the account deletion page.

Depending on where you live you may also have the right to correct your data, object to processing, or complain to a supervisory authority — [TO CONFIRM: jurisdiction and authority].

Security

Traffic is served over HTTPS. Passwords are stored as bcrypt hashes. Sign-in and registration are rate limited. Access to your library is scoped to your account on every request.

No service can promise perfect security. If a breach affects your data, you will be notified as required by applicable law.

Children

NightShelf is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created an account, contact us and it will be removed.

Changes

If this policy changes materially, the date above will be updated and the change will be announced in the app before it takes effect.