Privacy Policy

Who is responsible

NightShelf is operated by José Maria Teixeira de Queiroz, an individual based in Portugal, trading as Quiet Stack Labs. Quiet Stack Labs is a trading name rather than a registered company, so the data controller is the named individual. A postal address is available on request.

For any question about this policy or your data, contact support@nightshelf.pt.

What is collected

Account information you provide when you register:

• Your email address, used to identify your account and sign you in.
• Your display name, if you set one.
• Your password, stored only as a bcrypt hash. The original password is never written down and cannot be recovered from the hash.
• An avatar selection, chosen from a fixed set of built-in artwork.

Content you create by using the service:

• Your library: the titles you add, their status, your rating, your progress, and any notes attached to them.
• Custom lists you build and the order of items within them.
• Your queue, including when items were added, started or removed.
• Discovery feedback — which suggestions you swiped toward or away from, which is what makes later recommendations more relevant.
• Your display and discovery preferences.

Technical information generated automatically:

• Product usage events — for example that a suggestion card was shown, or that a deck ran out. These record what happened, not who you are: they hold only counters and positions.
• A daily count of discovery sessions, used to apply plan limits.
• Your IP address, held briefly in rate-limiting counters to stop automated abuse of sign-in and registration. These expire automatically and are not used to build a profile of you.

What is not collected

NightShelf does not use advertising trackers, does not sell or share your data with data brokers, does not build advertising profiles, and does not access your location, contacts, camera or microphone.

Why it is used

Your account details are processed to provide the service you signed up for. Your library, lists and queue exist because they are the product. Discovery feedback is used to rank future suggestions for you. Technical information is processed on the basis of legitimate interest in keeping the service working, secure and free from abuse.

Who it is shared with

NightShelf relies on a small number of processors. It does not sell your data to anyone.

• Vercel — application hosting and delivery.
• Supabase — the managed PostgreSQL database where your account and library are stored. The database is hosted in the European Union (Stockholm).
• Resend — delivery of the few emails NightShelf sends: password resets, email confirmation, and a notice when your password changes. Resend receives your email address and the contents of those messages. No marketing email is sent.
• Sentry — error reporting, so faults can be found and fixed. Reports are stored in the European Union. They are deliberately limited: they carry your account identifier but never your email address or name, no IP address, no cookies, and web addresses are stripped of anything after the path.

Some of these providers are established outside the European Union. Where that is the case, the transfer is governed by the data protection terms in their standard customer agreements.

To show catalogue information such as cover art, descriptions and release dates, NightShelf queries TMDB (films and TV), Google Books (books) and Jikan/MyAnimeList (anime). These lookups are made by our servers, not by your browser or device. Your identity is never included in them — the providers receive a search term or a catalogue id and nothing that identifies you.

How long it is kept

Your account and everything in it is kept until you delete it. Deletion is immediate and permanent, not a scheduled or reversible soft delete.

Rate-limiting counters expire within hours. Product usage events are retained in anonymized form after account deletion — the link to your account is removed, leaving records that cannot be traced back to you — and are kept for 180 days for aggregate product analysis, after which a nightly job deletes them.

Your rights

You can export everything NightShelf holds about you at any time from Account → Your data, as JSON, or as CSV for your library alone. The export runs immediately and requires no request.

You can permanently delete your account from Account → Delete account. If you cannot sign in, see the account deletion page.

You also have the right to correct your data, to object to processing, and to complain to a supervisory authority. NightShelf is operated from Portugal, so the relevant authority is the Comissão Nacional de Proteção de Dados (CNPD), cnpd.pt. If you live elsewhere in the EU or UK, you may instead complain to your own national authority.

Security

Traffic is served over HTTPS. Passwords are stored as bcrypt hashes. Sign-in and registration are rate limited. Access to your library is scoped to your account on every request.

No service can promise perfect security. If a breach affects your data, you will be notified as required by applicable law.

Children

NightShelf is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created an account, contact us and it will be removed.

Changes

If this policy changes materially, the date above will be updated and the change will be announced in the app before it takes effect.