Privacy policy

Last updated: November 10, 2026

We want your notes to be yours alone. This policy explains what data we process, why, and what your rights are.

1. Data controller

Guillermo Rossello Puigros, tax ID (NIF) 18225397J, Doctor Esteva 49, 07550 Son Servera, Illes Balears, España. Contact: [email protected].

2. What data we process

• Account: your email address, your password (stored encrypted, never in plain text), your language and your regional format.
• Content: the notes, shelves, binders, tags and files you save, and the emails you send to your A SHELF address.
• Subscription: your plan and its status. Payment details (card, billing address) are handled by Paddle; we never see them.
• Technical data: server logs (IP address, date, errors), kept for a short time to keep the service secure.
• Browser extension: it only reads the open tab when you click its button, and it only saves to your account what you choose (the article, the selection or the link, plus its images if you have Pro). It doesn’t read your history or other tabs, and it doesn’t send anything to third parties.

3. Why, and on what legal basis

• Providing the service and managing your subscription: performance of the contract.
• Sending you necessary emails (confirming your account, resetting your password, service notices): performance of the contract.
• Protecting the service against abuse: legitimate interest.
• Meeting legal and tax obligations: legal obligation.

We don't advertise, we don't sell data, we don't build profiles and we don't use your content to train artificial intelligence.

4. Who we share it with

Only with the providers we need in order to run, who process the data on our behalf:

• Supabase: database and user accounts.
• Cloudflare: hosting for the website and for attachments (R2).
• Resend: sending emails and receiving notes by email.
• Paddle: collecting subscription payments, as authorized reseller. For payments, Paddle is responsible for its own data under its privacy policy.
• Remember The Milk: only if you link your account, to sync your reminders as tasks (the note title and the date).

Some of these providers may process data outside the European Economic Area. When they do, they use the safeguards required by the GDPR, such as the European Commission's standard contractual clauses.

5. How long

We keep your data for as long as you have an account. Notes you move to the trash are kept until you empty it. If you delete your account, we erase your content within 30 days, except for anything we must keep by law (for example, billing records).

6. Cookies and local storage

We don't use advertising or analytics cookies. The app stores what it needs to work in your browser: your session, your preferences and a copy of your notes so you can use them offline. After signing out, you can clear it from your browser.

7. Your rights

You can ask us to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format, by writing to [email protected]. If you think we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es) or the authority in your country.

8. Changes

If we make significant changes to this policy, we will let you know beforehand by email or in the app.