PRIVACY NOTICE

Privacy & cookies

Last updated: 15 October 2026. This notice covers browsing, sign-in, reading, listening, reviews and the MuseShelf AI features.

Data controller: ΑΡΓΥΡΗΣ ΜΟΥΛΙΟΣ

Privacy contact: museshelf@gmail.com

Privacy settings, download and delete your data

Sign-in and your account

You can sign in with Google (including Gmail), Apple, Microsoft and Facebook when the provider is enabled. We receive the provider account identifier and, when available, name and email. Apple may supply a private relay email address. We never receive your password or request access to messages, contacts or posts. Email and name are held in the protected session for 12 hours, or 30 days if you choose “Remember me”. These details support authentication, review ownership and requested account features (GDPR Article 6(1)(b)). Signing in does not consent to analytics or public name display. Login uses the provider account identifier and does not require our own email code. In Account settings, you can connect another provider after a recent sign-in and authentication with the new provider. We do not link accounts solely because emails match. Connecting a provider does not renew free books, and existing duplicate accounts are not automatically merged.

Optional mailbox verification is separate from login and does not connect providers. The service uses its configured email provider to deliver verification codes. The recipient address and code are supplied to that provider solely to deliver the message. The database stores only a protected hash of the code, which expires within 10 minutes and can be used once. Temporary attempt data and send counters are cleaned up one day after expiry on the next optional mailbox-verification start.

For Facebook Login, we request only public_profile and email and use the app-scoped user identifier, name and email when supplied. We do not request a friends list, birthday, profile photo or permission to publish. Facebook Login does not enable Meta Pixel or advertising tracking, and we do not send your reading history, listening history or favorites to Meta for sign-in.

Connected provider identifiers map to the same MuseShelf account and remain while the account exists. Temporary provider-link records contain the account identifier, a binding to the current session and identity details returned by the provider. They are valid for up to 10 minutes, consumed on successful linking, and expired records are cleaned up on subsequent provider-link attempts. These records do not store passwords or provider tokens.

Access and subscription management

New accounts receive the global free-book allowance in effect when access is first initialized, for 30 days from registration. An administrator may apply a new allowance to existing accounts without removing already-selected books or changing expiry. When a signup campaign is configured, eligible accounts receive a monthly offer with a specific price and successful-payment count. The offer is displayed before checkout; its saved regular price resumes after those payments. Signing in again does not restart free access or the offer. Changing the campaign preserves already-granted offers.

Separately from optional analytics, we store the name and email supplied by the sign-in provider, account identifier and creation time, the free-book allowance and selections, free-access expiry and, where a subscription exists, its plan, status, paid-period expiry and next renewal. These records support requested access features and account support (Article 6(1)(b)). Refusing or withdrawing analytics consent does not remove these essential records or prevent access management.

Authorised account administrators can view necessary records, increase the free-book allowance and extend free access. We record the administrator, time, reason and previous/new values to document access changes. These records are not reading or listening histories. Access records and changes are kept while the account exists and removed with it from the active database. Historical backups follow the separate retention policy below.

When a personal subscription offer is granted, we store its reduced monthly price, the number of successful payments it covers, remaining payments and active status. Mock invoice records and related changes support correct application of the offer, are included in account data downloads and are removed with the account from the active database.

The current payment flow is a demo: no money is collected and no card details are requested. We store mock checkout choices and event receipts. Before a real payment provider is enabled, the notice will be updated with the provider, data, transfers and financial-record retention details.

Reading, listening and preferences

When signed in and reading or listening, we save your latest page or listening position, book, audio language and chapter, and update time so you can resume. These are not measurements of total time spent or every page visited. Positions are private account service bookmarks. You can disable saving and resuming, or delete all positions in Privacy settings. Your optional native-language preference is saved when you choose it and can be cleared from the same selector.

These requested account features are provided as part of the service (Article 6(1)(b)), separately from optional use for analytics.

Optional individual usage analytics

Individual account analytics and Google Analytics have separate choices. Providers without an email do not support email-based individual analytics.

By default, including for existing accounts, your data is excluded from the individual analytics dashboard. Separate optional consent at sign-in or in Privacy settings allows your account email supplied by the sign-in provider to be stored and linked to your MuseShelf ID, sign-in provider identifier, books, pages, listening positions and update times in the private administrator dashboard, to identify readers and understand library use. Email is not public and is not used for marketing. The legal basis is consent (Article 6(1)(a)). Declining does not affect reading, listening, saved positions or reviews. Analytics activity is stored separately only after consent; earlier private bookmarks are not imported. Withdrawal deletes the stored analytics email and activity and stops dashboard disclosure; private service bookmarks remain until you delete them.

Google Analytics

When configured by the operator, Google Analytics 4 loads only after acceptance in Cookie settings. Before acceptance or after rejection, we do not load the tag or send measurements. The lawful basis is consent (GDPR Article 6(1)(a)). Google receives technical connection data, including IP address, browser/device information and visit events. We do not send email, account identifiers, book titles, full URLs or search parameters. Google Signals and advertising personalization are disabled. Automatic enhanced measurement must be disabled in the GA4 property.

The _ga and _ga_* cookies identify the browser and session for statistics. We set a lifetime of up to 180 days without renewal on every visit. The necessary museshelf_ga_consent_v1 cookie remembers acceptance or rejection for 180 days. Change your choice using Cookie settings at the bottom of the page. Rejection stops measurement and removes Google Analytics cookies from this browser; it does not erase data already sent to Google. It does not affect sign-in or library use. Analytics service retention is separate from cookie lifetime and is configured by the operator in GA4. Google's processing and international transfers are governed by the applicable terms and the operator's published transfer safeguards. Google privacy · Google Analytics data processing terms.

Cookies and device storage

museshelf_oauth is a necessary encrypted cookie binding the sign-in request to the return from Apple, Microsoft and Facebook. It lasts up to 10 minutes and is cleared on return. It is HttpOnly and Secure, with SameSite=Lax or SameSite=None for Apple's return. Temporary provider tokens are used only for identity verification and are not stored.

The necessary museshelf_provider_link cookie binds completion of provider linking to the same session. It holds a temporary random identifier, is HttpOnly, Secure and SameSite=Lax, lasts up to 10 minutes and is removed after successful completion. museshelf_email_verification binds optional mailbox verification to the session, is HttpOnly and SameSite=Lax, Secure over HTTPS, and lasts up to 10 minutes. It is removed after successful verification.

The necessary museshelf_locale cookie remembers your chosen language for 180 days.

This storage supports sign-in or preferences you request. Optional Google Analytics starts only after separate cookie consent, when configured by the operator. We do not install advertising trackers. Browsing the library does not require blanket consent. You can clear stored items in your browser settings; removing the session cookie signs you out.

Providers, external links and AI

When you open the sign-in dialog, resources load from accounts.google.com and ssl.gstatic.com. Google's sign-in service may store a g_state status cookie on MuseShelf and cookies on Google's domain. They do not load simply from visiting the library. You can remove them in your browser's site-data settings; Google determines retention of its cookies.

Google Cloud provides hosting, the database and book/audio storage. Access involves technical data such as IP addresses and HTTP request details. Authorised operators may access data for operation, support, security and handling your requests. Necessary technical logs serve secure, reliable operation (Article 6(1)(f), legitimate interest in security). Fonts are served by MuseShelf rather than loaded from Google Fonts.

Google's sign-in script loads only when you open the sign-in dialog. Google also processes data for its own sign-in service under its privacy policy. Google Translate opens only through your action and receives the selected text and translation languages. Google privacy.

Administrator writing, translation and corrective review send instructions and the relevant manuscript to the Anthropic Claude API. Audiobook production sends the selected text to the Google Gemini API. Reader reviews and private activity history are not inputs to these features. Operators must have the necessary rights and lawful basis before submitting third-party personal data, and should avoid sensitive data. An operator's agreement does not replace another person's consent.

Choosing a third-party provider takes you to its sign-in page, where it receives technical request data. Cookies and processing within Apple, Microsoft and Meta services are also governed by their privacy policies. Apple · Microsoft · Meta.

Transfers and retention

MuseShelf's frontend, backend, database and book storage are hosted in Google Cloud's europe-west1 region in Belgium. Automated database backups are stored in the EU multi-region. Application and audit logs are stored in Cloud Logging buckets currently located in us-west3, United States. We will update this notice if these storage arrangements change. Google and its subprocessors may process personal data outside the European Economic Area. Google Cloud's applicable transfer mechanisms include the EU-US Data Privacy Framework for covered transfers to the United States and Standard Contractual Clauses where applicable, as described in the Cloud Data Processing Addendum. Google Sign-In, Microsoft sign-in and Facebook Login are external authentication services. When you choose a provider, it receives technical connection and authentication-request data and returns your account identifier and, when available, name and email to MuseShelf. These services are governed separately by Google's Privacy Policy, Microsoft's Privacy Statement and Meta's Privacy Policy. Their processing may take place outside the European Economic Area under the transfer arrangements described in their respective policies. MuseShelf's Google Cloud hosting region does not determine where these providers process authentication data. Where Gmail is used to deliver optional email-verification codes, Google also processes the recipient address and message content to deliver the email. Other external services used for AI features, analytics or translation are described separately in the Providers and Google Analytics sections of this privacy notice. Their processing locations are not determined solely by MuseShelf's hosting region. Information about the applicable transfer safeguards and how to obtain copies is available from our privacy contact.

In the active database, account data, preferences and positions remain while the account exists or until you delete them. Reviews and their records are removed when the review or account is deleted. Analytics choice evidence remains while the account exists. Operator-managed books follow their publication lifecycle and are not deleted with a reader account.

Logs: Application logs in the Google Cloud Logging _Default bucket are retained for 30 days. Mandatory audit logs in the _Required bucket are retained for 400 days.

Analytics data remains only while your choice is in effect and your account exists. Every quarter we review whether stored data is still needed, particularly for inactive accounts and old private reviews. If the service closes, reader data is removed from the active database unless specific lawful retention is required, which will be explained to you. Minimal choice evidence documents processing while the related item or account exists.

Backups: Cloud SQL retains the 7 most recent automated backups and 7 days of transaction logs for point-in-time recovery. Backups are stored in the EU multi-region.

Deleting from the active database does not automatically erase backups or provider logs. The operator must reconcile deletions and withdrawals before restoring backups to active use. Google and Anthropic retention is also governed by the relevant service agreements and policies. Google Cloud data terms · Anthropic API retention.

Minors and automated decisions

Accounts are available only to people aged 15 or older. Before sign-in, we request an age declaration without collecting birth dates. We record its time, language, version and text. This is self-declaration rather than age verification. Under-15 accounts and a parental-consent workflow are not offered. Age requirements in other countries may differ.

The application does not make solely automated decisions with legal or similarly significant effects on readers. AI book and audio production are content features.

Ratings and reviews

What we store and why

We store your rating, comment, the relevant book, creation and update dates, and a link to your account. This enables one review per account and book and lets you edit or delete it. Your account is identified using the identifier your sign-in provider supplies when you sign in.

What other people can see

Your rating, comment and date are public. By default, the display label is “Reader”. Your email and sign-in provider account identifier are not published. The “Reader” label does not remove the internal link between your review and your account.

Avoid personal information about yourself or others in your comment. Public content may be copied or indexed by third parties; deleting it from MuseShelf does not remove copies already made elsewhere.

Your choices

Before each new publication or update, we ask you to explicitly choose to publish your rating and comment. Publishing a new or updated review relies on the recorded choice in the form (Article 6(1)(a), consent). Public display of your account name relies on separate, optional consent. You can publish a review without a name. Consent to display a name is not required to use the library.

Older reviews without a recorded publication choice are kept privately, excluded from public lists and public rating averages. Their authors can confirm publication by updating the review, or delete it. Old names without recorded optional name consent are removed. We do not assign consent retrospectively.

Withdrawal, editing and deletion

Sign in with the same account and open the book page. “Hide name” withdraws consent and immediately removes the name from the review on MuseShelf, keeping the rating and comment. You do not need to rewrite the comment. You can also uncheck name consent and update the review. “Delete” removes the entire review and its rating from the average.

Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

Choice records and retention

We record the time, language, version and exact text of the publication choice. For name consent, we also record the name you chose to display and any withdrawals. These records are private and document your choices. We do not add IP or device tracking for this purpose.

The review and related records are retained while the review is stored. Deleting the review, account or book from the active database also deletes the related consent records. Deletion from the active database does not automatically erase historical backups.

Account and Facebook Login data deletion

  1. Sign in to MuseShelf with Facebook or another provider already connected to the same account.
  2. Open Privacy settings.
  3. Under “Your data”, select “Delete my MuseShelf account”, then “Confirm deletion”.

Confirmation removes the reader account, all connected provider identifiers (including the Facebook ID), stored account details, reading and listening positions, favorites, preferences, reviews, choice records and associated access records from the active database, and signs you out. Deletion covers the entire MuseShelf account, including accounts with multiple providers. It does not delete your Facebook, Google or Microsoft account. Temporary mailbox-verification records follow the short cleanup period described above. Backups and logs follow the retention periods and limits described above.

If you cannot sign in, need deletion of data from a particular provider, or hold an operator account, send a request to museshelf@gmail.com. Include the account email and sign-in provider. Identity verification may be required; do not send passwords or verification codes.

Removing MuseShelf from Facebook’s “Apps and websites” revokes provider access but does not automatically perform the MuseShelf deletion above. To delete data, use the steps or contact address in this section.

Access and rights

The service is hosted on Google Cloud. Administrators responsible for operating it may access stored records. The public part of the review is accessible to all visitors.

Requests to the controller are normally answered within one month, subject to legal exceptions and appropriate identity checks. Depending on the circumstances, you have rights of access, rectification, erasure, restriction, objection and portability, as well as withdrawal of consent. You can directly hide your name and delete your review from the review form.

For other requests or if you can no longer access your account, contact museshelf@gmail.com.

You may lodge a complaint with the Hellenic Data Protection Authority or your local competent supervisory authority.

← Back to the library