Citrus Shelf privacy policy
The short version. You can use Citrus Shelf without an account. Your reading data stays on your phone unless you choose to sign in, which enables sync to our server. Margin photos and reading sounds stay on your phone. Book lookups send search words or barcode numbers to our server, and technical error reports go to Sentry. The app has no advertising and no behavioural analytics. The website uses Google Analytics to count visits; the app does not.
Who this covers
Citrus Shelf is developed and published by an individual developer, referred to here as "we" and "the developer". This policy explains what the app and the website collect, why, where it goes, and how to contact us. It covers the Citrus Shelf app and the Citrus Shelf website at shelf.citrustheory.com. The website section below is the only part that applies to the website.
What stays on your device
Your books, reading progress and dates, shelf artifacts, room settings, collections, notes and reading sessions are stored on your phone. You can add and manage them without signing in. Signed-out reading data is not uploaded for sync.
If you are a patron, the initials on your patron badge are kept only on the phone. They are not sent to our server and appear only on your shelf and in shelf images you choose to share.
When you sign in, the phone also keeps the email address and the sign-in method you used, so the app can show which account it is signed in to. It is kept in the phone's secure storage, is not sent to our API, and is removed when you sign out or delete your account.
Photos you add to your margins are stored only on the phone and are not uploaded to our API or synced. Reading sounds are bundled ambient audio played locally, not microphone recordings; they are not uploaded. If you deliberately share or export an image, the app or destination you choose receives that image under its own privacy practices.
What the app sends, and why
Optional accounts. You can sign in with Google, Apple, or a code sent to your email address. An email-code account stores your email address; a Google or Apple account stores the provider's account identifier and a display name when supplied. We assign an internal user ID and keep authentication records to maintain your session. Apple sign-in may also provide a token kept so its access can be revoked when you delete the account. We do not receive or store your Google or Apple password.
Email codes. When you request a sign-in code, your email address and the sign-in message are sent to Resend, our email processor, to deliver the code. We do not use these emails for marketing.
Sync. Only after you sign in, the app syncs books, ornaments (including
companion names), room settings, collections and their book membership, text notes,
reading sessions, completions and achievements to our API and database hosted by
DigitalOcean in Bengaluru, India (region
blr). These records are linked to your account's user ID so your devices
can read the same shelf. Photos are excluded. Requests are encrypted in
transit using HTTPS. Signing out stops account sync; it does not delete the server copy.
Book lookups. When you scan a barcode or type a search, the app sends the barcode number (an ISBN) or your search words to our own server so it can fetch the book's title, author, page count, and cover. Our server forwards that ISBN or search to two public book databases, Open Library and Google Books, and keeps a copy of the answer so the next person asking about the same book is served from our cache. The cache holds book information and lookup queries, not a reading history tied to you, your device, or your shelf.
Like any web request, a lookup carries your device's IP address. Our server uses it to limit requests, which protects the service from abuse, and in short-lived server logs used to diagnose problems. We do not build a profile from it.
Cover images. Cover pictures are served from our own storage rather than fetched directly from the book databases. Requesting one carries your IP address in the same way as any image on the web.
Crash reports. If the app crashes or hits an internal error, it sends a report to Sentry so we can fix the bug. Reporting is errors only: no performance tracing or session tracking. A report contains technical details such as a stack trace, app version, device model, operating system version, and navigation breadcrumbs. Sentry is configured not to send default personal information; we do not attach your account identity or shelf contents to reports. Sentry keeps reports for 90 days, then deletes them.
The patron purchase. The app offers one optional in-app purchase, a lifetime patron membership: a one-time payment that adds a patron badge to your shelf and includes any paid feature we add later. Payment is taken by Apple's App Store or Google Play under their own terms and privacy policies; we never see your card or billing details. After a purchase, the app sends the store's transaction identifier (Apple) or purchase token (Google) to our server, which asks the store to confirm it and keeps a record of the purchase, the store, the product, its date and whether it was refunded, linked to your account's user ID if you are signed in, so your membership follows you to your other devices and a restore works. That record is deleted with your account.
The camera
The barcode scanner uses your camera to read the number printed on the back of a book. The picture is processed on the device, in the moment, to find that number. No scanner photo or video is saved or uploaded. You can decline camera permission and enter books by search or by hand instead. Photos you choose to add to your margins remain local as described above.
The website
The Citrus Shelf website at shelf.citrustheory.com uses
Google Analytics
to count visits and see which pages and links are used, so we can tell whether the site
is working. When you visit, Google Analytics sets first-party cookies (named
_ga and _ga_ followed by an ID) and receives the pages you view,
the site that referred you, your browser and device type, and an approximate location
derived from your IP address. Google Analytics does not log or store IP addresses.
We do not use this for advertising, we do not add Google Ads or other tags, and we do not send Google Analytics any account identity, email address or shelf contents. Visit data is kept for two months. Google processes it under its own privacy policy.
You can refuse or delete these cookies in your browser settings, or install Google's Google Analytics opt-out browser add-on. The website works the same without them. The Citrus Shelf app does not use Google Analytics or any analytics service, and nothing you do in the app reaches it.
What we do not do
- No account required to use the local reading features.
- No behavioural analytics or cross-app tracking in the app.
- No advertising, and no advertising identifiers.
- No selling or renting your data, or supplying it to advertising brokers.
- No uploading margin photos, recording your microphone, or uploading reading sounds.
Who else handles data
DigitalOcean hosts our API, database and cover storage; Resend delivers sign-in codes; Google and Apple handle their respective sign-in methods and, through the App Store and Google Play, the patron purchase; Open Library and Google Books answer book lookups; Sentry processes error reports; and Google Analytics measures visits to the website. They receive the information needed for the purposes described above and have their own privacy policies. Our hosting, email, crash-reporting and website-analytics providers process data on our behalf. No data is used for advertising or cross-app tracking.
Children
The app is not directed at children under 13 and we do not knowingly collect personal information from them. Contact us if you believe a child has supplied personal information so we can investigate and remove it.
Your choices and your rights
You can remain signed out. To delete an account, open the You screen, choose Delete account, and confirm. This removes your account and synced reading data from our server, then signs you out and wipes the local app data and margin photos on that phone. Deletion needs a network connection; if it fails, the app tells you and you can retry. Copies you saved to Photos or shared elsewhere are outside the app and must be deleted there separately.
If you cannot use the app, request deletion of your Citrus Shelf account and associated data by emailing [email protected]. Tell us which sign-in method you used; we will verify ownership before removing data. Uninstalling the app or signing out does not delete your server account. Anonymous lookup caches and technical crash reports are not account records; crash reports expire after 90 days. Contact us to request earlier removal or ask about this policy, and we will act within 30 days. Depending on where you live, you may have rights to access, correct or delete personal data and complain to a data protection authority. We honour requests regardless of where you are.
Changes
If we change what the app collects, we will update this page and the date at the top before the change reaches the app.
Contact
Email [email protected].