What Shelf-Lives knows about you

Shelf-Lives keeps your email address, the name you chose, and the games you put on your shelf. It never sees your card details, and nothing about you is sold or handed to an advertiser. The pages you can read without signing in, the Almanac’s game guides among them, count their visitors, anonymously and without a cookie, and inside the room we count which of its objects get used the same anonymous way. What is never counted is which individual games you look at: that stays yours. If you want all of it gone, there is a page for that, linked at the foot of this one.

That counter is new, on 20 September 2026, and this page used to promise it would never exist. It is described in full further down, under “The one script here that is not ours”.

Your email address, stored in lower case, and the name you type.

If you join with a password, we never store the password. We store an argon2id hash of it, which is a one-way scramble. Nobody can read your password back out of it: not us, and not somebody who steals the whole database.

If you sign in with Google or Facebook instead, we store which provider it was and the stable id that provider uses for you. We never store the tokens the provider hands over during sign-in. There is no column for them. We keep the email address the provider showed us at the moment you linked the account, as a note about how the link was made; it is not kept in step with the provider afterwards, and we cannot use it to reach back into your Google or Facebook account for anything.

A session is a long random token. Your browser holds the only usable copy; what we store is a SHA-256 hash of it. Password reset links work the same way: the link in the mail carries the only usable token, the database holds a hash that can be spent once, and it expires.

A job runs once a day and deletes expired sessions and expired reset tokens. It is housekeeping rather than a safety net. Both were already refused at the door the moment they expired; this just stops dead rows piling up.

• The session cookie, so the game knows you are you. HttpOnly, SameSite=Lax, and marked Secure whenever the site is served over https.
• A small cookie remembering whether you asked for the phone layout or the desktop one, so the choice sticks for the visit.
• During a Google or Facebook sign-in, a ten-minute cookie that exists only to check that the sign-in coming back is the one you started. It is gone when the handshake finishes.

There is no fourth cookie. None of them are for advertising or measurement, and none of them belong to anybody but us. The page counter below does not add one either. It sets no cookie, ours or anybody else’s, and it puts nothing in your browser’s storage. That was checked in the shipped code, not taken on trust, and a test holds it there.

• Your shelf: one per account, and when it was made.
• Your collection: which games from the catalogue you own, how each one arrived, whether you have started or finished it, and when.
• Your Ghost Boxes: the games you are tracking toward owning, and how far each one has got.
• Your honors: which achievements you have been awarded, when, and whether you have seen them yet. Earned stays earned. There is no code that takes one back.
• Your trading cards: which cards you have put in your collection or on your wishlist in the binders, the set each belongs to, and when. Take a card out and the record goes with it.
• Your game ratings: the stars (1 to 5) you give games in the catalogue, and when. Other players only ever see the average across everyone, never who gave which stars. Clear a rating and the record goes with it.
• Which consoles you collect for: when you choose a console from the picker, or add one later, we remember that choice so your shelf shows the right libraries. Change your mind and it changes with you.
• Your feedback: if you rate a Ghost Box that has just become real, or type something in the box under it, we keep the rating and your words exactly as written.
• A small funnel record each time you add a game to your shelf or a Ghost Box changes state, and one when your account is made.

That last one deserves to be specific, because most sites cannot afford to be. A funnel record holds the kind of event, the game or Ghost Box it was about, the state it moved from and the state it moved to, a trace id we use when chasing a bug, and the time. The one made with your account holds a single extra word: whether you came in from a page of The Almanac or from anywhere else. Not which page, not which game, not the address you came from. It holds no IP address and no user agent. Not redacted, not truncated: there is no column for either one.

Anything you post in the community channel is kept as you wrote it, next to the name you were using at the moment you posted. Change your name later and the old lines keep the old name, because a transcript that rewrote itself would not be a transcript. Please post accordingly.

The channel also keeps one small presence row per person: the name you go by and when you were last seen there, so the room can show who is around.

The name you claim is held once, community-wide, so that two people cannot answer to the same one. It is the name other players see. Your email address is never shown to another player anywhere in the game.

Payments happen at Ko-fi, not here. We never see your card, and there is nowhere in this database that a card number could go.

When Ko-fi tells us a payment happened, we write a receipt holding four things: Ko-fi’s transaction id, when it arrived, what kind of payment Ko-fi called it, and what we decided to do about it, as a single word from a fixed list. No amount. No payer name. None of the payer’s words. If you typed a lovely message with your coffee, it stayed at Ko-fi; we never stored it.

If the payment named an email address that no account here was using yet, we hold that address on its own so the shirt is waiting when you do sign up. It waits 180 days and is then swept away. Your account itself records only that you are a supporter, when the grant was made, which channel it came through, and the note whoever granted it typed.

When you sign in, sign up or ask for a new password, we read your IP address to count attempts, so nobody can sit there guessing at other people’s accounts. That count lives in memory for fifteen minutes to an hour and then it is gone. It is never written to the database and never written to a log.

We also read your browser’s user agent string once per page, to decide whether to draw the phone layout or the desktop one. That answer is used and discarded. It is not stored either.

What we cannot speak for is the machinery underneath us: our host keeps its own request logs, the way every host does, and those will contain addresses. We do not read them for anything but a broken deploy, and nothing there is joined up with your account.

On 20 September 2026 the five public pages started running Vercel Web Analytics. Until that day this page promised, in bold, that nothing of the kind would ever run here. That promise is broken. It was a deliberate decision rather than an accident, and the honest thing is to say so in the first sentence instead of leaving you to find it.

Where it runs. On the pages anybody can read without signing in (the front page, What is Shelf-Lives, these three house-rules pages, and The Almanac, the public game guides), and inside the room, where it counts which of the room’s own objects people reach. Everywhere else behind the door it still reports nothing: not your shelf, not your collection, not the catalogue, not the magazine, not the channel. The room is the one place behind the door that is measured, added on 30 September 2026 for a single reason: to learn which parts of the room people actually use, so the room can be made better.

What the room sends, and what it never sends. The room reports the name of a thing you used, as a plain label: that the honors table was opened, that a game was added to a shelf, that a new console was activated. At most it attaches a low-detail note, like which console shelf you were browsing. It never sends the title of a game, or any id that could name one. So we can see that the wishlist is popular; we can never see which games are in yours. The list of what you looked at stays yours, which is the whole reason the room was kept out of this until now.

The trading card binders.Opening a binder reports which set it is, by its public name (“Base Set”, “30th Celebration”) and series, so we can see which sets people collect. It never reports which cards you look at or pick up.

The Almanac’s join links.Pressing a “Join free” link on an Almanac page (the stars, the shelf buttons, the one in the header, the calendar’s, the guides’) reports that one was pressed and which kind it was, added on 13 October 2026 so we can see whether the guides lead anybody to the door. It says nothing about who pressed it.

What it writes down,once per page view, taken from Vercel’s own published list rather than guessed at: the time; the address you are on and the route shape behind it; the page that sent you; whatever survives Vercel’s filter of the query string; a location no finer than country, region and city; your operating system and its version; your browser and its version; whether you are on a phone, a tablet or a desktop; and the version number of the script itself. That is the whole list. There is no recording of your screen, no map of where you moved the mouse, and no test splitting you into group A or group B.

How you are counted, since it is not a cookie. Vercel counts a visitor by hashing the request your browser makes. Your IP address goes into that hash rather than into a record: Vercel states that it stores no IP address against a data point, that the hash is thrown away after 24 hours, and that it cannot be used to recognise you on anybody else’s site. We never see it. There is no column in this database it could be written to, and nothing in the counter is joined to your account.

What we get out of it is a number. How many people reached the front page, how many read the page that explains what this is, and roughly where they came from. We cannot pick you out of it, because what comes back is counts of pages rather than rows about people. It was added for one reason, which is that we had no idea whether anybody was finding the door.

With JavaScript switched off, none of this happens at all. The counter is not in the page we send you; it is fetched afterwards by script, if your browser runs script. These pages are built to work whole without it, so a reader with script disabled gets every word of them and is never counted.

• No advertising or ad-profile tracking. There is no Google Analytics, no pixel, no ad tag, no session recorder, no heatmap, no A/B service. Vercel’s script is the one piece of somebody else’s code that runs here; it runs on the public pages and in the room, and nowhere else behind the door. A test in our own build fails if a second vendor appears, if it spreads to any other address behind the door, or if it ever starts setting a cookie.
• No advertising profile. Nothing about you is sold, rented or traded, and nothing goes to an advertiser. There is no arrangement with anybody that would let that happen. The page counts above go to Vercel, who host the site, and they are counts of pages rather than facts about a person.
• No payment details. No card, no bank account, no billing address, no amounts.
• No contacts, no photos, no location. We never ask, so we never have them.

A few durable event rows sit behind the scenes so that work which was started always finishes, even if the server falls over halfway. Each one names the kind of event, an internal id for the account it concerned, and when. There are no names in them and no content.

Being exact, because this is the sort of detail a policy usually glosses: these rows are not attached to your account in the database, so deleting the account does not carry them off with it. What is left points at ids that no longer exist. The deletion page lists this with the rest of what stays behind.

• Vercel runs the site, stores the box art, and since 20 September 2026 counts page views on the five public pages.
• Neon holds the database, in the United States (US East).
• Ko-fi handles payments, and holds everything about them that we deliberately do not.
• Google and Facebook are involved only if you choose to sign in with one of them, and only for as long as that sign-in takes.

There is one more thing we should say rather than leave you to discover: the product has no mail service connected yet. Mail we would send, such as a password reset, is written to our own logs instead of being delivered. That is a gap we are closing, and until it is closed, the lost-key path will not reach you.

If you are reading this from outside the United States, note that using Shelf-Lives means your data is stored there.

Your account and everything on your shelf stay until you delete them. Expired sessions and reset tokens are swept daily. An unclaimed supporter grant expires after 180 days. Everything else lasts as long as the account does, which is another way of saying that the length of time is yours to decide.

You can ask for a copy of your Shelf-Lives data, and you can ask for the whole account to be deleted. The deletion page says exactly what goes, exactly what stays behind and why, and how to ask.

The date at the top is the date this page last changed. If we ever start collecting something new, this page changes in the same commit that collects it. That is a rule we hold ourselves to in the build, not a promise we are making in prose.

That is what happened on 20 September 2026. The page counter and every sentence on this page that had to change because of it went in together, in one commit, so there was never a day when the product and this page disagreed.

We have not published a contact address yet. That is a gap we know about and it is being fixed; until it is here, this page cannot tell you where to write, and we would rather say so than print an address that goes nowhere.