Privacy Policy

Effective October 26, 2026

Devmo, LLC ("we", "us") operates Shelf & Shaker. This policy explains what we collect, why, who we share it with, and the choices you have. We don't sell your personal information and we don't show ads.

What we collect

• Account details: your email address, your name if you give it, and a securely hashed password. If you sign in with Google or Apple, we receive your name, email address and a verified-email flag from them; with Apple you can choose to hide your email.
• Your answers in the app: whether you've confirmed you're of legal drinking age, and whether you've installed the app or seen the tour.
• Bar data: your accounts and bars, the bottles and tools on your shelf, favourites, drinks you've made, your Up next list, shopping list, and parties (names, dates, who's coming, what they're bringing, drink orders).
• People you invite: the email address of anyone you invite as a host or guest, and the role and expiry you give them.
• Billing: Stripe collects and stores your card details; we never see the full card number. We keep the Stripe customer and subscription IDs, plan and billing status.
• Waitlist: if you join the waitlist, your email address and when you joined.
• Support: messages you send through the in-app help widget or by email, along with your email and name so we can answer.
• Technical data: IP address, browser and device type, and request logs our servers keep for security and troubleshooting; and error reports when something breaks, which are set not to include personal details.

How we use it

• To run the Service: sign you in, show your shelf and what you can make, share bars with the people you invite, and run parties.
• To bill subscriptions and send account emails (verification, password resets, invitations, billing notices).
• To keep the Service secure, prevent abuse, fix bugs and improve it.
• To follow the law, including showing alcohol content only to people who say they're of legal drinking age.

Where the law asks for a legal basis, ours is performing our contract with you, our legitimate interest in running a secure and working service, your consent where we ask for it, and legal obligations.

Who we share it with

Other people in your account see what their role allows: owners and hosts see the account's bars and members; guests see the bars they were invited to. Beyond that, we share data only with service providers who process it for us under contract:

• OVHcloud (United States): hosts our servers and database.
• Amazon Web Services (SES): sends our emails.
• Stripe: processes payments and subscriptions.
• Google and Apple: only if you choose to sign in with them.
• Cloudflare: DNS and storage for drink photos (no personal data).
• Sentry: error reports.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.

Cookies and analytics

We use only cookies the Service needs: a session cookie to keep you signed in and a security (CSRF) cookie. The installed app stores pages on your device so it works offline; signing out clears them. Our public marketing pages use Umami, a privacy-friendly analytics tool that doesn't use cookies or track you across sites. Pages inside the app have no analytics.

How long we keep it

We keep your account and bar data for as long as your account is open. If 90 days pass after an account's subscription or trial ends without it being renewed, we may delete its data. Guest access ends when it expires or is removed. When you delete your login or an account, its data is deleted from our database right away, along with the Stripe customer record. We keep only what the law requires for tax and accounting (such as the invoices Stripe holds), and backups roll off on their normal schedule.

Your choices and rights

• Change your email and password, or connect and disconnect Google and Apple, in Account settings.
• Delete your login from Me → Delete my login; an owner can delete a whole account from Hosts & guests. If you're an account's only owner, deleting your login deletes that account too.
• Ask us for a copy of your data or to correct it by writing to privacy@test.shelfandshaker.app. We'll answer within 30 days.
• Depending on where you live (for example California, or the EU and UK), you may have further rights, such as to object to or restrict processing, or to complain to your data protection authority. We honour these and won't treat you differently for using them.

Security

Data is encrypted in transit, each account's data is kept separate at the database level, and access to our systems is limited to the people who run the Service. No system is perfectly secure, but we work to protect yours and will tell you if a breach affects your data as the law requires.

Children

Shelf & Shaker isn't for anyone under 18, and we don't knowingly collect their data. If you believe a child has given us information, contact us and we'll delete it.

International users

We're based in the United States and store data there. If you use the Service from elsewhere, your information is transferred to and processed in the United States.

Changes

If we change this policy in a material way, we'll tell you by email or in the app before it takes effect. The date at the top shows when it last changed.

Contact

Devmo, LLC, Massachusetts, USA · privacy@test.shelfandshaker.app. See also our Terms of Service.