StudShelf Privacy Policy
Last updated: August 6, 2026
About StudShelf
StudShelf is the developer and public entity responsible for the StudShelf app. StudShelf helps people track building-set collections and build activity. This policy describes StudShelf's current privacy practices for the app, website, public API, support, backups, and shareable images.
StudShelf is local-first. It currently has no user accounts, login, cloud synchronization, or remote StudShelf collection database. Some information still leaves the device when you use live Search, view remote set images, open the website, contact support, or share a file.
Information Stored Locally
StudShelf stores collection information locally on your device, including:
- saved sets;
- Wishlist, Owned, Building, Completed, and Archived statuses;
- progress;
- build sessions and elapsed time;
- ratings and reviews;
- saved-set notes and session notes;
- hidden-effort information;
- recap-related local history; and
- onboarding choices and local preferences.
StudShelf does not automatically upload this local library information. It remains on your device until you edit or remove it, clear the app's data, restore another collection, or uninstall the app in a way that removes local data. Because StudShelf has no account or cloud collection database, it cannot recover a local library that was removed without a backup you kept.
Live Search and Catalog Services
When you perform a live Search, StudShelf sends the normalized search term and fixed pagination information to the StudShelf public API at `https://api.studshelfapp.com`. The API forwards the search term to Rebrickable to request public catalog results. The Rebrickable API credential stays
on the server and is not exposed to the app.
Search requests do not include your local collection, statuses, progress, sessions, ratings, reviews, notes, backups, hidden-effort information, account identifiers, advertising identifiers, or clipboard contents.
StudShelf uses Search information to provide the catalog results you requested and for operational security, rate limiting, and troubleshooting. StudShelf does not use Search terms for advertising, behavioral profiling, or cross-app tracking. Search requests can appear in short-lived infrastructure logs and caches as described below.
You can avoid Search-related transmission by not using live Search and continuing to use locally available collection features.
Set Images
Normal catalog images are primarily loaded from Rebrickable's content-delivery network. When an image is requested, the image provider receives the requested image URL or set identifier and ordinary network metadata. That metadata can include an IP address, user-agent information, timestamp, and request details.
StudShelf does not add advertising identifiers, tracking identifiers, or account credentials to image requests. Images may be cached locally or by delivery infrastructure for operational periods.
Image links restored from imported or legacy backups are normalized before use. Exact trusted Rebrickable HTTP image links may be upgraded to HTTPS. During backup normalization, StudShelf removes unsupported schemes, recognized local hostnames, IP-literal destinations, and other image links that fail its import checks. Removed links use StudShelf's existing fallback presentation.
Valid public HTTPS image hosts from imported data remain allowed, so those providers may receive ordinary network metadata when an image is displayed.
Backups and Shareable Images
Backup JSON files are created only when you request an export. Restoring a backup begins only after you select a file or provide backup text and confirm the reviewed restore. Backup parsing, validation, and restoration occur locally on your device.
Completion-card and Monthly Recap PNG files are also generated only after you request them. The backup or image is handed to the operating system's share sheet, file picker, or the browser's download mechanism, and you choose the destination. StudShelf does not automatically upload these files.
StudShelf attempts to remove temporary working files after an export operation when cleanup succeeds. Files you save or share remain under your control and the destination app or service's privacy, security, and retention practices.
Feedback and Support
When you choose an in-app feedback or support action, StudShelf creates a draft in your chosen email client. StudShelf does not send the email automatically. You decide whether to send it and whether to add screenshots or other attachments.
If you send a message, StudShelf may receive your sender name, email address, message text, reproduction details, safe app or device diagnostics included in the draft, and screenshots or files you manually attach. No screenshot or attachment is uploaded automatically. Support content is used to investigate and respond to your request, secure StudShelf, and improve the product.
Support emails and attachments may be retained for up to 12 months after the last related interaction. They may be deleted earlier when no longer required. Limited information may be retained longer when reasonably necessary for security, abuse prevention, legal obligations, or dispute resolution.
You may request deletion of support emails and attachments by contacting [feedback@studshelfapp.com](mailto:feedback@studshelfapp.com). Requests are normally handled within 30 days. StudShelf may ask for identity or message details only when needed to locate the relevant correspondence. StudShelf cannot delete copies retained by your email provider or
another destination service.
If you use a contact form on the StudShelf website, StudShelf and the website form provider may receive your first name, last name, email address, and message. Website contact-form submissions are handled under the same support practices described above. StudShelf may retain those submissions for up to 12 months after the last related interaction, subject to the same limited
security, abuse-prevention, legal, and dispute-resolution exceptions.
If you submit the public closed-beta interest form, StudShelf may receive information you choose to provide, such as your email address, name, device information, and comments. Beta-interest submissions may be retained for up to 12 months after submission. If you become an active tester, related testing correspondence may be retained for up to 12 months after the last related testing
interaction. Information may be deleted earlier when it is no longer needed. Limited information may be retained longer when reasonably necessary for security, abuse prevention, legal obligations, or dispute resolution.
This information is used to respond to your request or manage beta participation, not for advertising or cross-app tracking. You may request deletion of website contact-form or beta-interest submissions through [feedback@studshelfapp.com](mailto:feedback@studshelfapp.com). Requests are normally handled within 30 days. Google Forms, Squarespace, or another form provider may independently process and retain form information under its own policies. StudShelf cannot delete independent copies or backups retained by those providers.
Infrastructure and Operational Information
The StudShelf website and public API use Vercel infrastructure. Vercel may process ordinary request metadata to deliver and secure these services, enforce firewall and rate limits, and support troubleshooting. Depending on the request and Vercel's systems, metadata may include:
- IP address;
- user-agent information;
- request path and query parameters;
- timestamp and response status;
- a request identifier;
- processing region; and
- cache or firewall information.
StudShelf is currently on Vercel's Hobby plan. Under the current plan, standard runtime logs are retained for up to one hour. StudShelf does not create application-level logs containing Search terms. Web Analytics, Speed Insights, Observability add-ons, external Log Drains, and external marketplace monitoring integrations are currently disabled. The public API firewall currently
limits clients to 20 requests per 60 seconds.
Vercel may process additional security and delivery metadata under its own documentation and privacy terms. StudShelf's plan, providers, and operational settings may change; material changes will be reflected in an updated policy.
Analytics, Advertising, and Tracking
StudShelf currently does not include:
- advertisements or advertising SDKs;
- behavioral analytics;
- attribution SDKs;
- session replay;
- fingerprinting;
- cross-app tracking; or
- an embedded third-party crash-reporting SDK.
StudShelf does not sell user data. Google Play, Apple, Android, iOS, browsers, email providers, and operating-system services may independently process installation, security, performance, crash, diagnostic, download, or sharing information under their own terms. That platform-managed processing is not sent through a StudShelf analytics SDK.
Data Retention and Deletion
- Local collection data: Remains on your device until you edit or remove it, clear app data, restore another collection, or uninstall the app in a way that removes local data.
- Backups and PNG exports: Remain wherever you saved or shared them until you or the destination provider removes them.
- Vercel runtime logs: Are retained for up to one hour under StudShelf's current Hobby plan.
- Search and image caches: Are kept only for operational caching periods and may expire or be evicted earlier.
- Support emails, attachments, and website contact-form submissions: May be retained for up to 12 months after the last related interaction, subject to the exceptions described above.
- Beta-interest submissions: May be retained for up to 12 months after submission. Related testing correspondence for active testers may be retained for up to 12 months after the last related testing interaction, subject to the exceptions described above.
StudShelf has no account or cloud collection database that requires an account-deletion process. You can remove individual sets and local records in the app, use the backup and restore controls, delete exported files from your chosen storage, or clear the app's storage or uninstall the app to remove local data. Deletion requests for support correspondence, website contact-form
submissions, or beta-interest submissions can be sent to [feedback@studshelfapp.com](mailto:feedback@studshelfapp.com). StudShelf cannot promise deletion from independent third-party providers outside its control.
Security
StudShelf-controlled production API requests and normal catalog connections use HTTPS. Imported image URLs are normalized to HTTPS URLs that pass StudShelf's import checks or removed. StudShelf limits the information it sends to what is needed for the feature you requested.
No security system can guarantee absolute protection. Email, storage, sharing, and download services you select follow their own security practices.
Third-Party Services
StudShelf currently relies on these categories of third-party services:
- Rebrickable: Public set catalog data and set images.
- Vercel: Website and API hosting, delivery, caching, firewalling, rate limiting, and runtime operations.
- Google Play, Apple, and operating-system or browser providers: App distribution and platform services.
- Your selected email, storage, sharing, or download provider: Destinations you choose for support messages, backups, or shareable images.
These providers apply their own privacy and retention policies.
Children
StudShelf is intended for users aged 13 and older and is not directed to children under 13. The app does not include accounts, messaging, a social feed, or public user-generated content sharing.
Changes to This Policy
This policy may change as StudShelf's features, providers, distribution methods, or practices change. The last-updated date will be revised when material changes are published. Significant changes may also be communicated through the website, app, store listing, or another appropriate channel.
Contact
For privacy questions or to request deletion of support correspondence, email [feedback@studshelfapp.com](mailto:feedback@studshelfapp.com).
Support information is available at [https://studshelfapp.com/support](https://studshelfapp.com/support).
Independent Product Notice
LEGO® is a trademark of the LEGO Group, which does not sponsor, authorize, or endorse StudShelf.
Set catalog data and imagery are provided through Rebrickable.