Privacy Policy

Account information. When you create an account, we collect your email address and authentication credentials (handled securely by our authentication provider). If you sign in with Google, we receive your name and email from Google.

Shelf and product data. Products you add to your shelf, including product names, brands, categories, barcodes, batch codes, purchase dates, prices, expiry dates, period-after-opening (PAO) dates, notes, ratings, tags, and photos you upload.

Scan and usage data. Barcodes you scan, feature usage events (such as scan counts and page views), and basic device and browser information used for analytics and to enforce plan limits (for example, the free tier's 10 scans per month).

Payment information. If you subscribe to CosmeShelf PRO ($4.99/month or $39.99/year), payments are processed by Stripe. We never see or store your full card number; we receive only your subscription status, plan, and billing identifiers from Stripe.

Waitlist and contact data. If you join our waitlist or email us, we collect the email address and any message you provide.

• Provide and operate the service — your shelf, expiry tracking, batch-code decoding, routines, and budget tools.
• Authenticate you and keep your account secure.
• Process subscriptions and manage billing through Stripe.
• Enforce plan limits and prevent abuse.
• Send service-related messages (such as expiry reminders you enable) and respond to support requests.
• Understand how the product is used so we can improve it, using aggregated analytics.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

Your data is stored in our hosted database (Lovable Cloud, powered by Supabase) with row-level security so that only you can access your personal shelf data. Access to the app is encrypted in transit using HTTPS. We retain your data while your account is active; when you delete your account, your personal data is removed from our systems, subject to limited records we must keep for legal or accounting purposes.

No method of transmission or storage is 100% secure, but we use industry-standard safeguards to protect your information.

We rely on a small number of trusted providers to operate CosmeShelf:

• Supabase / Lovable Cloud — hosting, database, and authentication.
• Stripe — payment processing for PRO subscriptions. Stripe's own privacy policy applies to the payment data it processes.
• Open Beauty Facts — a public product database we query to look up product information when you scan a barcode.

These providers process data only as needed to deliver their services to us.

We use cookies and similar browser storage to keep you signed in, remember your preferences, and measure aggregate usage. You can control cookies through your browser settings, but disabling them may prevent sign-in and other core features from working.

Depending on where you live (including under Canadian privacy law and, where applicable, GDPR), you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Export your data (PRO members can export their shelf to CSV).
• Delete your account and associated personal data from the Settings page.
• Withdraw consent to optional processing, such as analytics.

To exercise any of these rights, email us at hello@cosmeshelf.ca.

CosmeShelf is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide notice in the app or by email. Your continued use of CosmeShelf after changes take effect means you accept the updated policy.

CosmeShelf is operated from Canada. If you have questions about this Privacy Policy or how we handle your data, contact us at hello@cosmeshelf.ca.