Joyshelf Privacy Policy

Last updated: 31 October 2026

Joyshelf collects as little about you as it can. It has no ads, no analytics and no tracking, and we never sell your data. This policy explains what data there is, why, where it goes and what you can do about it.

1. Who is responsible
2. In short
3. Using Joyshelf without an account
4. Your account and library
5. Signing in with Google, Apple or Facebook
6. What our servers see
7. Content from other services
8. What stays on your device
9. When you write to us
10. Tips
11. Who processes data for us
12. Data outside the EU
13. How long we keep data
14. Your rights
15. Children
16. Changes to this policy

1. Who is responsible

The controller of your personal data is:

Write to this address with any question about your data or to use your rights (see Your rights). This policy covers the Joyshelf apps for Android and iOS and the web app at joyshelf.joypadworks.com. Words like “we” and “you” mean what they mean in the Terms of Use.

2. In short

• Without an account, Joyshelf keeps nothing about you on our servers.
• With an account, we keep your email address and your library (games, their states, play dates, platforms and tags) so that it syncs between your devices.
• Your library is stored in the European Union and is not shown to anyone else.
• You can delete your account, with everything in it, at any time in Settings.
• No ads, no analytics, no tracking, no selling of data, and no cookies in the web app.

3. Using Joyshelf without an account

You can browse and search games without an account. The app then asks our servers and the services the game data comes from for that data (see What our servers see and Content from other services). Like any request on the internet, these requests carry your IP address and the kind of device or browser you use. We don't use them to find out who you are, and we don't build a profile of you.

4. Your account and library

When you create an account, we store:

• your email address, and your password in a hashed form we can't read, if you sign up with an email and a password;
• your library: the games you add, the states you give them (Want to Play, Playing, Completed, Dropped), the platforms and the dates you enter for them, your tags and which games have them, and when each of these was changed;
• technical data of the account, such as when it was created and when you last signed in, and the IP addresses of sign-ins, which the sign-in service keeps for security.

We use this data only to give you your account and keep your library in sync across your devices. The legal basis is the performance of our agreement with you (Article 6(1)(b) GDPR); for the security data, our legitimate interest in keeping accounts safe (Article 6(1)(f) GDPR).

Your library is private: nobody else can see it, and a link you share leads to a game, not to your library. When you remove something from your library, a short note that it was removed stays with your account, so that your other devices remove it too. Deleting your account (Settings → Delete account) erases the account and everything in it from our database at once.

5. Signing in with Google, Apple or Facebook

If you sign in with Google, Apple or Facebook, that service tells us your email address and confirms that it's you. It may also give us your name and the address of your profile picture, which we store with the account but don't use. We don't get your password, your contacts or anything else from your account there. Google, Apple and Meta handle the sign-in under their own privacy policies: Google, Apple, Meta. With Apple, you can choose to hide your email address, and we then get an address Apple forwards to you.

6. What our servers see

Our backend runs on Supabase, in a data centre in Ireland. Besides accounts and libraries, it answers the app's questions about games, such as searches and lists of releases, and passes some of them on to IGDB.

• What you search for is sent to our servers and, for IGDB, on to IGDB, without anything that identifies you. Answers are kept for up to 12 hours, by the text of the search alone, so that the same search doesn't have to be asked again.
• To stop abuse, we count requests from each IP address per minute. The address is kept only as a keyed hash, from which it can't be recovered, and the counts are deleted after an hour. The basis is our legitimate interest in protecting the service (Article 6(1)(f) GDPR).
• Supabase keeps technical logs of requests, including IP addresses, for a few days, for operating and securing the service.

The web app and this website are delivered by Cloudflare, which processes your IP address to deliver the pages and protect them from attacks. We don't keep logs of visits.

7. Content from other services

To show information about games, the app loads it directly from the services it comes from, which then see your IP address and device or browser, as with any website:

• Wikidata, Wikipedia and Wikimedia Commons, run by the Wikimedia Foundation – game data, article texts and cover images (privacy policy);
• IGDB, run by Twitch – cover images (privacy notice).

Pages you open from the app, such as a game's page in a store, a Wikipedia article or this policy, are shown by the website they belong to, in the app or in your browser, and that website's own privacy policy applies to them. They may set their own cookies in the app's web view.

8. What stays on your device

The app keeps your library, your settings (theme, language) and, if you're signed in, the keys of your session on your device, so that it works quickly and offline. In the web app, they're kept in your browser's storage (local storage and IndexedDB), which only the web app reads; it uses no cookies. Signing out removes the library from the device.

If you turn on backups in your system, Android or iOS may include the app's data in the backup of your device, under the terms of Google or Apple. If you agree to share diagnostics with Google or Apple, they may send us crash reports, which don't identify you.

9. When you write to us

If you email us, for example with Contact the developer in Settings, we get your email address and what you write. The app adds the version of Joyshelf and of your system to the message, so that we can help; you can delete them before sending. We use this only to answer you and to fix what you report, based on our legitimate interest in looking after our users (Article 6(1)(f) GDPR), and keep the conversation for as long as needed for that, at most 3 years after it ends.

10. Tips

Tips in the App Store or Google Play are paid to Apple or Google, which handle the payment under their own privacy policies. We don't get your name, your payment details or anything that identifies you; we only see totals.

On Ko-fi, the payment is handled by Ko-fi and its payment providers. Ko-fi shows us the name and message you choose to leave, and may give us your email address. We use them only for that tip, and keep the records accounting law requires, for 5 years after the end of the year of the tip (Article 6(1)(c) GDPR).

11. Who processes data for us

These companies process personal data on our behalf, under data processing agreements, and only as we instruct:

• Supabase, Inc. – database, accounts and backend functions, hosted in Ireland (EU);
• Cloudflare, Inc. – delivery of the web app and of this website, DNS and protection from attacks;
• Google LLC – our email (Gmail), for messages you send us.

Google, Apple and Meta (for signing in), Apple and Google (for the stores and tips), Ko-fi, the Wikimedia Foundation and Twitch act as separate controllers under their own policies, as described above. We don't share your data with anyone else, unless the law requires us to.

12. Data outside the EU

Your account and library are stored in the EU. Some of the companies above are based in the United States and may process data there, for example to deliver web pages or for support. Where they do, the transfer is protected by the EU–U.S. Data Privacy Framework, to which they are certified, or by the European Commission's standard contractual clauses.

13. How long we keep data

• Account and library: until you delete your account.
• Hashed IP addresses for counting requests: 1 hour. Cached search answers: 12 hours.
• Technical logs of our providers: a few days.
• Emails: up to 3 years after the conversation ends.
• Records of Ko-fi tips: 5 years after the end of the year of the tip.

Backups of our database may keep deleted data for a short time longer, until they are replaced by newer ones.

14. Your rights

Under the GDPR, you have the right to:

• get a copy of your personal data (access), including in a machine-readable form (portability);
• have it corrected or deleted – you can delete your account yourself in Settings;
• restrict how we use it, or object to our using it on the basis of legitimate interests;
• lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or the authority of the country where you live.

To use your rights, write to support@joypadworks.com from the email address of your account. We'll answer within one month. We don't make decisions about you by automated means, and we don't profile you.

15. Children

Accounts are for people aged 16 or over. If we learn that someone younger has created an account, we'll delete it. If you think this has happened, please write to us.

16. Changes to this policy

We'll update this policy when what Joyshelf does with data changes, and change the date at the top. If a change matters to you, we'll tell you in the app, and by email if you have an account, before it takes effect.