NyangNyangBit
Meow Shelf Privacy Notice
Effective November 8, 2026 (announced November 1, 2026). Until then, the previous version applies (effective November 4, 2026, or October 29, 2026 before that; see the revision history). However, the book-search and book-information changes in the book database table apply from the day the app update that includes them is released. The random device number and the Google ML Kit diagnostic data for Android text recognition apply from October 25, 2026, together with the Android app launch.
This is the English version of our privacy policy, prepared for users outside Korea. If it conflicts with the Korean version, the Korean version prevails, except where the law of your country of residence requires otherwise.
At a glance
- What we collect: nothing is required. If you choose to sign in, we receive your email address, an account identifier and a nickname. If you sign in, we also back up your books, quotes, notes and wordbook entries.
- What we don't do: no advertising, no analytics or tracking SDKs, no cookies, no selling of data. Photos are never stored on our servers.
- Works without an account: adding books, saving quotes and notes, the reading timer and collecting cats all work on your device without signing in.
- Public feed: only posts you choose to publish are shown to other users, with your nickname. Unpublishing removes them.
- Your data, your copy: Settings > Back up your records lets you export everything to a file.
- Deleting your account: removes your account, backup and feed data from our servers immediately. Data stored on your device stays there until you delete it or uninstall the app.
- Email you send us: if you email us, we keep your email address and message to reply and keep a record (3 years after we reply; we use Gmail).
- Contact: sokurihj@gmail.com
1. Controller and contact
The data controller is NyangNyangBit (“we”, “us”), the individual developer and operator of Meow Shelf (“the app”), based in the Republic of Korea.
Email: sokurihj@gmail.com. The app is run by one person, who handles all privacy requests; we have not appointed a separate Data Protection Officer.
2. Personal data we process
| Category | Data | Where it is stored |
|---|---|---|
| Account (only if you sign in) | Email address and account identifier from Google or Apple, and the nickname you enter. If you use “Hide My Email” with Apple, we only receive Apple’s anonymous relay address. | Our server |
| Backup (only if you sign in) | Your books (title, author, ISBN and cover image address), and your quotes, notes and wordbook entries (the text, page number and note). Everything else, such as reading status, page counts, reading time and cats, stays on your device. | Our server |
| Public feed posts (only if you publish) | Quote text, note, nickname, the book title and author as they were when you published, and the app language at that time. Likes, reports and blocks are also stored. | Our server |
| Letters you send (optional) | The text of a letter written in Settings > Write a letter, plus the app version, the platform (iOS or Android) and the time it was sent. Letters can be sent without signing in; if you are signed in, the letter is linked to your account. | Our server |
| Email you send us (optional) | Your email address, your message (and any attachments), and when you sent it. | Gmail (Google LLC) |
| Reading time, target time, finished-book and cat records | Timer start and end times, the target time you set, books finished and cats collected. | Your device only |
| Photos | Pictures you take or pick from your library to capture a passage. | Your device only |
| Purchase status | A single “purchase completed” flag reported by Apple or Google. We never receive your card or bank details. | Your device only |
We do not use analytics, advertising or crash-reporting tools. The only thing recorded automatically is on Android: when you ask the app to recognise text, it sends a random device number it generated itself, and our server keeps that number with the day’s request count for three days to limit abuse, then deletes it. It is not linked to your email, nickname, photos or account, is not used for advertising or tracking, and changes if you reinstall the app. Also on Android, when on-device text recognition is used, Google ML Kit does not send the photo or the recognised text, but it may send Google diagnostic and usage data: device information (manufacturer, model, OS version), app information (package name, version), a per-installation identifier that is not meant to identify you or your device, performance metrics and error codes. Google handles this data under its own privacy policy. iOS does neither. How to object: this data is sent only when you use photo text recognition on Android. If you don’t want it sent, type your quote in yourself instead of using recognition; nothing is sent and every other feature works as usual. Any device number already on our server is deleted automatically after three days. We do not process special categories of personal data (Art. 9 GDPR) on purpose. Quotes and notes are free text that you write yourself, so please do not enter sensitive information you don’t want stored.
Camera (to capture passages and scan barcodes), photo library (to pick a book photo) and notification permissions are all optional. If you decline one, only that feature is unavailable.
Camera, photos and text recognition
- iOS: text in a photo is recognised on your device with Apple Vision. The photo does not leave your device.
- Android: each time you ask the app to recognise text, the photo is sent through our server function (Supabase) to Google Cloud Vision (Google LLC). We do not store the photo and only return the recognised text to the app. Google states that in this mode it processes the image in memory without writing it to disk and does not use it to train its models. If you are offline, or the daily limit of this service is reached, the app uses Google ML Kit on your device instead, and the photo does not leave your device. Google ML Kit does not send the photo or the recognised text, but it may send Google diagnostic and usage data: device information (manufacturer, model, OS version), app information (package name, version), a per-installation identifier that is not meant to identify you or your device, performance metrics and error codes. Google handles this data under its own privacy policy.
- Android: to limit how many times one device can use text recognition each day, the app also sends a random device number it generated itself with each request. It is not linked to you and changes if you reinstall the app. The server keeps this number and the day’s request count for three days from the day recorded, then deletes them.
Notifications
If you set a target time on the reading timer, the app asks for permission to notify you when time is up. You can decline and the timer still works. Notifications are scheduled on your device only. We use no remote (push) notifications and create or collect no push token.
Paid features
Some features are a one-time in-app purchase. Payment is handled by Apple App Store or Google Play. We do not collect or store payment details or transaction records; they stay with Apple or Google, and you can see them in your store purchase history.
3. Purposes and legal bases (Art. 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Signing you in and keeping you signed in; showing your nickname | Contract (Art. 6(1)(b)) — providing the account you asked for |
| Backing up and restoring your books, quotes, notes and wordbook | Contract (Art. 6(1)(b)) |
| Recognising text in your photos on Android | Contract (Art. 6(1)(b)) — the feature you request each time |
| Limiting daily text recognition per device on Android (random device number) | Legitimate interests (Art. 6(1)(f)) — preventing abuse and keeping the cost of the service under control |
| Looking up books by title or barcode (see Section 4) | Contract (Art. 6(1)(b)) |
| Publishing a post to the public feed and showing it to other users | Consent (Art. 6(1)(a)) — you choose to publish; you can withdraw at any time by unpublishing |
| Likes, reports and blocks; removing unlawful or rule-breaking posts; protecting the service from abuse | Legitimate interests (Art. 6(1)(f)) — keeping the community safe and the service working — and legal obligations under the Digital Services Act (Art. 6(1)(c)) |
| Reading and answering your letters, fixing bugs and improving the app | Legitimate interests (Art. 6(1)(f)) — understanding and answering the feedback you chose to send us |
| Unlocking paid features | Contract (Art. 6(1)(b)) |
| Replying to email you send us and keeping a record of support requests | Legitimate interests (Art. 6(1)(f)) — answering your request and being able to handle later purchase or bug questions |
Giving us your account data is voluntary. Without it you cannot use sign-in, backup or the public feed, but everything else works.
4. Recipients and external services
We do not sell your data or share it with third parties for their own purposes. These recipients help us run the app:
| Recipient | What for | What they receive |
|---|---|---|
| Supabase, Inc. (processor; data stored in Seoul, South Korea, on AWS) | Sign-in, storage of backups and feed posts, relaying Android text-recognition requests and book searches | The account and backup data described in Section 2, or the photo or search term being relayed |
| Google LLC (processor) | Google Cloud Vision for Android text recognition; Google Books for book title search when Rakuten Books or Open Library does not respond, and for finding a cover for a book added without one; Google sign-in; Gmail for receiving and storing email you send us | The photo or search term; for sign-in, the data Google handles as an identity provider; your email address and message |
| Rakuten Group, Inc. (Japan) | Rakuten Books API for book title search when the app language is Japanese | The search term, through our Supabase server function |
| Apple Inc. | Sign in with Apple; App Store payments | As described in Apple’s privacy policy |
| Google Play | Payments on Android | As described in Google’s privacy policy |
To find book information, the app sends the following to book databases. We never include your email, account identifier or nickname.
| Feature | What is sent | Sent to |
|---|---|---|
| Book search by title (English app language) | The title or other search term | Open Library (Internet Archive, USA); if it does not respond, Google Books API (Google LLC, USA), through our Supabase server function |
| Book search by title (Japanese app language) | The title or other search term | Rakuten Books API (Rakuten Group, Inc., Japan); if it does not respond, Google Books API (Google LLC, USA), both through our Supabase server function |
| Finding a cover when a book is added without one | The book’s title and author | Google Books API (Google LLC, USA), through our Supabase server function |
| Book search by title (Korean app language) | The title or other search term | Kakao book search API (Korea) |
| Barcode lookup, ISBN starting 978-4 (Japanese books) | The ISBN | National Diet Library of Japan search API; Open Library |
| Barcode lookup, other foreign books | The ISBN | Open Library |
| Barcode lookup, Korean books (ISBN starting 978-89 or 979-11), and a last attempt for any barcode not found elsewhere | The ISBN | Kakao book search API (Korea) |
| Filling in the page count and category when a book is added | The ISBN | National Library of Korea bibliographic API (Korea); if it has no page count, Google Books API (Google LLC, USA), both through our Supabase server function |
| Word definitions (Korean app language only) | The word | National Institute of Korean Language dictionaries (Korea) |
Requests to Open Library, the National Diet Library, Kakao and the Korean dictionaries are sent directly from your device, so, as with any internet request, those services can see your IP address. They handle it under their own privacy policies. Book cover images are also loaded directly from their source (Open Library, Google Books or Kakao), so those services can see your IP address when a cover is shown.
5. International transfers (Chapter V GDPR)
- To us (Republic of Korea): we are based in Korea, so data from users in the EEA reaches us there. The European Commission has found that Korea provides an adequate level of data protection (Implementing Decision (EU) 2022/254), so no further safeguard is required.
- Supabase, Inc. (USA): your data is stored in Seoul, but Supabase staff in the USA may access the servers remotely for operations and fault handling. This transfer relies on the Standard Contractual Clauses incorporated in Supabase’s data processing addendum.
- Google LLC (USA and other countries where Google has data centres): used for Android text recognition, Japanese-language book search, and email you send us (Gmail). This relies on the Standard Contractual Clauses incorporated in Google’s data processing terms.
- Open Library / Internet Archive (USA): receives only the search term or ISBN and your IP address. No account data is sent.
You can ask us for a copy of the safeguards at sokurihj@gmail.com. If you do not want an Android photo to be sent to Google, turn off your internet connection before recognising text; recognition then happens only on your device.
6. Retention
| Data | How long we keep it |
|---|---|
| Account data and nickname | Until you delete your account; deleted immediately |
| Backed-up books, quotes, notes and wordbook | Until you delete your account; deleted immediately |
| Feed posts, likes, reports, blocks | Until you unpublish or delete your account; deleted immediately |
| Photos, reading time, finished-book and cat records, purchase flag | Only on your device. They disappear when you delete them in the app or uninstall it. |
| Photos sent for Android text recognition | Not stored; discarded after each request |
| Random device number and daily request count (Android text recognition) | Deleted three days after the day recorded |
| Email you send us | 3 years after we reply, then deleted |
| Letters | 3 years after we receive them, then deleted. You can ask us by email to delete yours sooner. When you delete your account, the link between your letters and your account is removed, but the text of a letter may remain without your account; after that we may no longer be able to find your letters. |
We do not keep payment or transaction records ourselves. Apple or Google keep them as the payment processor. Deleted data is removed from the database and cannot be recovered. There is no separate archive.
7. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw consent at any time (Art. 7(3)) where we rely on consent. You also have the right not to be subject to a decision based solely on automated processing (Art. 22); we do not make any such decisions.
Most of these you can use inside the app:
- Change your nickname — Settings
- Delete individual books, quotes, notes and words
- Unpublish a feed post — Feed (withdraws consent for that post)
- Report a post or block a user — Feed
- Export all your data as a file (JSON text,
.nyang) — Settings > Back up your records - Delete your account and all server-side data — Settings > Delete account
For anything else, email sokurihj@gmail.com. We reply within one month (extendable by up to two further months for complex requests, in which case we tell you why). Requests are free unless they are manifestly unfounded or excessive.
8. Complaints
You may lodge a complaint with the data protection supervisory authority in the EU/EEA country where you live, work or where you believe an infringement took place. A list is available at edpb.europa.eu. We would appreciate the chance to resolve your concern first, so please contact us as well.
9. Cookies and tracking
The app does not use cookies, advertising identifiers or tracking technologies. These policy pages are static web pages and set no cookies of their own.
10. Children
Signing in is optional, and without signing in we collect no personal data. We do not knowingly collect personal data from children below 16 (or the lower age set by your country, but never below 13) without the consent of the holder of parental responsibility. If you believe a child has signed in without that consent, email us and we will delete the data without delay.
11. Security
- Your sign-in session is stored on your device encrypted with AES-256, and the key is kept in the system secure storage.
- All traffic to our server uses HTTPS.
- Server data is protected by row-level access rules so that you can only read your own data (and the posts other users published).
- Server access is limited to the operator, and admin credentials are not included in the app.
12. Changes to this notice
If we change this notice we announce it in the app or on this page at least 7 days before the change takes effect, and at least 30 days before if the change significantly affects your rights.
Revision history
- October 25, 2026 — First English version. It follows the Korean notice effective the same day (reading-timer notifications, book lookup services including Open Library, the National Diet Library of Japan and Google Books, target time, app language stored with feed posts).
- October 25, 2026 — Added the random device number used to limit daily text recognition per device on Android, and the diagnostic data that on-device recognition (Google ML Kit) may send to Google (applies from the Android app launch).
- October 29, 2026 — Added how we handle email you send us (Gmail, legal basis, retention), optional permissions, and a fixed 3-year retention period for letters (announced October 22, 2026).
- November 4, 2026 — Japanese-language title search now uses Rakuten Books (Google Books if it does not respond); added the Google Books fallback for English-language search and the cover lookup (title and author) for books added without a cover (announced October 28, 2026).
- November 8, 2026 — The page count and category filled in when a book is added now come from the National Library of Korea bibliographic API (Google Books if it has no page count) instead of Aladin (announced November 1, 2026).