Privacy policy

1. Introduction

Cosmic Thread Software ("Cosmic Thread," "we," "us," or "our") provides Backshelf, a wishlist and collection service for physical video games (the "Service"). This Privacy Policy explains what personal information we collect, how we use it, when we disclose it, how long we retain it, and the rights available to you.

This Privacy Policy applies to backshelf.gg and the Service. It does not apply to third-party websites, services, or applications that you may reach through links from the Service. Those third parties are responsible for their own privacy practices.

Cosmic Thread Software is located in California, United States. Where applicable, Cosmic Thread is the controller of personal information under the EU and UK General Data Protection Regulation and the business responsible for personal information under the California Consumer Privacy Act, as amended.

Contact: [email protected]

2. Information We Collect

Account information

When you create an account, we collect your email address and a password. Passwords are stored using a cryptographic hash and are not available to us in their original form. We may also collect a display name, handle, and information about whether your email address has been verified.

Your wishlist and collection

We collect the information you enter or create through the Service, including your wishlist and collection, groups, shelves, retailers, settings, and information you associate with an item. This may include the price you paid, purchase date and place, condition, and notes.

Subscription information

If you subscribe to a paid plan, we receive identifiers associated with your subscription, the plan and its status, and relevant renewal or cancellation information from our payment provider. We do not receive or store your full payment-card number.

Our payment provider may independently collect and process payment information, billing information, and tax information as described in its own privacy policy.

Security and registration information

During registration and other security-related interactions, we may process your IP address and related technical information to prevent automated abuse, fraud, and unauthorized access.

Where we collect an IP address solely for a particular security check, we delete it when that security purpose is complete unless we have a legal or security reason to retain it.

Technical and log information

When you use the Service, our systems and service providers may automatically generate technical and log information, including IP address, browser and device information, the time of a request, the requested resource, and information associated with your account. We also record each day on which your account uses the Service.

We use this information to operate, secure, troubleshoot, and improve the Service.

Correspondence

If you contact us, we collect the information you provide and our correspondence with you.

The Service also offers optional forms for sending us feedback or reporting incorrect game information. These forms are hosted by a service provider on our behalf. We collect what you enter, along with which part of the Service you opened the form from and, for a report about a game, identifiers for the catalog entry you are reporting. Name and email are optional on these forms, and we ask for them only so we can reply.

Analytics

If you consent to analytics, we and our analytics providers collect information about page views, use of the Service, and your interactions with it. Analytics does not load unless you provide the required consent.

You may withdraw analytics consent at any time through "Cookie settings."

3. Sources of Information

We collect personal information:

• directly from you when you create an account, use the Service, enter information, subscribe, or contact us;
• automatically from your browser or device when you use the Service; and
• from service providers, including our payment provider, in connection with your subscription and account.

4. How We Use Personal Information

We use personal information for the following purposes:

Providing the Service

We use your account information and content to create and maintain your account, provide access to your wishlist and collection, synchronize your records across devices, and provide features you request.

EU/UK lawful basis: Performance of our contract with you.

Operating, securing, and supporting the Service

We use personal information to authenticate users, prevent automated abuse and fraud, maintain security, diagnose technical problems, respond to correspondence, and otherwise operate and support the Service.

EU/UK lawful basis: Our legitimate interests in operating a secure and reliable service, except where another lawful basis applies.

Processing subscriptions

We use subscription information to provide paid features, administer subscriptions, process cancellations and renewals, and maintain required business and tax records.

EU/UK lawful basis: Performance of our contract and compliance with legal obligations.

Analytics and service improvement

If you consent, we use analytics information to understand how the Service is used and improve its functionality.

EU/UK lawful basis: Consent.

You may withdraw consent at any time. Withdrawal does not affect processing that occurred before withdrawal.

Aggregated and deidentified information

We may create aggregated or deidentified information from information collected through the Service and use it to understand how the Service is used, to improve it, and for research, reporting, and other lawful business purposes.

EU/UK lawful basis: Our legitimate interests in understanding and improving the Service and in developing our business.

Legal and compliance purposes

We may process personal information to comply with applicable law, respond to lawful requests, establish, exercise, or defend legal claims, and protect the rights, property, and safety of Cosmic Thread, our users, and others.

EU/UK lawful basis: Compliance with legal obligations and, where applicable, our legitimate interests.

5. Information You Must Provide

An email address is required to create and maintain an account because we use it to identify your account, provide account-related communications, and allow you to recover access to the Service.

Other information is generally optional unless the relevant feature requires it.

6. Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects.

We may use automated security systems to assess whether a registration or other activity appears to be automated, abusive, or otherwise suspicious. If such a system prevents you from registering or using the Service in error, contact us at [email protected] and a person will review the issue.

7. Cookies, Local Storage, and Similar Technologies

We use the following technologies:

Strictly necessary technologies

Signing in uses a session cookie or similar technology necessary to maintain your authenticated session. Our cookie-consent mechanism may also store your cookie or analytics preference.

These technologies are necessary for the Service and are not used for advertising.

Analytics

If you accept analytics, our analytics providers may set cookies or use similar technologies to measure use of the Service.

If you decline analytics, we do not load the analytics service.

Local storage

Your browser may retain a cached copy of information associated with your own records and preferences. This information remains on your device and can be removed by clearing the site's stored data.

We do not use advertising or remarketing cookies.

You may change your analytics preference at any time using "Cookie settings" in the site footer.

8. How We Disclose Personal Information

We disclose personal information only as described below.

Service providers

We disclose personal information to service providers that process it on our behalf to help us operate the Service. These providers may provide services including:

• cloud hosting and data storage;
• payment and subscription processing;
• transactional email;
• security, fraud prevention, and protection against automated or abusive activity;
• collecting feedback and reports you choose to submit; and
• analytics, where you have consented to analytics.

We require service providers that process personal information on our behalf to use it only to provide the services we have engaged them to provide and to comply with applicable law and our contractual requirements.

Our service providers may change from time to time as we operate, maintain, and improve the Service. We do not disclose more personal information than is reasonably necessary for the applicable service.

Our payment provider may process payment and transaction information as an independent controller for purposes described in its own privacy policy. Where a service provider processes personal information solely on our behalf, we remain responsible for determining the purposes for which that information is processed.

Legal requirements and protection of rights

We may disclose personal information where required by law, legal process, subpoena, court order, or other lawful request, to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of any person.

Where legally permitted, we will provide notice before making such a disclosure.

Corporate transactions

If Cosmic Thread is involved in a merger, acquisition, financing, reorganization, sale of assets, or other corporate transaction, personal information may be transferred as part of that transaction.

We will require the recipient to handle personal information consistently with this Privacy Policy or provide appropriate notice of any material change in its handling.

At your direction

We may disclose information when you direct us to do so, including when you publish a wishlist or collection page or export your information.

Retailer links

The Service displays links to third-party retailers, such as Amazon, where an item can be viewed or purchased. Some of these links are affiliate links. When you follow one, the retailer or an affiliate network acting on its behalf may record that the click came from Backshelf. That retailer or network handles the information under its own privacy policy, not this one.

9. Sale and Sharing of Personal Information

We do not sell personal information for monetary or other valuable consideration.

We do not share personal information for cross-context behavioral advertising.

We have not sold or shared personal information for cross-context behavioral advertising during the preceding twelve months.

Our disclosures to service providers and other parties described in section 8 are not intended to constitute a sale or sharing for cross-context behavioral advertising.

We do not use your wishlist, collection, notes, or other user-entered content in a form that identifies you to train machine-learning models.

Aggregated and deidentified information

We may create aggregated or deidentified information from information collected through the Service, and we may use, disclose, or otherwise make that information available for any lawful purpose, including commercial purposes.

Aggregated and deidentified information does not identify you and is not personal information under applicable law. Nothing in this section permits us to sell or share personal information.

Where we treat information as deidentified, we will maintain and use it in deidentified form, we will not attempt to reidentify it except as applicable law permits in order to test our deidentification measures, and we will require recipients to do the same.

10. Public Wishlist and Collection Pages

A paid account may allow you to publish your wishlist, collection, or both.

Publication is disabled unless you enable it.

A published page may display your handle and display name and, for each item, catalog information such as the title, platform, estimated price, scores, trailer link, and, for a collection page, condition.

Information displayed on a published page is intentionally made public. A published page may be accessible to anyone and may be indexed by search engines or copied, cached, archived, or redistributed by others.

Disabling publication removes the page from the Service, but we cannot guarantee that copies previously made by third parties will be removed.

Information that is not included on the published page, including private notes and other private account information, is not made public merely because you publish a page.

11. International Transfers

Your personal information is stored and processed in the United States.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, this means that your personal information may be transferred to and processed in the United States and other countries where our service providers operate.

Where applicable law requires a safeguard for an international transfer, we rely on an applicable adequacy decision or other legally recognized transfer mechanism, such as the European Commission's Standard Contractual Clauses or the applicable UK transfer mechanism.

Where a provider relies on an applicable certification under the EU-U.S. Data Privacy Framework or another recognized adequacy mechanism, we may rely on that mechanism where permitted.

You may request information about the applicable transfer safeguards by contacting us at [email protected].

12. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security, complying with legal obligations, resolving disputes, and enforcing our agreements.

Our principal retention periods are:

We do not close accounts solely because they have been inactive.

When you delete your account, we delete your account and user-entered records from our active systems, subject to information we are required to retain and ordinary backup or archival processes.

13. Security

We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

Traffic to the Service is encrypted in transit, and account passwords are stored using cryptographic hashing rather than in plaintext.

No method of transmission or storage is completely secure. You should use a unique password for the Service and contact us promptly if you believe your account has been accessed without authorization.

If applicable law requires us to notify you or a regulator of a personal-data breach, we will do so within the required timeframe.

14. Your Privacy Rights

Depending on where you live and subject to applicable legal exceptions, you may have rights including:

• access to personal information we hold about you;
• correction of inaccurate personal information;
• deletion of personal information;
• portability of certain personal information;
• restriction of processing;
• objection to certain processing based on legitimate interests;
• withdrawal of consent where processing is based on consent; and
• the right to lodge a complaint with the applicable data protection authority.

You can export your wishlist and collection through Settings. You can also delete your account through Settings. These features are available regardless of whether your account is paid.

Making a request

Email [email protected] from the email address associated with your account.

If you cannot make the request from that address, we may request additional information reasonably necessary to verify your identity and protect your account.

You may use an authorized agent where permitted by applicable law. We may require evidence of the agent's authority and may independently verify the request with you.

We do not charge a fee for privacy-rights requests unless applicable law permits us to do so.

We will respond within the period required by applicable law. Where the law permits an extension, we will notify you of the extension and the reason for it.

We will not discriminate against you for exercising a privacy right.

15. California Privacy Rights

If the California Consumer Privacy Act applies to you, you may have the right to:

• know the categories of personal information we collect, the categories of sources, the purposes for collection or use, and the categories of recipients;
• request access to specific pieces of personal information, subject to applicable exceptions;
• request correction of inaccurate personal information;
• request deletion of personal information, subject to applicable exceptions;
• obtain information about our disclosure, sale, or sharing practices;
• opt out of the sale or sharing of personal information where applicable;
• limit certain uses and disclosures of sensitive personal information where applicable; and
• not be discriminated against for exercising rights provided by law.

We do not sell personal information or share it for cross-context behavioral advertising.

We may nevertheless collect categories of personal information that California law treats as sensitive personal information, including account login credentials. We use such information only for purposes reasonably necessary to provide and secure the Service and for other purposes permitted by applicable law.

To exercise California privacy rights, contact [email protected].

We may verify your identity before completing a request. Verification procedures will be appropriate to the nature and sensitivity of the request.

16. European Economic Area, United Kingdom, and Switzerland

If applicable data-protection law applies to our processing of your personal information, you may exercise the rights described in section 14.

You may also lodge a complaint with the data protection supervisory authority in the country where you live, work, or believe an infringement occurred.

You do not need to contact us before contacting a supervisory authority.

17. Children

The Service is not directed to children.

You must be at least 13 years old to create an account, and a higher minimum age applies where the law of your jurisdiction requires a higher age for processing personal information without parental authorization.

We do not knowingly collect personal information from a child below the applicable minimum age. If you believe that a child has created an account or provided personal information to us in violation of this section, contact us at [email protected].

If we determine that we have collected personal information from a child in circumstances requiring deletion, we will take reasonable steps to delete it.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

The effective date at the beginning of the Policy identifies the current version.

If we make a material change to how we collect, use, disclose, or otherwise process personal information, we will provide notice as required by applicable law before the change takes effect.

We will retain prior versions where required by applicable law and may provide an earlier version upon request.

19. Contact Us

Cosmic Thread Software
California, United States

Privacy questions, requests, complaints, and security concerns may be sent to [email protected].

For questions about the contractual relationship between you and Cosmic Thread, see the Backshelf terms of service.