Privacy Policy
This is a template prepared for Gigahertz Company and has not yet been reviewed by an attorney.
01Scope: the app vs. Lookshelf Cloud
The Lookshelf desktop app works fully offline, requires no account, and sends us nothing. No analytics, no tracking, no phone-home. Fonts are self-hosted; there are no CDN calls. If you never create a Lookshelf Cloud account, we collect nothing about you at all.
This policy therefore mostly describes Lookshelf Cloud, the optional hosted backup service run by Gigahertz Company LLC ("Gigahertz", "we"). You can also skip our hosted service entirely and self-host the backup backend from the open-source repository with your own keys.
02What we collect
When you use Lookshelf Cloud, we store:
- Account email — for login, receipts, and service notices.
- Password, scrypt-hashed — we never store or see your plaintext password.
- Subscription status — via Stripe. Card numbers never touch our servers; Stripe processes all payments.
- Encrypted file contents and encrypted filenames — your backed-up library, encrypted at rest. Even filenames are encrypted in storage.
- Hashed access logs — records of access to your data, with identifiers hashed, kept for security auditing.
That is the full list. We do not run analytics or ad tracking, and we do not sell or rent personal data to anyone.
03How encryption works — honestly
Your data is encrypted in transit with TLS and envelope-encrypted at rest: each user has their own AES-256-GCM data key, wrapped by a rotatable master key we hold, on top of the storage provider's own at-rest encryption. Filenames are encrypted too, and every stored object is cryptographically bound to its exact identity and hash-verified on read, so tampering or relocation is detected. But we want to be straight with you: Lookshelf Cloud is not zero-knowledge. Gigahertz holds the master key. We chose this deliberately so that a lost password does not mean lost data — account recovery works. It also means we can technically access decrypted content. We will only do so with your consent, when legally required, or when necessary to protect the service, and every access is recorded in the audit log. If you want no one but yourself to hold the keys, self-host the backend with your own keys — the code is open source and that path is fully supported.
04Subprocessors
We use four service providers to run Lookshelf Cloud. Here is each one and what it can see:
| Provider | Purpose | What it sees |
|---|---|---|
| Stripe | Payments | Your email and payment details. Stripe handles all card data; we never receive card numbers. |
| Cloudflare R2 | Encrypted storage | Encrypted blobs with encrypted filenames. No plaintext content, no readable names. |
| Neon | Database | Account records: email, hashed password, subscription status, and file metadata. |
| Render | Hosting | Runs our server code; sees traffic to the API in the course of serving it. |
If we add or replace a subprocessor, we will update this page.
05Retention
- Deleted files stay restorable from trash for 30 days, then are purged from live storage.
- Account deletion removes your data from our systems.
- Backup mirror. Every write is mirrored to a second store that ordinary deletions never touch — that is a durability feature, not a retention loophole. On request, we will purge your data from the mirror as well.
06Your rights
Wherever you live, we extend the same rights to you, in the spirit of the GDPR and CCPA:
- Access — ask what we hold about you.
- Export — take your data with you; restore is built into the product, and we will help with anything it does not cover.
- Correction — fix inaccurate account information.
- Deletion — delete your account and data, including the backup mirror on request.
- No sale — we do not sell personal information, so there is nothing to opt out of.
To exercise any of these, email support@lookshelf.app from your account address. We will respond within 30 days.
07Security measures
In summary, Lookshelf Cloud protects your data with four tested layers, plus supporting controls:
- TLS for all traffic, with bearer-token authentication.
- Server-side envelope encryption: per-user AES-256-GCM data keys wrapped by a rotatable master key.
- Provider at-rest encryption on Cloudflare R2.
- Tamper and relocation detection: every object is cryptographically bound to its exact identity and hash-verified on read.
- A deletion-proof backup mirror, encrypted filenames at rest, per-account download budgets that limit damage from a stolen token, and a hashed access audit log.
No system is perfectly secure. If a breach affects your data, we will notify you promptly at your account email.
08Children
Lookshelf Cloud is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it.
09Changes to this policy
We may update this policy from time to time. For material changes, we will notify you by email or in the app before they take effect. The "Last updated" date at the top always reflects the current version.
10Contact
Privacy questions, requests, or concerns: support@lookshelf.app.