Last updated September 17, 2026
Backshelf is a website that keeps a record of the games you play. To do this, it holds some data about you. This page tells you what data it holds, why it holds it, how long it holds it, and what rights you have.
Backshelf is made and operated by one person, Andre Silva, who is the data controller for all the data in this policy. Send questions and requests to info@norrwyn.com.
Backshelf does not sell your data. There are no advertisers, no data brokers and no tracking pixels on this site.
Backshelf collects only the data that it needs to operate. This is that data.
Your account. A username, a password, and an email address if you give one. The password is held as a hash, and the original password cannot be read from it. An email address is optional, but without one you cannot reset a password that you forget. You can also upload an avatar image.
What you put on Backshelf. Your shelves and the games on them, your reviews and their ratings, the modules on your profile and the text in them, the links you add to other sites, and the people you follow. Backshelf holds this data to show it to you, and to show it to other people if your settings permit that.
Your Steam connection. Only if you connect a Steam account. Refer to the Steam section below.
Sign-in attempts. Each failed login and each signup records the IP address it came from and the username it used. This prevents an attacker from guessing passwords. Backshelf deletes these records after 24 hours.
Errors. When a fault occurs, Backshelf records the error, the position in the code, and the address of the page. It does not record your IP address, your cookies or your account details. The address of a profile page contains the username of that profile, which can be yours or another person's.
Page performance. Vercel Speed Insights measures the time that pages take to load. It records the page address, the browser, the device type, the operating system and the country. This data cannot be connected to your account.
Messages you send. If you use the contact form, Backshelf keeps the name, the email address and the message.
Backshelf has no advertising, no A/B testing, no session recording and no behavioural analytics.
The GDPR requires a lawful basis for each use of data. Backshelf uses two.
A contract (Article 6(1)(b)) is the basis for the functions that you ask for: your account, your shelves and reviews, your profile, the people you follow, the notifications you turn on, the Steam import, and the password reset email.
Legitimate interests (Article 6(1)(f)) is the basis for the functions that keep the app safe and available: the limit on sign-in attempts, the error records, the page performance data, the backups, and the replies to messages you send.
No function uses consent as a basis. There is no newsletter, no marketing email and no optional tracking.
Backshelf makes no automated decisions about you.
A new account is public. Any person on the internet can read your profile, your shelves and your reviews, with an account or without one. Search engines can find them.
You can change this at any time in your settings. A private profile is visible only to the people you approve.
You can also keep shelves private while the rest of your profile stays public. A private shelf and the games on it are visible only to you. A shelf that Backshelf manages for you, such as the one for your Steam wishlist, is always private.
This data is never public: your email address, your password, your sign-in records, your notifications, and the messages you send through the contact form.
Other people can copy public data while it is public. If you delete that data, Backshelf removes it. Backshelf cannot remove a copy that another person made.
A Steam connection is optional. Backshelf operates without one.
You sign in with Steam, so Backshelf does not receive your Steam password. Backshelf keeps your SteamID and the sign-in response that contains it.
When you start an import, Backshelf asks Steam for the games on your account and the play time for each game. It uses the play time only to select a shelf for each game. If you ask for your wishlist, it reads that too. It then matches the games against a public games database to find the titles and the cover images. That request contains game identifiers and no data about you.
You can also turn on scheduled imports. Backshelf then reads your Steam library and your wishlist once a night, puts the games that are not yet on a shelf onto the shelves that you choose, and sends you a notification. It keeps a record of each night's run for 90 days
If you disconnect Steam, Backshelf deletes the connection and the SteamID. The games that you imported stay on your shelves.
Backshelf uses services from other companies. A contract permits these companies to process the data only as instructed.
No other company receives your data. No analytics company, no advertising network and no data broker is involved in Backshelf.
One person operates Backshelf and has administrative access to the database. That access is used in four conditions:
Backshelf does not sell, rent or trade your data. If a different person or company takes over Backshelf, you will get a message before the data moves, and you can delete your account first.
You have these rights. A request is answered in one month or less.
To use one of these rights, send an email to info@norrwyn.com. You must first confirm that the account is yours.
No system is fully secure. If a breach puts your data at risk, the regulator receives a notification in 72 hours or less. If the risk to you is high, you receive a notification.
If you find a security fault, send a message to info@norrwyn.com before you tell other people.
Deletion is immediate and permanent. There is no delay period, and a deleted account cannot be restored.
Deletion removes your username, your email address and your password, your avatar image, your shelves and their contents, your reviews, your profile and its modules, your social links, the follows in both directions, your Steam connection and the SteamID with it, your scheduled imports and the record of each one, your notifications, and the notifications that your activity created for other people.
Every session token issued to you stops when the account is deleted.
The backups are the one exception. Backshelf makes a database backup each night and keeps it for 14 days. A copy of the account stays in those backups until the last backup made before the deletion is itself deleted. Backups are used only to restore the service after a failure.
The server, the database and the person who operates Backshelf are all in Canada. Your data is held there from the time that you create it.
Backshelf does not operate from the European Union. Your data is not exported out of Europe, because it is collected in Canada. Backshelf applies the standards and the rights in this policy to all users, in all countries.
Data held in Canada is subject to Canadian law. This includes the access that Canadian authorities have under that law.
Cloudflare and Vercel are companies in the United States, so the avatar images and this website are processed there. A contract permits both companies to process the data only as instructed. Where European law applies to such a transfer, the Standard Contractual Clauses of the European Commission and the EU-US Data Privacy Framework cover it.
If you connect Steam, Backshelf sends a request to Valve, also in the United States. This occurs when you start an import, and once a night while you have scheduled imports turned on.
Backshelf is not for children. To create an account you must be 16 years old or more. The terms give the same limit.
If you think that an account belongs to a younger person, send a message to info@norrwyn.com. That account will be removed.
This policy changes when the app changes or when the law changes. The date at the top of the page gives the last change.
Send questions, corrections and requests to info@norrwyn.com.