Trust & security
What we do with your stuff.
Shelf asks you to trust it with three things: your apps, a little of your data, and a dollar. Here's exactly how each is handled. No jargon, and only claims we can actually stand behind.
Security posture last reviewed 30 August 2026. Every item below says how we know it's true.
Your apps
- By designWe never run your code
A live preview is your app loading from your host inside a sandboxed frame. Shelf doesn't copy, host, or execute anyone's code, so nothing you built runs on our servers, and nothing another maker built runs against you.
- How we operateCredit first, takedown on request
We feature apps from public showcases with full credit and a link back. If one is yours and you want it changed or gone, email us. Done within 24 hours, no forms, no reason needed.
Your data
- By designWe collect as little as we can
Anonymous usage analytics, plus whatever you deliberately type into a form, usually an email and a handle. We don't sell it or hand it to advertisers, and you can have it deleted on request.
- By designThe demo sign-in never sends a password
Shelf accounts aren't open yet. The preview sign-in is checked entirely in your browser. The password is never transmitted or stored anywhere.
- VerifiedForm submissions are sanitized
Our capture endpoint was reviewed and hardened: submissions are size-limited, rate-limited, restricted to expected fields, and neutralized against spreadsheet-formula injection before they touch any downstream tool.
Your money
- VerifiedStripe handles the card; we never see it
The $1 founder pre-order runs entirely through Stripe. Shelf never sees or stores your card details.
- How we operateRefundable, and not a subscription
The $1 is a one-time deposit that locks in your rate, refundable any time, and nothing recurring is charged without you opting in when Pro launches. Full terms on the terms page.
The platform
- VerifiedHTTPS everywhere, dependencies checked
The site is served over HTTPS with a valid certificate, and its dependencies were checked for known vulnerabilities at the last review, with none found.
- By designAn early build, said plainly
Some things you can click (remix, suggestions, accounts) aren't wired up yet. Clicking them tells us to build them, and we say so rather than pretend otherwise.
The honest caveat
This page is a plain-English summary of how Shelf operates and the posture from our own review, not a formal security audit or a compliance certification. It describes only what we can verify or promise, and we'll update the date above when that changes. Questions or something that looks wrong? support@shelfmade.cloud A real person answers.