Privacy Policy
Our Privacy-First Approach
CourseShelf is built with privacy as a core principle. We collect only the minimal data necessary to provide our service and never share personal information with third parties for marketing purposes.
Information We Collect
Account Information (OAuth Only)
- • Name and Email: Provided by Google or GitHub OAuth
- • Profile Picture: Avatar URL from your OAuth provider
- • OAuth Provider ID: Unique identifier from Google/GitHub
Note: We never store passwords. All authentication is handled securely through OAuth providers.
Profile Information (Optional)
- • Bio: Optional personal description
- • Social Links: Optional Twitter, LinkedIn, GitHub, website links
- • Privacy Settings: Profile visibility preferences
All profile information is optional and under your control.
Activity Feed Data
CourseShelf features an activity feed that showcases community interactions to help users discover courses and connect with fellow learners.
What Activity Data We Collect:
- • User registration events
- • Course submissions and additions
- • Course reviews and ratings
- • Personal library additions and status changes
- • Public playlist creations
Privacy Controls:
- • Only users with public profiles appear in the activity feed
- • Only public playlists generate activity events
- • You can make your profile private at any time to stop appearing in the feed
- • Activity data is automatically deleted when you delete related content
Purpose: Activity data is used solely to power the community activity feed feature and is not shared with third parties or used for advertising.
Course Interactions
- • Library Status: Courses you've added to your personal library
- • Reviews: Course reviews and ratings you submit
- • Playlists: Custom course collections you create
- • External Clicks: When you click "Watch" buttons to visit course platforms
How We Use Your Information
Platform Functionality
- • Display your profile and manage account settings
- • Enable course reviews, playlists, and library features
- • Provide personalized course recommendations
- • Support user authentication and session management
Service Improvement
- • Understand popular courses and search trends
- • Optimize platform performance and user experience
- • Identify gaps in our course catalog
- • Monitor platform usage and technical issues
Creator Features
- • YouTube Channel Verification: Verify ownership of YouTube channels
- • OAuth Integration: Secure verification through YouTube API
- • Creator Badges: Display verified creator status on profiles
YouTube verification uses OAuth and only accesses channel information necessary for verification.
Information Sharing
What We DON'T Do
- • No Data Sales: We never sell or rent personal information to third parties
- • No Marketing Emails: We don't send promotional emails (only service-related communications)
- • No Cross-Site Tracking: No tracking pixels or cookies from other websites
- • No Third-Party Analytics: We do not run Google Analytics, Facebook Pixel, or any behavioral tracking
Limited Sharing
- • OAuth Providers: Google/GitHub for authentication (as required)
- • YouTube API: For creator channel verification only
- • Public Profiles: Information you choose to make public
- • Legal Requirements: If required by law or to protect our service
Cookies & Tracking
Session Cookies
- • Authentication: Keep you logged in during your session
- • Flash Messages: Display notifications and form feedback
All cookies are first-party only. We do not use advertising cookies, behavioral tracking, or cross-site fingerprinting.
Third-Party Services
OAuth Providers
- • Google OAuth: Secure authentication and profile information
- • GitHub OAuth: Developer-focused authentication option
- • YouTube API: Channel verification for creators
These services have their own privacy policies. We only access the minimal information needed for authentication and verification.
Course Platform Integration
- • YouTube: Fetch course information and thumbnails
- • Course Platforms: External links to Udemy, Coursera, etc.
When you click external course links, you'll be subject to those platforms' privacy policies.
YouTube Video Embeds
- • Embedded Videos: YouTube videos can be played directly on CourseShelf course pages
- • Privacy-Enhanced Mode: We use YouTube's privacy-enhanced embed domain (youtube-nocookie.com) which delays cookie setting until you play a video
- • Data Collection: When you play an embedded video, YouTube may collect data according to Google's Privacy Policy
- • Alternative: You can always click "Watch" to view videos directly on YouTube instead
Video embeds are lazy-loaded and only activate when you click to play, minimizing data collection until you choose to watch.
AI Features
- • OpenRouter (AI Gateway): We use OpenRouter to power several automated features. The data we send depends on the feature:
- • Topic Tags & Related Courses: A course's public title and description, used to suggest topic tags and rank similar courses
- • "What Learners Say" Digest: Public YouTube comments from a course's videos, used to generate a short summary of learner feedback
- • No Personal Account Data: Only public course metadata and public YouTube comments are sent — never your name, email, or other personal account information
These features run automatically in the background and are governed by OpenRouter's privacy policy. Raw YouTube comments are not stored — only the generated summary. We never send your personal account data to AI providers.
Data Retention
- • Account Data: Retained until you delete your account
- • Reviews & Playlists: Retained for platform functionality
- • OAuth Tokens: Refreshed as needed, expired tokens deleted
Note: Account deletion functionality is planned for future implementation. Currently, please contact us directly for account deletion requests.
Your Rights
Privacy Controls
- • Profile Visibility: Make your profile public or private
- • Playlist Privacy: Create public or private course collections
- • Optional Information: All profile details are optional
Data Access & Portability
- • Request access to your personal data
- • Correct inaccurate information in your profile
- • Request account deletion (contact us directly)
Note: Data export functionality for playlists and library data is planned for future implementation.
GDPR & CCPA Rights
- • Right to Access: Request a copy of all personal data we hold about you
- • Right to Rectification: Correct any inaccurate or incomplete personal data
- • Right to Erasure: Request deletion of your personal data ("right to be forgotten")
- • Right to Portability: Receive your data in a structured, machine-readable format
- • Right to Object: Object to processing of your personal data for certain purposes
- • Right to Restrict Processing: Limit how we use your personal data in certain circumstances
To exercise these rights, contact us at support@thecourseshelf.com. We will respond within 30 days.
Children's Privacy (COPPA Compliance)
Age Requirements
- • Minimum Age: CourseShelf is not intended for children under 13 years old
- • No Knowingly Collection: We do not knowingly collect personal information from children under 13
- • Parental Discovery: If we become aware that a child under 13 has provided personal information, we will delete it immediately
- • Parental Rights: Parents can contact us to review, delete, or stop collection of their child's information
If you believe your child under 13 has created an account, please contact us immediately at support@thecourseshelf.com.
Data Security & Breach Notification
Security Measures
- • OAuth Security: No password storage, using secure OAuth providers
- • Data Encryption: All data transmitted over HTTPS with automatic TLS encryption
- • Infrastructure Security: Hosted on SOC 2 Type 2 certified and ISO 27001 compliant infrastructure
- • Volume Encryption: Database storage encrypted at rest with secure key management
- • Regular Backups: Automated database backups and monitoring
- • Access Controls: Limited access to personal data on a need-to-know basis
Breach Notification
- • Prompt Notification: In the event of a data breach affecting personal information, we will notify affected users within 72 hours
- • Notification Methods: Email notification and prominent website notice
- • Information Provided: Nature of the breach, data involved, and steps being taken
- • Regulatory Compliance: We will comply with all applicable data breach notification laws
International Data Transfers
- • Company Location: CourseShelf is operated by Berg Tecnologia, incorporated in Brazil
- • Data Storage: Your data is primarily stored and processed on servers located in the United States
- • Third-Party Services: Some data may be processed by our service providers (OAuth providers and our AI provider, OpenRouter) in various countries
- • Adequate Protection: We ensure all international transfers have appropriate safeguards in place
- • EU Users: For European users, we rely on adequacy decisions and standard contractual clauses where applicable
- • Brazilian Users: Data transfer to US servers complies with Brazilian data protection laws (LGPD)
We only transfer data internationally when necessary for service functionality and with appropriate legal protections.
Terms of Service
This Privacy Policy works alongside our Terms of Service to define your rights and our responsibilities.
Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
- • Email: support@thecourseshelf.com
- • Website: https://thecourseshelf.com
We'll respond to privacy inquiries within 30 days.
Policy Updates
We may update this Privacy Policy occasionally to reflect changes in our practices or legal requirements. When we make significant changes:
- • We'll update the "Last Updated" date at the top of this policy
- • For major changes, we'll provide notice on our website
- • Your continued use of CourseShelf constitutes acceptance of the updated policy
Thank you for trusting CourseShelf with your privacy.