Our Privacy-First Approach
CourseShelf is built with privacy as a core principle. We collect only the minimal data necessary to provide our service, use anonymous analytics, and never share personal information with third parties for marketing purposes.
Information We Collect
Account Information (OAuth Only)
- • Name and Email: Provided by Google or GitHub OAuth
- • Profile Picture: Avatar URL from your OAuth provider
- • OAuth Provider ID: Unique identifier from Google/GitHub
Note: We never store passwords. All authentication is handled securely through OAuth providers.
Profile Information (Optional)
- • Bio: Optional personal description
- • Social Links: Optional Twitter, LinkedIn, GitHub, website links
- • Privacy Settings: Profile visibility preferences
All profile information is optional and under your control.
Analytics Data (Anonymous)
- • Page Views: Which pages you visit on CourseShelf
- • Search Queries: What you search for to improve our course catalog
- • Device Information: Device type (mobile/tablet/desktop) from user agent
- • Traffic Sources: How you found us (social media, search engines, direct)
- • UTM Parameters: Marketing campaign data when you click tracking links
- • Country Location: Derived from IP address for regional insights
Privacy Protection: All analytics use anonymous session IDs with 24-hour expiry. No personal identifiers are stored in analytics data.
Activity Feed Data
CourseShelf features an activity feed that showcases community interactions to help users discover courses and connect with fellow learners.
What Activity Data We Collect:
- • User registration events
- • Course submissions and additions
- • Course reviews and ratings
- • Personal library additions and status changes
- • Public playlist creations
Privacy Controls:
- • Only users with public profiles appear in the activity feed
- • Only public playlists generate activity events
- • You can make your profile private at any time to stop appearing in the feed
- • Activity data is automatically deleted when you delete related content
Purpose: Activity data is used solely to power the community activity feed feature and is not shared with third parties or used for advertising.
Course Interactions
- • Library Status: Courses you've added to your personal library
- • Reviews: Course reviews and ratings you submit
- • Playlists: Custom course collections you create
- • External Clicks: When you click "Watch" buttons to visit course platforms
How We Use Your Information
Platform Functionality
- • Display your profile and manage account settings
- • Enable course reviews, playlists, and library features
- • Provide personalized course recommendations
- • Support user authentication and session management
Service Improvement
- • Understand popular courses and search trends
- • Optimize platform performance and user experience
- • Identify gaps in our course catalog
- • Monitor platform usage and technical issues
- • Provide anonymous analytics insights and downloadable data to Advertiser plan users
Creator Plan Features
- • YouTube Channel Verification: Verify ownership of YouTube channels
- • OAuth Integration: Secure verification through YouTube API
- • Creator Badges: Display verified creator status on profiles
YouTube verification uses OAuth and only accesses channel information necessary for verification.
Information Sharing
What We DON'T Do
- • Privacy-First Analytics: We use Plausible.io for basic analytics - a privacy-friendly alternative to Google Analytics
- • No Data Sales: We never sell or rent personal information to third parties
- • No Marketing Emails: We don't send promotional emails (only service-related communications)
- • No Cross-Site Tracking: No tracking pixels or cookies from other websites
Limited Sharing
- • OAuth Providers: Google/GitHub for authentication (as required)
- • YouTube API: For Creator plan channel verification only
- • Public Profiles: Information you choose to make public
- • Legal Requirements: If required by law or to protect our service
Cookies & Tracking
Session Cookies
- • Authentication: Keep you logged in during your session
- • Analytics Session: Anonymous session tracking (24-hour expiry)
- • Flash Messages: Display notifications and form feedback
All cookies are first-party only and expire within 24 hours.
Privacy-First Third-Party Analytics
- • Plausible.io: Privacy-friendly analytics with no cookies, no cross-site tracking, and GDPR/CCPA compliant
- • No Google Analytics, Facebook Pixel, or invasive trackers
- • No advertising cookies or behavioral tracking
- • No cross-site tracking or fingerprinting
- • No persistent user identification across sessions
Third-Party Services
OAuth Providers
- • Google OAuth: Secure authentication and profile information
- • GitHub OAuth: Developer-focused authentication option
- • YouTube API: Channel verification for Creator plan users
These services have their own privacy policies. We only access the minimal information needed for authentication and verification.
Analytics & Course Platform Integration
- • Plausible.io: Privacy-first web analytics (see their privacy policy)
- • YouTube: Fetch course information and thumbnails
- • Course Platforms: External links to Udemy, Coursera, etc.
When you click external course links, you'll be subject to those platforms' privacy policies.
Data Retention
- • Account Data: Retained until you delete your account
- • Analytics Data: Anonymous session data with 24-hour cookie expiry
- • Reviews & Playlists: Retained for platform functionality
- • OAuth Tokens: Refreshed as needed, expired tokens deleted
Note: Account deletion functionality is planned for future implementation. Currently, please contact us directly for account deletion requests.
Your Rights
Privacy Controls
- • Profile Visibility: Make your profile public or private (Student plan feature)
- • Playlist Privacy: Create public or private course collections (Student plan feature)
- • Optional Information: All profile details are optional
Data Access & Portability
- • Request access to your personal data
- • Correct inaccurate information in your profile
- • Request account deletion (contact us directly)
Note: Data export functionality for playlists and library data is planned for future implementation.
GDPR & CCPA Rights
- • Right to Access: Request a copy of all personal data we hold about you
- • Right to Rectification: Correct any inaccurate or incomplete personal data
- • Right to Erasure: Request deletion of your personal data ("right to be forgotten")
- • Right to Portability: Receive your data in a structured, machine-readable format
- • Right to Object: Object to processing of your personal data for certain purposes
- • Right to Restrict Processing: Limit how we use your personal data in certain circumstances
To exercise these rights, contact us at support@thecourseshelf.com. We will respond within 30 days.
Children's Privacy (COPPA Compliance)
Age Requirements
- • Minimum Age: CourseShelf is not intended for children under 13 years old
- • No Knowingly Collection: We do not knowingly collect personal information from children under 13
- • Parental Discovery: If we become aware that a child under 13 has provided personal information, we will delete it immediately
- • Parental Rights: Parents can contact us to review, delete, or stop collection of their child's information
If you believe your child under 13 has created an account, please contact us immediately at support@thecourseshelf.com.
Data Security & Breach Notification
Security Measures
- • OAuth Security: No password storage, using secure OAuth providers
- • Data Encryption: All data transmitted over HTTPS with automatic TLS encryption
- • Infrastructure Security: Hosted on SOC 2 Type 2 certified and ISO 27001 compliant infrastructure
- • Volume Encryption: Database storage encrypted at rest with secure key management
- • Regular Backups: Automated database backups and monitoring
- • Access Controls: Limited access to personal data on a need-to-know basis
Breach Notification
- • Prompt Notification: In the event of a data breach affecting personal information, we will notify affected users within 72 hours
- • Notification Methods: Email notification and prominent website notice
- • Information Provided: Nature of the breach, data involved, and steps being taken
- • Regulatory Compliance: We will comply with all applicable data breach notification laws
Analytics Privacy
Our Privacy-First Analytics
- • Anonymous Sessions: Random session IDs, no personal identifiers
- • 24-Hour Expiry: Analytics cookies automatically expire
- • No Cross-Session Tracking: Each visit creates a new anonymous session
- • Aggregated Data Only: We analyze trends, not individual behavior
- • No Third-Party Access: Analytics data stays within CourseShelf
Our analytics help us understand what courses are popular and how to improve the platform, while maintaining your privacy through anonymous data collection.
International Data Transfers
- • Company Location: CourseShelf is operated by Berg Tecnologia, incorporated in Brazil
- • Data Storage: Your data is primarily stored and processed on servers located in the United States
- • Third-Party Services: Some data may be processed by our service providers (OAuth providers, analytics) in various countries
- • Adequate Protection: We ensure all international transfers have appropriate safeguards in place
- • EU Users: For European users, we rely on adequacy decisions and standard contractual clauses where applicable
- • Brazilian Users: Data transfer to US servers complies with Brazilian data protection laws (LGPD)
We only transfer data internationally when necessary for service functionality and with appropriate legal protections.
Terms of Service
This Privacy Policy works alongside our Terms of Service to define your rights and our responsibilities.
Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
- • Email: support@thecourseshelf.com
- • Website: https://thecourseshelf.com
We'll respond to privacy inquiries within 30 days.
Policy Updates
We may update this Privacy Policy occasionally to reflect changes in our practices or legal requirements. When we make significant changes:
- • We'll update the "Last Updated" date at the top of this policy
- • For major changes, we'll provide notice on our website
- • Your continued use of CourseShelf constitutes acceptance of the updated policy