Privacy and data

Local first#

Your library, play history, screenshots, save backups and settings live in %LOCALAPPDATA%\GalShelf on your computer. The desktop app works without an account and without any online service.

Services GalShelf contacts#

GalShelf contacts a service only when you use a feature that needs it:

• catalogue sources you search or refresh from: VNDB, KUN Galgame (鲲 Galgame), Shionlib, Bangumi, 誠也の部屋, NextMoe and TouchGal (only with keys),
• Steam, when you link it or import from it,
• the GalShelf service at galshelf.com, when you sign in, upload, look up fingerprints (if enabled) or use the NextMoe calendar,
• the galbd bridge you configured,
• the model provider you configured for the companion,
• the public release page, to check for updates.

There is no general usage telemetry. If you enable website save status, the service receives the specific backup-activity summaries described below.

What is not sent to GalShelf's servers#

• Save files, snapshot manifests, save filenames, save hashes, absolute local paths, game file contents and provider credentials are not part of the website save-status index or fingerprint contributions. Save files and manifests go to the backup provider or folder you choose.
• Exports never include pairing keys or Steam keys.

Library sync and the account upload do include your notes (up to 20,000 characters per work), so don't keep secrets in notes you sync. The optional QQ group ranking shares only a work's ID, VNDB ID, title, minutes played, play count and score.

What the website keeps#

• Your account shelf, account details and linked services.
• Passwords only as salted, irreversible hashes.
• For browsers authorised through the QQ group flow: the visiting IP address, a browser device identifier and the authorised client, kept for 90 days as security records.
• An account audit log, kept for 180 days.
• The Steam developer key exists only on the server.
• If enabled, private save-status observations: canonical work and opaque account-scoped line/device references, provider kind, reported backup/source time, generation, file count, aggregate bytes and coarse status. No save files, manifests, file lists, hashes, location templates, custom labels, provider tokens or provider object links are accepted.

Where secrets are kept#

• On your computer, the GalShelf session and the Steam link are encrypted for your Windows user (DPAPI); the QQ credential file is restricted to your Windows user.
• On the server, NextMoe tokens are kept only when encrypted, and Steam and Bangumi links are sealed.

Cookies#

The website uses only functional cookies: your sign-in session, galshelf_lang for the language you chose, and galshelf_docs_theme for the light or dark docs theme. None of them track you.

Fingerprints#

Fingerprint lookup and contribution are independent choices. Enabling Cloud Saves presents both as enabled for new choices, explains what leaves this computer, and lets you disable either. Existing explicit privacy opt-outs survive upgrades and activation; an upgrade alone never starts a new upload behavior. With consent, automatic lookup and bounded contributions can help identify compatible releases and generic save locations. Contributions are tied to your account for abuse prevention and are not anonymous to GalShelf. They do not include saves or save hashes, file contents, absolute paths, usernames, screenshots, secrets, directory trees or private custom names inside relative templates. Bare filenames remain separately controlled. See Game fingerprints.

Cloud storage and cloud saves#

Save files and snapshot manifests go to Google Drive (GalShelf's app-data area), OneDrive (Apps › GalShelf) or the backup folder you choose, not to GalShelf's servers. Manifests may include portable logical destinations such as {install_dir}/savedata; absolute local paths stay on your device. Private custom names are not automatically suitable for community contribution. Provider storage encryption is not end-to-end; optional end-to-end encryption uses your own passphrase, which nobody can recover if lost. Missing encryption configuration cannot silently switch future backups to plaintext. See Cloud storage and Cloud saves.

Private website save status#

Website save status is a separate, visible choice when enabling Cloud Saves. It can be disabled independently. Only your signed-in account can read the metadata. Each device reports separately, with source time, server receipt time and freshness. An old or offline report is not real-time provider status. The website cannot decide conflicts, restore saves or delete provider history. Website unavailability does not block desktop-to-provider save operations.

Use Hide and delete website save status to disable publication, discard pending updates and remove the account's current index metadata. Re-enabling is explicit. This deletes no save files, provider versions or fingerprint data. Account/index and fingerprint databases have separate encrypted, restricted operational backups with finite retention; deleted metadata can remain in those protected backups until their retention expires. Required recovery secrets are protected inside an independently encrypted backup, with its key kept separately.

Removing your data#

• Delete %LOCALAPPDATA%\GalShelf to remove all local data (after uninstalling, see Getting started).
• Remove works from your website shelf at any time. For anything else about your account data, contact the service operator through the channel you received GalShelf from.
• Website-status export contains only your private metadata. The corresponding delete action affects that index only. Fingerprint contribution and withdrawal have separate controls; see Game fingerprints.