Wondershelf is a library app that helps a school keep track of its library books, its students and the books they borrow. In this policy, "the school" means the school that uses Wondershelf for its library. This policy explains what information Wondershelf holds, why, who can see it, how long it's kept and how to have it deleted.
Who we are
Wondershelf is written and run by Aaron Jackson, an individual developer, free of charge for the school ("we", "us"). We run Wondershelf for the school and under its direction. The school decides what goes into Wondershelf and controls that information. We use it only to provide the library service to the school.
For student information covered by the Family Educational Rights and Privacy Act (FERPA), we act as a "school official" with a legitimate educational interest. That means we work under the school's direct control and don't share the information with anyone else except as this policy describes.
Who uses Wondershelf
Only adult school staff, such as librarians and teachers, sign in to Wondershelf. Students don't sign in or use the app. Staff enter student information on the school's behalf.
What information we hold
About staff who sign in
- Your sign-in identity from Google or Apple: an account ID, your email address and your name. If you use Sign in with Apple and choose to hide your email, we receive Apple's private relay address instead.
- Which school library you belong to and your role (for example, owner or librarian).
- Invitations you send or receive to join a library.
- Technical sign-in records, such as your IP address and device type, which Google's sign-in service keeps for a few weeks for security.
About students (entered by staff)
- Name, classroom, grade level and student number.
- Borrowing history: which book a student borrowed, when it's due and when it was returned.
About the library
- The book catalog: titles, authors, ISBNs and similar details. This isn't personal information.
What we don't collect
- No advertising, analytics or crash-reporting tools.
- No location, contacts, camera, photos or files from your device.
- No information collected directly from students.
How we use it
Only to run the school's library: signing staff in, managing the catalog and student roster, and checking books in and out.
We don't sell information, show ads, build profiles of students or staff, or use student information for any purpose other than the school's library. We don't use it to train AI models.
Who can see it
- Staff of the school's library who have been invited and signed in. Each library's information is visible only to its own members.
- Service providers that run Wondershelf for us, only as needed
to provide the service:
- Google (Firebase) stores the information and handles sign-in, under Google's Firebase Data Processing and Security Terms.
- Apple handles Sign in with Apple, if you use it.
- Open Library (Internet Archive) and the Google Books API look up book details and cover images. Only the book's ISBN and your device's IP address are sent. No student or staff information is sent.
- When the law requires it, for example a valid court order. We will tell the school first unless the law forbids it.
We don't share information with anyone else.
Where it's stored and how it's protected
Information is stored with Google Firebase in the United States. It's encrypted in transit and at rest. Access rules on the database let each library's members see only that library's information. Only library owners can delete students or the library. Only we have administrative access to the Firebase project, through a Google account protected by two-step verification.
If we learn of a security breach affecting the school's information, we'll notify the school promptly so it can meet its own obligations, including under Idaho's breach-notice law.
How long we keep it
- Borrowing records are deleted automatically 3 years after the book is returned. Records for books still checked out are kept until the book is returned.
- Students: when library staff delete a student, the student and their borrowing history are removed immediately.
- The whole library: when the school deletes its library, or asks us to when it stops using Wondershelf, all of its information is removed immediately.
- Staff accounts are kept until you delete your account (see below) or the school removes you from its library.
After deletion, copies can remain in Google's daily database backups for up to 14 days, and Google's sign-in service removes deleted accounts within 180 days. These copies aren't used and expire on their own.
Your choices and rights
Parents and eligible students who want to see, correct or delete a student's information should contact the school. Under FERPA the school handles these requests, and we'll help it carry them out.
Staff can see their own information in the app and ask the school library's owner to correct it.
Delete your Wondershelf account
You can delete your Wondershelf account at any time:
- Open Wondershelf and sign in.
- Go to Settings › Account › Delete Account.
- Confirm.
This deletes your sign-in account and your membership in every library, and revokes Wondershelf's access to your Apple or Google sign-in. It doesn't delete the library's books or student records, because those belong to the school. Records you made, like checkouts, stay with the library but are no longer linked to an account. If you can't access the app, email from the address you sign in with and we'll delete your account within 30 days.
Changes to this policy
If we make a material change, we'll tell the school before it takes effect and update the date and version above. Past versions are kept at wondershelf.web.app/versions.
Contact
Questions about this policy or Wondershelf's handling of information: wondershelflibrary@gmail.com.
Questions about a student's records: contact the student's school.