Shopy 101 Privacy Policy

Last updated: 6 September 2026

Data controller: SHOPY 101 LTD (company no. 16388100, England and Wales).
Registered address: Suite 8953, 5 Brayford Square, London, E1 0SG, United Kingdom
Contact: help@shopy101.com

This policy covers both the Shopy 101 mobile app and the website at shopy101.com. It is not a generic template; it describes what the service actually does.

1. WHAT WE COLLECT

ACCOUNT

• Your email address and display name (on sign-up or Google sign-in)
• The username you choose
• Your profile photo, if you set one
• When your account was created and last updated

USE AND LIBRARY

• The works you add to your library and when
• Your progress in each work (percentage, last read time); for audiobooks the chapter and exact position
• Your reading streak (current streak, longest streak, last active day)
• Your favourite lists and their contents
• The genres you engage with — this builds the 'For You' shelf
• Ratings and reviews you write (shown publicly with your display name)

PURCHASES

• The products you bought, the amount paid and when
• We do NOT collect or store card details. Payment runs through Stripe and card details are entered on Stripe's own secure screen.

IF YOU ARE A SELLER — ADDITIONAL DATA

• Your store name, description and logo
• The products and files you upload
• Your earnings and payout records via your Stripe account
• Your identity verification data (collected and verified by Stripe)
• Your tax identification details and address — collected because the law requires it (see section 4)

AUTOMATIC

• Firebase Analytics: screens opened, features used, search terms, approximate device and app information
• Firebase Crashlytics: crash reports — device model, OS version, technical state at the time of the crash
• Firebase Cloud Messaging: a notification token if you allow notifications

2. WHY WE COLLECT IT

• To create your account and sign you in (performance of contract)
• To remember your library, position, favourites and streak across devices (performance of contract)
• To deliver and record your purchases (performance of contract)
• To run seller payouts and meet our tax obligations (legal obligation)
• To prevent fraud and abuse (legitimate interest)
• To send notifications if you allow them (consent)
• To find and fix crashes and improve the app (legitimate interest)

3. AI CONTENT REVIEW

When a seller uploads a product, the product's TITLE, DESCRIPTION and CATEGORY are sent to Google's Gemini service for automated pre-publication review, checking for suspected copyright infringement and illegal content.

The product FILE ITSELF is never sent. No buyer data is ever sent.

You can appeal a decision; appeals are reviewed by a person.

4. WHO ELSE PROCESSES YOUR DATA

• Google (Firebase): authentication, database, file storage, analytics, crash reporting, notifications, AI pre-review. Data is held on Google Cloud servers in the United States (us-central1) and Europe (europe-west1, europe-west3).
• Stripe: payment processing and seller identity verification.
• Content sources: opening a work downloads its file from the source, and that service can see the request. Sources: Project Gutenberg, LibriVox, Wikisource, Wikibooks, OpenStax, NASA, The Metropolitan Museum of Art, the Art Institute of Chicago, the Internet Archive, Google Fonts.
• HMRC (UK tax authority): if you are a seller, under the legal obligation below.

SELLER INCOME REPORTING. UK law requires digital platforms to report their sellers' identity and income to HMRC each year. If you are a seller, your name, address, date of birth or tax/company number, bank account details and the income you earned through the platform are reported to HMRC once a year. You are given a copy of what was reported. This is a legal obligation, not an option.

INTERNATIONAL TRANSFERS. Some of your data is processed on servers outside the UK and Europe, in the United States (Google Cloud us-central1, Stripe). These transfers rely on the safeguards required by UK and EU data protection law (standard contractual clauses and equivalent mechanisms). Write to help@shopy101.com if you want details of the safeguard relied on.

We do NOT sell your data.

ADVERTISING. The shopy101.com website shows Google AdSense ads. There are NO ads in the Android app. Google and its partners may place cookies in your browser to select and measure ads; those cookies are controlled by Google, not by us. You can manage or switch off Google’s use of your data for advertising at https://adssettings.google.com. If you connect from the European Union, the United Kingdom or Switzerland you are asked for consent before any advertising cookie is set, and you can withdraw that consent at any time. You never have to accept ads in order to read anything in the catalogue.

5. HOW LONG WE KEEP IT

• Account, library, reading progress, favourites and streak: for as long as your account exists.
• Purchase and invoice records: 6 years from the end of the accounting period. SHOPY 101 LTD is registered in England and Wales, and UK tax law (HMRC) requires company records to be kept for that long. These records survive account deletion, but they are ANONYMISED at deletion: the accounting entry remains while the link to your name is removed. After the 6 years they are deleted automatically.
• Crash and analytics data: subject to Google Firebase's default retention periods.

6. YOUR RIGHTS

You have the right to access, correct, delete, port and object to the processing of your data. Where processing is based on consent, you may withdraw it at any time.

You can delete your account and all data linked to it in two ways, and neither requires you to contact us:

• In the app: Profile → "Delete my account" (the red row directly above "Sign out").
• On the web: https://shopy101.com/delete-account/ — sign in there and confirm.

Either route permanently deletes your account, username, profile picture, library, reading progress, favourites, follows and reviews. This cannot be undone and is not a suspension: the data is removed, not hidden. The only exception is the anonymised accounting records described in section 5.

You have these rights under UK GDPR, under GDPR in the European Economic Area, and under KVKK in Türkiye. To exercise them, write to help@shopy101.com; we respond within 30 days at the latest.

If you are unhappy with our response you can complain to your national data protection authority (UK: ICO; Türkiye: KVKK Authority).

7. AGE

You must be at least 18, or of legal age in your country, to hold an account. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.

8. NOTIFICATIONS

Notifications are optional and off until you allow them. You can turn them off in your device settings at any time without losing any other feature.

9. CHANGES

For a material change we will update the date above and notify you in the app before it takes effect.

10. CONTACT

help@shopy101.com