Privacy Policy

Offline-first and local storage

AudioShelf plays audiobooks on your Android device, including through Android Auto. Library information, listening progress, listening history, statistics, and settings are stored locally. No AudioShelf account is required. Our public website provides app information; it is not a web audiobook player.

Google data accessed and how it is used

Connecting Google Drive is optional and starts when you choose the Drive connection feature. Google handles account selection and permission approval. AudioShelf uses your Google account email/account name to identify the connected account and obtain permission to read Drive. Google’s authorization response can include an account identifier and basic profile information; AudioShelf uses the email/account name, not your profile picture or display name, for this feature. Older versions also request the basic profile permission.

AudioShelf requests read-only Drive access (https://www.googleapis.com/auth/drive.readonly), together with account identity permissions (email and OpenID). This permission allows browsing and reading files across your Google Drive; it is not limited by Google to files individually selected in AudioShelf. The app lists folders as you browse and reads the selected audiobook folders, their subfolders, and shortcut targets to prepare downloads.

• File and folder names, identifiers, MIME types, file sizes, and shortcut target information are used to display folders, find supported files, preserve folder organization, and calculate download progress.
• Audio files, playlist files, and cover images are read and downloaded directly from Google Drive to your device. Audio tags and embedded artwork are processed locally to build the library. Playlist contents determine chapter ordering.
• You can listen to locally available audio while further files download. AudioShelf does not use a streaming proxy or copy your Drive files to AudioShelf servers.
• The Drive integration does not upload, modify, or delete Google Drive originals, perform two-way synchronization, or create Drive backups. A destination you select through Android’s document picker is handled by that document provider and can have its own storage or synchronization behavior.

Read-only access is needed to browse existing audiobook folders and download their contents recursively. Permission to an app’s private Drive configuration folder would not provide access to those audiobooks. Per-file access would require a different selection workflow and does not provide the current folder-browsing access.

How We Protect Google User Data

• Encrypted communication: Google account lookup and Drive API requests use HTTPS/TLS. Access tokens are sent in the Authorization header to Google, rather than in download links. Google Play services handles authorization and token acquisition.
• Limited token storage: AudioShelf uses access tokens in application memory for requests. It does not save access tokens in its preferences or database, receive or store OAuth refresh tokens, or exchange authorization codes on an AudioShelf server. Google Play services manages its own credential cache.
• Device access controls: the connected email and browser state are held in app memory. The default offline downloads, temporary staging files, and local database use Android app storage, protected by Android’s app sandbox. Files placed in a user-selected location have that location’s access controls. AudioShelf does not add its own database or audiobook encryption.
• Read-only permissions: the Google Drive API integration uses read requests; it cannot write or delete your originals using its requested Drive scope. Access is initiated for the optional Drive feature.
• Diagnostic controls: crash reporting can be disabled in Settings → Privacy. Sentry’s default personal-information collection is disabled, and AudioShelf does not attach audio files to crash reports. Diagnostics can still include file identifiers, paths, or error details, particularly in older app versions; see the sharing and retention sections below.

These protections depend in part on Android, Google’s services, and the security of your device and chosen storage provider. No claim is made that downloaded files or the local database have additional AudioShelf encryption.

Data Retention

• OAuth access tokens: AudioShelf holds them in memory while authorization or API requests run; it does not maintain a persistent token store. Google Play services manages cached credentials and token expiry. Disconnecting the app’s local session alone in older versions does not remove Google’s permission grant. Revoke that grant using Google’s permissions page as described below.
• OAuth refresh tokens: AudioShelf does not receive or retain them. Google’s own account and credential storage is controlled by Google, not by AudioShelf.
• Account/profile information: the selected email/account name is kept in the running app to identify the Drive connection, until disconnection or the app process ends. AudioShelf does not store a profile or Google account record in its database or on a backend. Google sign-in services may retain their own account selection and consent state.
• Drive browser metadata: folder listings and navigation identifiers are held in memory for browsing, until cleared by disconnection or process termination. Downloaded file names and paths, extracted audio metadata, cover information, progress, and listening records can remain in local library storage after disconnecting.
• Downloaded audio, playlists, and images: these are retained for offline listening until you delete them. Disconnecting or revoking permission does not delete completed downloads. Files outside app-private storage can remain after clearing app storage or uninstalling.
• Temporary files: download staging files are placed in the app cache. The app attempts cleanup after import and when a download is cancelled. A failed operation or interrupted process can leave files behind until you clear the app cache or app storage; do not rely on automatic cache eviction for deletion.
• Backend records: there is no AudioShelf backend account, Drive token database, or server copy of Google Drive audio to retain or delete.
• Local diagnostic logs: debug builds keep up to ten session log files, pruned as new sessions start. Older releases may also have written session logs containing file names, paths, identifiers, and exception details. Updating does not necessarily remove those older files: they remain until pruned or deleted, including by clearing the relevant app storage. There is no time-based expiry for local session logs.
• Firebase Analytics: the linked Google Analytics property is configured to retain user-level and event-level data for two months, with retention renewal on new activity disabled. The user-data setting was reduced from fourteen months on September 5, 2026; Google applies retention-setting changes after 24 hours and deletes expired data during its monthly deletion cycle. These controls do not set an expiry for standard aggregated reports, which can remain available beyond two months. See Google’s explanation of Analytics retention.
• Sentry diagnostics: previously submitted reports, including reports from older versions that may contain Drive paths or identifiers, remain subject to Sentry’s project and subscription retention controls. We have not yet verified the applicable event-retention period and therefore cannot state a fixed expiry. A client update does not retrospectively sanitize reports already received by Sentry. Contact us about deletion of diagnostic records that can be identified.
• Backups: Android backup and device transfer are configured to include AudioShelf’s settings and local database, which may contain downloaded audiobook metadata, paths, and listening records. The backup configuration does not include audio downloads or session logs. Existing device backups have a separate lifecycle: deleting current app data does not guarantee deletion of older backups. Manage those copies through your Android/Google backup settings; other storage providers may retain their own copies. AudioShelf does not operate a separate backend backup of your Drive files.

Disconnecting Google Drive and Deleting Google User Data

1. Disconnect in AudioShelf: use “Disconnect Google Drive” in Settings or the Drive browser. This clears the local connected-account display and Drive browser state and requests cancellation of active downloads. Cancellation cleanup is attempted for files written by that download session; completed downloads from earlier sessions remain available offline.
2. Revoke Google access: open Google Account permissions, select AudioShelf, and remove its access. This removes Google’s authorization grant but does not delete local audio or Google Drive originals. Previously issued access tokens may remain usable until Google processes revocation. Reconnect and approve access again if you want to use Drive later. Older AudioShelf versions only disconnect locally, so use this Google control to revoke access.
3. Delete downloads: remove the audiobook from the library and review the confirmation. AudioShelf deletes files in its managed download/import folders and associated chapter progress when removal succeeds. For other folders, removal may only hide the book: delete the files separately with your file manager or storage provider. Library removal is not a complete erasure of all historical listening records.
4. Delete all device-local app data: in Android Settings, open Apps → AudioShelf → Storage (wording varies by device) and use Clear storage / Clear data. This resets the app’s private database, preferences, and private downloads. Use Clear cache to remove cached temporary files. Delete any externally stored downloads and old session logs separately if they remain, and manage device backups separately. Do not restore an old backup if you want deleted library data to stay deleted.
5. No AudioShelf account deletion is needed: the app has no AudioShelf account system. Clearing device storage and revoking Google access are separate steps; neither deletes your Google account or your original Drive files.
6. Contact: email hello@audioshelf.app for help or to request deletion of diagnostic information that can be identified. Include the app version, approximate incident date/time and time zone, and whether your request concerns diagnostics or analytics. Include a report reference only if you already have one; do not send tokens, passwords, Drive links, or audiobook contents. We may need additional non-sensitive information to confirm which records the request concerns before taking action. An email address alone may not identify anonymous or pseudonymous SDK records, and we cannot promise to locate an individual entry in aggregated reports. We cannot remotely erase files on your device or remove your Google backups. We will explain the applicable deletion steps and any provider limitations; no automatic remote deletion deadline is promised.

Local clearing takes effect when the Android operation completes; individual file deletion depends on successful storage access. Google revocation requires connectivity and completion by Google. Disabling analytics or crash reporting stops future collection through the app’s controls; it does not instantly delete previously submitted records. Already submitted diagnostics and existing backups are not removed by local clearing.

Data sharing, analytics, and crash reports

Google processes authorization and serves Drive data directly to the Android app. AudioShelf has no backend receiving your Drive tokens, account profile, or audio files. Firebase Hosting serves this public website and handles normal website requests; the website contains no Drive sign-in or file-upload feature.

Firebase Analytics: when enabled, the app sends usage events, app/device information, library-size buckets, Drive connection status, download counts, results, and timing information to Google’s Firebase Analytics. The analytics code does not send Google account email, Drive file names/identifiers, access tokens, or audio contents. Analytics is off until enabled in current versions and can be disabled in Settings → Privacy. SDK-generated identifiers mean these records should not be described as guaranteed anonymous.

Sentry: when enabled, crash reports, handled exceptions, device/app context, and activity breadcrumbs go to Sentry to diagnose failures. Crash reporting is enabled by default in release versions and can be disabled in Settings → Privacy. Error messages and older Drive navigation breadcrumbs can include file paths or identifiers. AudioShelf does not attach audiobook contents or deliberately supply Google account identity to Sentry. Turning reporting off stops future collection through the app’s telemetry controls; it is not deletion of previously received reports.

Ads and purchases: versions with optional rewarded ads use Google Mobile Ads, which processes its own advertising and device-related information; purchases use Google Play Billing. AudioShelf does not pass Google Drive API contents, file metadata, Google account email, or Drive tokens to advertising or billing code.

AudioShelf does not sell Google user data, transfer it for advertising, use it to build creditworthiness or lending profiles, or use it to train generalized AI or machine-learning models. Its Google API access is used for the described Drive browsing, download, and playback functionality, with operational diagnostics as described above, not unrelated uses.

AudioShelf’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Children

AudioShelf is not directed to children under 13.

Contact and policy updates

For privacy questions, deletion assistance, or concerns about this policy, contact hello@audioshelf.app. Changes to this policy will be published at this URL with an updated date.