Privacy policy
Shuriken runs your coding agents on your own computers. Most of what you do never reaches us, and what our cloud keeps for your account is encrypted on your devices where it can be. This page says exactly what we hold, why, for how long and who helps us run it.
1. Who is responsible
The controller of your personal data is Enkova s. r. o., Lehotská 370/22, 972 71 Nováky, Slovakia, IČO 57610657, registered in the Obchodný register Okresného súdu Trenčín, oddiel Sro, vložka č. 57998/R ("we", "us").
Write to office@shuriken.sh about anything on this page. We have not appointed a data protection officer; the same address reaches the people who run Shuriken.
2. What stays on your devices
Shuriken is local-first. Your agents run on your own computers and servers, and the following never reach our cloud:
- your code, files and terminals;
- your chats with agents and their output. When you follow a chat from another of your devices, it travels between your devices end-to-end encrypted through our relay, which cannot read it and does not store it;
- your agent command-line tools' own sign-ins and history;
- audio you record with on-device dictation.
We have no access to this data, and it is governed by your own devices and the providers you choose (sections 5 and 6).
3. The encrypted vault
Your account keeps a vault: your AI providers' sign-ins and API keys, your connectors' tokens, your voice keys and most of your settings. Your project names, folders and repository addresses, your device names and your profile picture are sealed the same way. Your devices encrypt all of it before it leaves them, with a key derived from your password on the device (PBKDF2, 600,000 rounds, then AES-256-GCM).
Your password never reaches us. Signing in sends a key derived from it, from which the vault key cannot be derived. We cannot read your vault, and we cannot recover it: if you lose your password, a reset starts a new, empty vault. One limit: the web app at shuriken.sh/app is delivered by our servers each time you open it, so using it in a browser means trusting those servers. The desktop and phone apps carry their own code.
To route the vault, we keep a few labels in plain form: each item's kind and its name, and whether your notification switches are on.
4. What we keep, why and for how long
The legal bases below are those of the GDPR: performing our contract with you or taking steps you asked for before one (Art. 6(1)(b)), our legitimate interests in keeping Shuriken secure and working (Art. 6(1)(f)) and our legal obligations (Art. 6(1)(c)). We never sell your data, show you ads or use your data to train AI models.
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Waitlist entry: first name, email, what you would use Shuriken for, who invited you, the Terms version shown and when | Deciding who to let in, writing to you about it | Steps you asked for before a contract (6(1)(b)) | Until you ask us to remove it; with an account, until the account is deleted |
| Account: email, first name, a hash of your sign-in key (never your password), the vault's salt and wrapped key, your plan, the Terms version you agreed to and when | Your account, sign-in, your plan, proof of what you agreed to | Contract (6(1)(b)); consent records: legal obligation (6(1)(c)) | Until you delete your account |
| Devices: platform, model, system version, browser, the country, region and city of the sign-in (from the connection, not GPS), local network and wake-on-LAN addresses if you use waking, push notification token, language; device names are encrypted | Showing and managing your devices, waking them, notifications, spotting a sign-in you did not make | Contract (6(1)(b)); security: legitimate interest (6(1)(f)) | Until you remove the device or delete your account |
| Sessions: hashes of your devices' sign-in tokens | Keeping you signed in | Contract (6(1)(b)) | Until you sign out; after an account is deleted, the hashes only, 90 days, so a returning device is told why |
| Encrypted account data: the vault, settings, projects list, profile picture, shared sources and their usage, usage readings | Syncing your setup between your devices and the people you share with | Contract (6(1)(b)) | Until you remove it or delete your account; usage readings 7 days |
| Sharing: the email you invite to a project or source, the invite and its state | Sending the invite and letting that person in | Contract (6(1)(b)) | Until the share ends or either account is deleted |
| Messages between your devices: queued events, notifications waiting for a device, the hours in which chats ran (no content) | Delivering them to devices that were offline; your usage overview | Contract (6(1)(b)) | Until delivered, at most 7 days; finished work hours 48 hours; resolved alerts 3 days |
| Bug reports and feature requests: see section 7 | Fixing what went wrong | Legitimate interest (6(1)(f)) and contract (6(1)(b)) | Until fixed and no longer needed, at the latest until you delete your account |
| Security records: hashed network addresses of failed sign-ins and form submissions; a server's sign-in request with its network address; preview access grants with network address, city and country | Stopping password guessing and abuse, letting you check a request | Legitimate interest (6(1)(f)) | Sign-in requests 1 hour after they expire; preview grants up to a year from last use; hashed addresses while the limit they count applies |
| Email: the address and text of the emails we send you (waitlist confirmation, your sign-in details, invites, account deletion link) and email you send us | Running the service, answering you | Contract (6(1)(b)); legitimate interest (6(1)(f)) | As long as needed to answer, and as the law requires |
| Payments (once paid plans start): plan, period, amounts, invoices; card details stay with the payment provider | Billing, accounting | Contract (6(1)(b)); legal obligation (6(1)(c)) | As accounting and tax law require (in Slovakia, up to 10 years) |
Our cloud records no request logs and no analytics, and our apps send no crash reports or analytics anywhere. When you delete your account we erase its data as described in the app, and keep only a monthly count of deletions.
5. Your AI provider accounts
Shuriken drives the coding agents you connect: Claude Code, Codex and others, with your own subscriptions or API keys. Your prompts, code and the agents' answers go from your device straight to that provider (for example Anthropic, OpenAI or Google), under that provider's own terms and privacy policy. We are not a party to that exchange, we do not see it and we are not the provider's processor for it.
When you share a source with another account, its sign-in is sealed on your device to that person's key and passes through our cloud only in that sealed form.
6. Voice
Dictation and spoken replies are off until you turn them on. With on-device speech, audio never leaves your computer. If you choose a cloud voice provider (OpenAI, Deepgram, ElevenLabs or Speechmatics) with your own key, your device sends the audio straight to that provider under its terms; it never passes through our cloud. Local speech models are downloaded from GitHub on your computer's own request.
7. Bug reports
A bug report or feature request you send from the app contains: the text you write, whether it is a bug or a request, your app version, platform and device, your account, and any screenshots you attach (up to four). Screenshots show what was on your screen, so look before you send. Reports are stored unencrypted with their screenshots' hidden metadata removed, and only the people who run Shuriken can read them. They are erased with your account, and you can ask us to delete one sooner.
8. Processors and recipients
These companies process data for us under data processing terms. Nobody else receives your data from us unless the law obliges us to hand it to an authority.
| Who | What for | What they receive |
|---|---|---|
| Cloudflare, Inc. (USA) | Hosting shuriken.sh: Workers, D1 database, R2 storage, Durable Objects (sync and relay), Turnstile human check, Email Routing | Everything the cloud keeps (section 4), your network address with each request, browser signals for the human check, email you send us |
| Resend (Plus Five Five, Inc., USA) | Sending our emails | Your email address and the email's text |
| Google LLC / Google Ireland Ltd. | Android notifications (Firebase Cloud Messaging); our mailbox, which receives the email you send us | Your Android device's push token and an encrypted notification; email you send us |
| Your browser's push service (Apple, Google, Microsoft or Mozilla) | Web notifications, if you turn them on | An encrypted notification for your browser |
| GitHub, Inc. (USA) | Storing our release files | Nothing about you: downloads and updates come through shuriken.sh. Local speech models come from GitHub directly to your computer. |
The web app also reads public exchange rates (from cdn.jsdelivr.net and currency-api.pages.dev) and checks your connection against well-known addresses (gstatic.com, cloudflare.com). These requests carry no account data, only what any request shows: your network address.
9. Transfers outside the EU
Cloudflare, Resend, Google and GitHub are based in the United States, so data can reach the US. Each transfer rests on the EU–US Data Privacy Framework (the European Commission's adequacy decision of 10 July 2023) where the company is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Decision 2021/914) with the safeguards they require. You can ask us for a copy of the safeguards at office@shuriken.sh.
11. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it (Art. 15);
- have it corrected (Art. 16) or erased (Art. 17);
- restrict its processing (Art. 18);
- receive it in a machine-readable form and take it elsewhere (Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- withdraw any consent at any time, without affecting what came before.
Most of this you can do yourself in the app:
- Export your data: Settings › Account › Delete account › Export my data saves everything our cloud holds for your account as a file. It does not delete anything.
- Delete your account: Settings › Account › Delete account. We email you a link to confirm; once confirmed, your account and its cloud data are erased. What is on your own computers stays there.
- Correct your data: change your name and password in Settings › Account; remove devices, projects and shares where they are listed.
For anything else, write to office@shuriken.sh from your account's address. We answer within one month; if a request is complex, we may extend that by two months and tell you why.
12. Complaints
Please tell us first, and we will try to put it right. You can also complain to the supervisory authority where you live or work, or to ours:
Úrad na ochranu osobných údajov Slovenskej republiky, Galvaniho 7/B, 821 04 Bratislava, Slovakia; dataprotection.gov.sk; statny.dozor@pdp.gov.sk; +421 2 3231 3214.
13. Children
Shuriken is not for anyone under 16, and we do not knowingly collect data from them. If you believe a child under 16 has given us their data, write to us and we will delete it.
14. Security
Beyond the encryption above: connections use HTTPS, devices sign in with their own tokens that we store only as hashes, sign-in attempts are limited, and only the people who run Shuriken can reach the cloud's data. If a breach puts your data at risk, we will tell the authority and, where the law requires, you.
15. Changes to this policy
When we change this policy, we update the version and date at the top. When a change matters to you, the app shows you a notice once, before or when it takes effect, and we may also email you. Earlier versions are available on request.