Privacy policy
Shuriken runs your coding agents on your own computers. Most of what you do never reaches us, and what our cloud keeps for your account is encrypted on your devices where it can be. This page says exactly what we hold, why, for how long and who helps us run it.
1. Who is responsible
The controller of your personal data is Enkova s. r. o., Lehotská 370/22, 972 71 Nováky, Slovakia, IČO 57610657, registered in the Obchodný register Okresného súdu Trenčín, oddiel Sro, vložka č. 57998/R ("we", "us").
Write to office@shuriken.sh, or by post to the address above, about anything on this page. We have not appointed a data protection officer; the same address reaches the people who run Shuriken.
2. What stays on your devices
Shuriken is local-first. Your agents run on your own computers and servers, and the following never reach our cloud:
- your code, files and terminals;
- your chats with agents and their output. When you follow a chat from another of your devices, it travels between your devices end-to-end encrypted through our relay, which cannot read it and does not store it;
- your agent command-line tools' own sign-ins and history;
- audio you record for dictation. By default it is turned into text on your own computer and is never sent to a speech service or any other third party; if you pick a live speech provider with your own key, your computer sends it to that provider (section 6). Recorded on your phone or in a browser, it travels to your own computer end-to-end encrypted through our relay, which cannot read it and does not store it.
We have no access to this data, and it is governed by your own devices and the providers you choose (sections 5 and 6). Two features you turn on yourself pass some of it through our cloud, as section 4 describes: previews of your own dev servers (passed through, never stored) and GitHub or Linear events you connect (kept at most 30 days).
3. The encrypted vault
Your account keeps a vault: your AI providers' sign-ins and API keys, your connectors' tokens and most of your settings, including the API key of any live speech provider you add. Your project names, folders and repository addresses, your device names and your profile picture are sealed the same way. Your devices encrypt all of it before it leaves them (AES-256-GCM), under a random vault key. We store the vault encrypted, so any device you sign in on has it.
The vault key is kept in two locked copies. Your password locks one, through a key derived from it on your device (PBKDF2, 600,000 rounds); your password never reaches us. We lock the other with a key of our own, which our database does not hold, so that signing in with Google, Apple, an emailed code or your password opens your vault on that device without asking for anything else. This means our cloud can open your vault. It does so only to hand the key to your own signed-in devices. Anyone who can sign in to your account, including through your email or your Google or Apple account, can open it too. If you lose your password and have no recovery key, a password reset starts a new, empty vault. The web app at shuriken.sh/app is delivered by our servers each time you open it; the desktop and phone apps carry their own code.
To route the vault, we keep a few labels in plain form: each item's kind and its name, and whether your notification switches are on.
4. What we keep, why and for how long
The legal bases below are those of the GDPR: performing our contract with you or taking steps you asked for before one (Art. 6(1)(b)), our legitimate interests in keeping Shuriken secure and working (Art. 6(1)(f)), our legal obligations (Art. 6(1)(c)) and, only where we ask for it, your consent (Art. 6(1)(a)). We never sell your data, show you ads or use your data to train AI models.
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Old waitlist entry (the waitlist has closed): first name, email, what you would use Shuriken for, who invited you, the Terms version shown and when, your Founding status, our invitation and when we sent it | Keeping your Founding membership and inviting you to an account | Legitimate interest (6(1)(f)), at your earlier request | 12 months after its last activity (joining, confirming, our invitation), unless it becomes an account; then until the account is deleted |
| Sign-up: email, first name, the link we email you (as a hash), the Terms version you accepted, your confirmation that you are 16 or older, and, only if you answer, where you heard about Shuriken | Creating your account; counting where people hear about us (the answer is optional) | Steps before a contract (6(1)(b)); the answer: legitimate interest (6(1)(f)) | The sign-up link a day after it expires; the answer 12 months; the rest with your account |
| How you found us: if you came through a campaign or referral link, its campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and a referral code; if you came from another website, a search engine, an AI assistant (such as ChatGPT or Perplexity) or one of our own articles, that website's domain or the article; for a link on a platform such as Reddit, X, Instagram or GitHub, which platform it was and, where the referring address names one, the community or repository (such as the subreddit); whether the link carried an ad platform's click marker (only which kind, never its value); and the page you landed on, from your first visit only | Knowing which campaigns and partners bring people to Shuriken, and crediting the promoter whose link you used | Legitimate interest (6(1)(f)) | Stored once, when your account is made; the content and term tags, the referring domain and the landing page are cleared after 12 months, the rest is deleted with your account |
| Visit counts: when a page of shuriken.sh is opened, we count the visit under the link that brought you there (its campaign tags, referral code or referring site; for a platform link, the platform and its community or repository, told from the referring address, the kind of ad click marker in the link, or which app's built-in browser opened it, read from the browser's identification string and not kept), and count each page view under the page's address (without its query). To count a visitor once a day, we keep a hash of the network address and the kind of device (phone, tablet or computer) made with a random value that changes every day and a secret key that is kept outside our database, so a copy of the database alone can not turn a hash back into an address. When you download Shuriken from shuriken.sh (a file, the store link or a store badge), the same hash is used to count that download once under the link and the ad you came from. No cookie, nothing stored on your device | Counting how many people each campaign brings, which pages they read and how many of them download Shuriken | Legitimate interest (6(1)(f)) | The hash and the day's random value 2 days, after which visits can no longer be linked; daily counts per link and per page 25 months |
| Marketing email, only if you tick the box at sign-up or turn it on in Settings: your email, the wording you agreed to and when, each later change of that choice, which of these emails we sent you and when (and which of two subject lines, when we test two), and our mail provider's report if one bounced or was marked as spam. Which emails you get, and when, follows your plan and how far you have set up (sources added, devices linked, and when your first chat finished: the app tells us that moment once, never anything about the chat), read from your account; a setup tip you no longer need is skipped | What the sentence you agreed to names. Under today's sentence: setup help, feature tips, new releases and the occasional offer, one a day in your first week, then about one or two a week, fewer after the first month. Under the earlier "features and new releases" wording: a few emails in your first month, then one when a new version is released. Under the earliest "about once a month" wording: at most one a month and no series | Consent (6(1)(a)) | Until you withdraw it: one click on the unsubscribe link in any such email, or the switch in Settings, stops all of them at once. The record of your choices stays with your account as proof of what you agreed to; delivery reports 90 days |
| Do-not-email list: an address that unsubscribed, reported one of our emails as spam, could not be delivered to, or that we added by hand, and why | Making sure no marketing email reaches that address again | Respecting your objection: legal obligation (6(1)(c)) and legitimate interest (6(1)(f)) | An unsubscribe or spam report stays after you delete your account, so we can keep honouring it (so does an entry we added if you also unsubscribed); a bounce or an entry we added goes with your account |
| Order reminders: when you open the Pro order while signed in, we note the period you chose, the contract language, when, and whether you went on to the payment page. If you don't finish, we email you about that order at most twice (about an hour later and the next day), unless you said no at sign-up, on the order page or in a reminder. We also note whether you opened a reminder's link, and whether you said no | Reminding you of an order you started | Our own similar service to a customer (Art. 13(2) ePrivacy Directive; § 116(15) Act 452/2021 Z. z.); legitimate interest (6(1)(f)). You can say no at any time, free: the button next to the pay button, either link in a reminder, or unsubscribing from all marketing email | 30 days after the order is paid, dropped or stopped; a "no" to reminders as long as we need it to respect it, also after you delete your account |
| Usage limit alerts, only if you sign up on the Claude usage limit tracker and type the code we email you: your email, the tracker you chose, your language and time zone, the sentence you agreed to and when, and when we last emailed you | Emailing you when the tracker finds a change in a Claude usage limit, when a change is confirmed and when one is withdrawn | Consent (6(1)(a)) | Until you withdraw it: one click on the unsubscribe link in any such email deletes your address from the list. The code expires after 30 minutes |
| Claude Code usage dashboard, only if you run its command: your report, encrypted on your computer with a key that stays in your link, so we cannot read it; when it was uploaded; and a one-way hash of the code that deletes it. Apart from that, how many times a day the command was downloaded and reports were uploaded, opened, deleted or turned away, with nothing about you or any report in those counts. We store no network address for it, only the keyed form our abuse limits use (Security records) | Showing you your dashboard at your link, and stopping floods | Steps you asked for (6(1)(b)); the daily counts and abuse limits: legitimate interest (6(1)(f)) | Reports 30 days, or until you press Delete now on yours; daily counts 400 days |
| Send it to my computer, only if you ask for the download link by email on a phone: your email is used once, to send that one email. We do not store the address. We keep a keyed hash (HMAC) of it, made with a secret key kept outside our database, with the page's language, its campaign tag and the ad you came from if any, when you asked, whether an account was later made with the same address, and whether the link in the email was used to download Shuriken within 7 days (the link carries a random number for that, nothing about you). If you allowed advertising, Google, Meta and Reddit are told that a link was asked for, and Meta also gets a one-way hash (SHA-256) of the address (section 10). If you press Copy link or Share there instead, and your phone came from an ad or another source, we keep a row with no address at all: a random reference that goes in the link you copy or share, the ad and the source your phone came from (read from the cookie-less visit count, never a cookie), when, and whether that link was used to download Shuriken within 7 days. We use it only to count that download, and an account made on that computer, for the ad your phone came from | Sending you the link; limiting how many links one address gets (3 a day, one every 10 minutes) and stopping abuse; counting how many of these requests become downloads and accounts | Steps you asked for (6(1)(b)); limits and counting: legitimate interest (6(1)(f)); the ad platforms: consent (6(1)(a)) | The keyed hash 400 days from when you asked (a copied link's reference the same); the address is not kept |
| Account: email, first name, a hash of your sign-in key (never your password), the vault's salt and its two locked keys, your plan and Founding status, the Terms version you accepted and when, the Privacy policy version you were shown | Your account, sign-in, your plan, proof of what you agreed to | Contract (6(1)(b)); proof of what you agreed to: legitimate interest (6(1)(f)) | Until you delete your account |
| An account we create for you (we may set up an account for someone and give them Pro as a gift): email, first name, the gift and our own note about it, and the links we email you to choose a password (as a hash) | Offering you the account and the gift | Legitimate interest (6(1)(f)) | If you never choose a password and never sign in: deleted, with the gift and our note, 30 days after the last link we sent you expires (a link lasts 7 days). Once you claim it, as your account above; earlier links a day after they expire, the last one with your account |
| Free trial of Pro: when your trial started and ends, how it ended, and which reminder emails we sent about it. Since 28 October 2026 a trial starts only when you order Pro; for it we keep the hashes of your email address and of your card's fingerprint described next. The other signals are kept only for trials that began before then, with a new account. So that each person gets one trial, we keep keyed hashes (HMAC), never the values themselves, of: your email address in a standard form (lower case, without a +tag, and for Gmail without dots); your IP address; a short summary your browser computes when you create the account (screen, time zone, languages, graphics card and a drawing test, plus whether the browser looks automated; the summary itself never leaves your browser); the id the app or this browser was given when you signed in, and this computer's id (the hash the app already sends); your projects' git remote addresses, hashed on your computer (never names, paths or code); and, if you order Pro, the fingerprint Stripe gives your card (never the card number). From these we keep a score and the reasons for it (which kinds matched, never a value) | Running your trial and telling you before it ends; preventing fraud: one free trial per person and per card. If the signals clearly match another account's trial, your new account gets no free days, or a running trial ends early and the account moves to Free (nothing is deleted) | Contract (6(1)(b)); one trial per person: legitimate interest (6(1)(f)), preventing fraud. It never affects your account or your sign-in, only the free days. You can ask us to review the result, or object to the check (Article 21), at the address in section 1 | The trial's record with your account. The IP address hash 30 days from when it was last seen. The other signal hashes 400 days from when each was last seen. The email and card hashes each 3 years from when it was made, also after you delete your account (then nothing links it to you), then deleted. When you delete your account, the IP address hash goes at once and the others stay with nothing linking them to you |
| Devices: platform, model, system version, browser, the country, region and city of the sign-in (from the connection, not GPS), push notification token, language; device names, local network addresses and wake-on-LAN addresses are encrypted (we keep only codes, made with a key your devices hold, that say which of your computers share a network) | Showing and managing your devices, waking them, notifications, spotting a sign-in you did not make | Contract (6(1)(b)); security: legitimate interest (6(1)(f)) | Until you remove the device or delete your account |
| Sessions: hashes of your devices' sign-in tokens | Keeping you signed in | Contract (6(1)(b)) | Until you sign out; after an account is deleted, the hashes only, 90 days, so a returning device is told why |
| Encrypted account data: the vault, settings, projects list, profile picture, usage readings, and the usage reports of sources shared before lending ran through the lender's computer | Syncing your setup between your devices and the people you share with | Contract (6(1)(b)) | Until you remove it or delete your account; usage readings 7 days |
| Sharing: the email you invite to a project, the invite and its state; for a lent source, who lent it to whom, when you confirmed the provider allows it, the computer it runs through, the borrower's computers allowed to use it (with a public key for each), and the terms your app signed for it: its models, limits, end and whether it is paused (the people you lend to see your name and picture); and, when two of you sign in to the same provider account, a code derived from that provider's account id that links the two (never the sign-in itself), each holder's signed statement that its computer found that account, when it was last confirmed, and whether each of you was told. The other holder sees your name and picture, never your sign-in. If someone lent you a source, we also keep that code for the account you borrowed, so you are never linked to its holders | Sending the invite, letting that person in, connecting a borrower to the lender's computer, showing who else holds an account | Contract (6(1)(b)) | Until the share ends, then 30 days; an invite to someone with no account, 14 days if they do not join; a share paused when Pro ends, 90 days; a signed statement, until the next check replaces it or you delete your account; the code of an account you borrowed, until you delete your account |
| Messages between your devices: queued events, notifications waiting for a device, the hours in which chats ran (no content) | Delivering them to devices that were offline; your usage overview; our own overview of how active accounts are (hour counts only) | Contract (6(1)(b)); our activity overview: legitimate interest (6(1)(f)) | Until delivered, at most 7 days; finished work hours 48 hours; resolved alerts 3 days |
| Bug reports and feature requests: see section 7 | Fixing what went wrong | Legitimate interest (6(1)(f)) and contract (6(1)(b)) | 24 months from when you sent it, or until you delete your account |
| Why you cancelled Pro, if you answer the optional question when cancelling: the reason you pick, any words you add, your plan and how long you paid, and whether you kept Pro after all | Fixing what made people leave, and answering what you asked | Legitimate interest (6(1)(f)) | Your words: 24 months from the cancel. The reason, plan and how long you paid: until you delete your account |
| Integrations you connect (GitHub, Linear): the connection, your GitHub login, and each event they send us, which can name the people in it (their names, logins and emails) | Handing the events to your computers | Contract (6(1)(b)); people named in events: legitimate interest (6(1)(f)) | Events 30 days (waiting for a device, at most 7 days); the connection until you remove it |
| Previews of your dev servers: the requests and answers between a browser you allowed and your computer | Showing you your own app from anywhere | Contract (6(1)(b)) | Passed through, never stored |
| Security records: network addresses of failed sign-ins and form submissions, in a protected, keyed form; a server's sign-in request with its network address; preview access grants with network address, city and country | Stopping password guessing and abuse, letting you check a request | Legitimate interest (6(1)(f)) | Sign-in requests and links at most a day after they expire; preview grants up to a year from last use, then 30 days after they end; keyed addresses 2 days after the limit they count ends |
| Email: the address and text of the emails we send you (sign-up and sign-in links, invites, billing and account emails) and email you send us at office@shuriken.sh or another @shuriken.sh address. Email to a promoter's address (such as a first name at shuriken.sh) is read by that promoter and by us; a promoter sees only the mail sent to their own address | Running the service, answering you | Contract (6(1)(b)); legitimate interest (6(1)(f)) | Mail with us: 3 years from the last message in the conversation; our mail provider's delivery log: as short as it allows |
| Payments (Pro): your Stripe customer id, plan, period, amounts, invoices, the Terms version you accepted with your order and when, the language of your contract, whether you asked Pro to start at once, whether you bought as a business (with its name and VAT ID), your billing country and the country of your network address (the evidence VAT law asks for), any withdrawal statement or cancellation you send us (your name, email, what you sent and when), and whether a payment was disputed or refunded; card details stay with Stripe | Billing, accounting, VAT, proving your order and withdrawal | Contract (6(1)(b)); legal obligation (6(1)(c)) | 10 years, as accounting and VAT law require; when you delete your account, the link to it is removed |
| Promoters (people who promote Shuriken with their own link): their email, name, referral code and status. A promoter sees only figures about the sign-ups their links brought: how many signed up, how many pay and the monthly amount they pay, and rows with no name or email (such as "User 14, signed up 3 October, Pro yearly"). Dates in those rows are the day only, never the time, and a campaign shows rows only once at least 3 people signed up through it in the period shown | Running the referral programme and showing each promoter their results | The promoter: contract (6(1)(b)); the people they referred: legitimate interest (6(1)(f)) | While they promote Shuriken; afterwards the record is kept, marked as ended, so their past campaigns keep their figures |
| Admin audit log: each change made in our admin tools: who made it, what it changed and when | Accountability for, and the security of, our admin tools | Legitimate interest (6(1)(f)) | 24 months |
| Shared usage numbers, only if you turn on Share usage numbers: for each Claude or Codex sign-in, a random code, the plan, how much of its limits is used and when they reset, its use priced at API rates, and the app's version (section 5) | Measuring how big each plan's limits are and when they change | Consent (6(1)(a)), which you can withdraw in Settings at any time | 400 days from when it arrived, or until you delete it |
Our cloud records no request logs and no third-party analytics (only the cookie-less visit counts and the usage dashboard's daily counts above), and our apps send no crash reports or analytics anywhere, apart from the anonymous switch counts below, which you can turn off, and the usage numbers below, only if you choose to share them. When you delete your account we erase its data as described in the app. What stays: a monthly count of deletions, payment records for the period above (without the link to your account), email you exchanged with us under the Email row, your address on the do-not-email list if you unsubscribed or reported spam, the keyed hash of your address from a free trial, and of your card if you ordered during it (3 years, see Free trial of Pro above), the keyed hash of an address you had the download link sent to with Send it to my computer (never tied to an account; 400 days, see that row above), your account's random id until its stored files and sync storage are erased (normally within minutes; failed steps are retried every five minutes), and our database restore points, which are kept up to 30 days and expire on their own. This includes the storage of the sync service that passes events between your devices.
Our status page, status.shuriken.sh, checks our own systems from our own cloud. It sets no cookies and holds no personal data.
5. Your AI provider accounts
Shuriken drives the coding agents you connect: Claude Code, Codex and others, with your own subscriptions or API keys. Your prompts, code and the agents' answers go from your device straight to that provider (for example Anthropic, OpenAI or Google), under that provider's own terms and privacy policy. We are not a party to that exchange, we do not see it and we are not the provider's processor for it.
Shuriken is an independent third-party tool. We are not affiliated with, endorsed by or sponsored by Anthropic, OpenAI, Google or any other provider. Each provider is a separate controller of what you send it under your account, and its own privacy policy applies to it.
When you lend a source to another account, its sign-in or key is not sent to the borrower: a borrower's requests pass end-to-end encrypted through our relay to the lender's computer, which sends them to the provider; we see only encrypted traffic, its timing and size, and we store none of it. If you lend, the borrower's requests pass through your computer's memory and are never stored, and the usage figures are kept on your devices, not by us. If you borrow, the lender's computer handles what you send, as the provider does; we cannot read it.
When two of you add the same provider account, neither receives the other's sign-in. To link you, each app checks on its own computer which provider account it holds (for Claude, by asking Anthropic's profile service; for Codex, from the sign-in's own identity token). The two computers compare a one-way code of that account over an end-to-end encrypted connection through our relay, and on a match each app signs a statement with its own account key. We record the link only when both statements arrive. No sign-in, token or API key is sent to us for this, and we never learn the provider's id of the account.
When Claude or Codex gives one of your provider accounts a free limit reset, your computer finds it while reading that account's usage, with the sign-in it already holds, and sends us no sign-in or token for it. It tells us four things about each new reset: the provider, what the reset refills, when it expires and a salted one-way hash of it, so we can email you once (you can turn that email off in Settings). Only while Share anonymous reset sightings is on (Settings, on by default) does it also send the plan type, such as Pro or Max, and we add the reset to an anonymous count on the public limit reset tracker. That count holds no account, device, address or hash. Claude's weekly offer to reset a 5-hour session is sent only while that setting is on, for the count alone: the provider, the plan type and a salted one-way hash, never its expiry, and we never email you about it. Turn the setting off and your computer stops sending the plan type and the weekly offer, and nothing of yours is counted.
When Shuriken moves your work to another of your accounts by itself, because an account reached its limit or its switch point, your computer counts it. Only while Share anonymous switch counts is on (Settings, on by default) does it send us three numbers for each day: how many such switches, how many of them came before the limit, and how many running chats were moved. We add them to totals per day that hold no account, device, address or time, and we may show a month's total on our website, rounded down to 10 and only once it reaches 100. The request is signed in so that we can refuse floods; nothing about you is stored with the numbers. Turn the setting off and your computer sends nothing more and forgets what it counted.
Share usage numbers is off unless you turn it on, in Settings › Account › Privacy, on the last step of the setup guide or when Home asks you once. While it is on, each of your computers sends us one report a day for each Claude or Codex sign-in whose limits it already reads: the provider; the plan, such as Pro or Ultra; how much of the 5-hour and weekly limits is used and when each resets; the shortest time it saw between two resets; what the sign-in's use since its weekly limit began would cost at the provider's API prices; and the app's version. Instead of the sign-in's email or any account id, the report carries a random code made on your devices. It never carries your prompts, code or file paths, and your computer asks the provider nothing extra for it. We keep each report with your account so that you can delete it, use the reports only to work out how big each plan's limits are and when they change, and show only counts and medians across many people. Turn the setting off and your computers stop sending at once; Delete my shared data, in the same place, removes every report you sent. Otherwise a report is kept 400 days from when it arrived, and it goes with your account.
Your computers also fetch a few public things on their own: website icons for the tools you connect (from Google's icon service, the tools' own sites and npm), and a connection check (gstatic.com, google.com). These requests carry no account data, only your network address and, for icons, the tool's domain.
6. Voice
Dictation and spoken replies are off until you turn them on. By default your voice is turned into text on your own computer by a speech model that runs there (NVIDIA Parakeet). With that local model, your audio is never sent to us, to a speech provider or to any other third party. When you dictate on your phone or in a browser, the audio travels end-to-end encrypted to your own computer, which turns it into text; our relay cannot read it and does not store it. The speech model is downloaded from GitHub on your computer's own request; that download carries no audio and no account data.
You may instead pick a live speech provider in Settings › Dictation (ElevenLabs, AssemblyAI, Deepgram, Speechmatics or OpenAI) and add your own API key. Then your computer streams your audio to that provider while you speak, under your account and that provider's own terms and privacy policy; we are not a party to it and receive none of it. Silence between your words is held back on your computer and not sent. With AssemblyAI, Deepgram, Speechmatics and OpenAI, the words the app has learned you often use go along too, so they are spelled right. Your key is kept in your encrypted vault (section 3) or your computer's keychain, and is never written to a log. Choosing the local model again stops all of it.
Spoken replies are made on your computer too. Only if you yourself set your computer's configuration to use OpenAI for spoken replies, with your own OpenAI key, does the text of a reply go to OpenAI under its terms.
So you can play a take again or transcribe it once more, the app keeps your last 30 recordings and their text on the device that made them; our cloud never gets them. Older ones are deleted as new ones come in, and signing out deletes them all.
7. Bug reports
A bug report or feature request you send from the app contains: the text you write, whether it is a bug or a request, your app version, platform and device, your account, and any screenshots you attach (up to four). Screenshots show what was on your screen, so look before you send. Reports are stored unencrypted with their screenshots' hidden metadata removed. The people who run Shuriken read them, and an AI assistant (Claude, by Anthropic) analyses them for us to find the cause; it acts only on our instructions and does not use them to train its models. Copies made on our computers for that are deleted when the report is closed. Reports are kept 24 months, are erased with your account, and you can ask us to delete one sooner.
8. Processors and recipients
These companies process data for us under data processing terms, except where the table says one acts as its own controller. Nobody else receives your data from us unless the law obliges us to hand it to an authority.
| Who | What for | What they receive |
|---|---|---|
| Cloudflare, Inc. (USA) | Hosting shuriken.sh: Workers, D1 database, R2 storage, Durable Objects (sync and relay), Turnstile human check, Email Routing | Everything the cloud keeps (section 4), your network address with each request, browser signals for the human check, email you send us |
| Resend (Plus Five Five, Inc., USA) | Sending our emails, including marketing email you agreed to, and telling us when one bounced or was reported as spam | Your email address and the email's text |
| Stripe Payments Europe, Ltd. (Ireland), with Stripe, Inc. (USA) | Taking payments for Pro, invoices, the billing page. Stripe is also its own controller for fraud prevention and its legal duties (stripe.com/privacy) | Your email, billing details, payment method, the plan and amount; your card details go to Stripe only |
| Google LLC / Google Ireland Ltd. | Android notifications (Firebase Cloud Messaging). Email you send to office@shuriken.sh is also forwarded to our founder's Gmail mailbox, where Google acts as its own controller under its terms | Your Android device's push token and an encrypted notification; email you send us |
| Apple Inc. (USA) / Apple Distribution International Ltd. (Ireland) | iPhone notifications (Apple Push Notification service) | Your iPhone's push token and a notification with no content |
| Anthropic PBC (USA) | Analysing bug reports for us (section 7), the reasons people give when cancelling Pro, and email to us that is waiting on an answer | The bug report's text, its screenshots and your account's email; a cancel reason, its words and your account's email; a waiting email's sender, subject and first lines. Not used to train models |
| Your browser's push service (Apple, Google, Microsoft or Mozilla) | Web notifications, if you turn them on | An encrypted notification for your browser |
| GitHub, Inc. (USA) | Storing our release files | Nothing about you: downloads and updates come through shuriken.sh. Local speech models come from GitHub directly to your computer. |
The web app also reads public exchange rates (from cdn.jsdelivr.net and currency-api.pages.dev) and checks your connection against well-known addresses (gstatic.com, cloudflare.com). These requests carry no account data, only what any request shows: your network address.
9. Transfers outside the EU
Cloudflare, Resend, Stripe, Google, Apple, Anthropic and GitHub are based in, or use, the United States, so data can reach the US. Each transfer rests on the EU–US Data Privacy Framework (the European Commission's adequacy decision of 10 July 2023) where the company is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Decision 2021/914) with the safeguards they require. You can ask us for a copy of the safeguards at office@shuriken.sh.
11. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it (Art. 15);
- have it corrected (Art. 16) or erased (Art. 17);
- restrict its processing (Art. 18);
- receive it in a machine-readable form and take it elsewhere (Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- withdraw any consent at any time, without affecting what came before.
We make no decision about you by automated means alone that has legal or similarly significant effects (Art. 22). The free trial check in section 4 decides only whether free days apply; your account and your sign-in are never refused by it, and a person reviews it if you ask.
Most of this you can do yourself in the app:
- Export your data: Settings › Account › Delete account › Export my data saves everything our cloud holds for your account as a file: the account's records, files, the data waiting in its sync service, and email you exchanged with us. It does not delete anything.
- Delete your account: Settings › Account › Delete account. We email you a link to confirm; once confirmed, your account and its cloud data are erased, apart from what section 4 says stays. What is on your own computers stays there. The Delete account page explains how to do it without the app.
- Correct your data: change your name and password in Settings › Account; remove devices, projects and shares where they are listed.
- Stop marketing email: one click on the unsubscribe link in any such email stops all of them at once, or turn it off in Settings › Account. Email about your account still comes.
For anything else, write to office@shuriken.sh from your account's address. We answer within one month; if a request is complex, we may extend that by two months and tell you why.
12. Complaints
Please tell us first, and we will try to put it right. You can also complain to the supervisory authority where you live or work, or to ours:
Úrad na ochranu osobných údajov Slovenskej republiky, Galvaniho 7/B, 821 04 Bratislava, Slovakia; dataprotection.gov.sk; statny.dozor@pdp.gov.sk; +421 2 3231 3214.
13. Children
Shuriken is not for anyone under 16, and we do not knowingly collect data from them. If you believe a child under 16 has given us their data, write to us and we will delete it.
14. Security
Beyond the encryption above: connections use HTTPS, devices sign in with their own tokens that we store only as hashes, sign-in attempts are limited, and only the people who run Shuriken can reach the cloud's data. We keep a record of what we process and a register of security incidents. If a breach puts your data at risk, we tell the authority within 72 hours and, where the law requires, you.
15. Changes to this policy
When we change this policy, we update the version and date at the top; it has its own version number, apart from the Terms. When a change matters to you, the app shows you a notice once, before or when it takes effect, and we may also email you. Earlier versions are available on request.