Privacy Policy
The short version: a local project stays on your computer and we never see it. What follows covers the rest, which is your Shiro account, cloud projects, payments and hosted AI, in enough detail that you can check us.
Who We Are
Shiro is made by Qualia LP, a limited partnership based in Ontario, Canada (2967 Dundas St. W. #436B, Toronto, ON M6P 1Z2). We are responsible for the personal information described here. Privacy questions and requests go to [email protected], in English or French, and reach the person accountable for privacy at Qualia LP.
Canada’s federal privacy law, PIPEDA, applies to what we do.
What Never Reaches Us
- Local projects. A local project is a folder of Markdown files on your disk. We don’t receive it, sync it or back it up unless you choose to move it to the cloud or add an encrypted cloud backup.
- Anything from the desktop app before you sign in. It contacts no Shiro server until then, collects no usage data and sends no crash reports. The test that enforces this,
apps/desktop/e2e/privacy.spec.ts, is open source. - AI requests you don’t route through us. With a local model, nothing leaves your computer. With your own key, the request goes straight from your computer to that provider, under its terms.
The desktop app does fetch a spelling dictionary, a thesaurus or a focus music track when you ask for one. Those files come from our mirrors (dictionaries.meetshiro.com, focus.meetshiro.com) or from jsDelivr, which see your IP address like any web server and nothing else.
What We Collect, and Why
Your account. Your email address, the name you give, your language and your settings, so that you can sign in and Shiro can address you properly. If you sign in with Google or Apple, we receive your email address from them, and no password.
Cloud projects. Their text, structure, comments, history and files, so that we can sync them between your devices and your co-authors and keep their history. Cloud projects are not encrypted end to end: the server reads them to keep history, run webhooks and agents you set up, and answer the people you share them with. An encrypted cloud backup of a local project is different: it is sealed with your passphrase, and we can’t read it.
Payments. If you buy a plan, credits or a gift, Stripe handles the card. We keep your Stripe customer reference, your plan, your invoices and what you bought. We never see or store your card number.
Hosted AI. When you use the AI that comes with a Cloud plan, your request goes through our server to the provider of the model. For each call we keep the model, the number of tokens and the cost, for 30 days, to count your allowance. We keep the prompt and the answer only if you turn on Help improve Shiro, which is off by default, and then for 90 days. We don’t train models on your writing. Each provider handles the requests it receives under its own terms.
Sign-ins and requests. To keep accounts safe and to answer card disputes, we record the IP address, browser and device each account signs in from, once a day per address, and keep that for 13 months. We also log each request to our API (its route, its status and how long it took, never its content) for 30 days. When you create an account from a link that says where it came from (a referrer or campaign tags), we note that once, to know which pages bring writers to Shiro.
Email. We send you what your account needs: sign-in links, receipts, invitations, and notices about your account. Our newsletter only reaches you if you ask for it and confirm, and every issue has a link to stop it.
Errors and logs. Our servers keep logs and report errors so that we can fix what breaks. Before a log line or an error report leaves the server, sign-in links, codes, tokens and keys in it are redacted. Logs are kept for no more than 30 days, and error reports for 90.
This website. It sets no cookies and runs no analytics or advertising scripts. Your browser keeps the theme you chose, and nothing else.
People You Bring In
Some features put other people’s details in your hands: the co-authors you invite, the beta readers you send review links to, the readers who sign up for a pen name’s news, and the Kindle address you send books to. We use those details only to do what you asked, such as sending the invitation or the chapter, and each email says who it comes from. Readers who sign up for a pen name confirm by email first, and can stop at any time.
Who Else Handles It
We use these companies to run Shiro. Each gets only what its job needs, and is bound to use it for that job alone.
| Company | What for | Where |
|---|---|---|
| Hetzner | The servers and database of Shiro Cloud | Ashburn, Virginia, US |
| Cloudflare | Files of cloud projects, backups, this website, DNS, our mirrors | United States, and its edge |
| Stripe | Payments, invoices, tax | United States |
| Loops | Sending email | United States |
| Better Stack | Logs, error reports and uptime checks | United States |
| OpenRouter, fal, Replicate | Hosted AI: text, images and clips | United States |
| Google, Apple | Sign-in, only if you choose it | United States |
Your information is therefore stored and processed in the United States, where the authorities may be able to reach it under US law. We don’t sell personal information, we don’t share it for advertising, and we don’t buy it from anyone.
We would disclose information to the authorities only when the law requires it, and we will tell you when the law allows.
How Long We Keep It
| What | How long |
|---|---|
| Your account | Until you delete it, then 30 days, in case you change your mind |
| A cloud project you delete | 30 days in Recently deleted, then erased |
| Cloud history | 7 days on the free account, 90 days on a Cloud plan |
| Hosted AI usage (model, tokens, cost) | 30 days |
| Prompts and answers, with Help improve on | 90 days |
| API request records | 30 days |
| Sign-in addresses and browsers | 13 months |
| Server logs | No more than 30 days |
| Error reports | 90 days |
| Backups of the database and files | 90 days, after which deleted data is gone from them too |
| Invoices and payment records | 6 years, as Canadian tax law requires |
Your Choices and Rights
- See and correct. Most of what we hold is in the app, under You. For anything else, write to us and we will send you a copy within 30 days.
- Take it with you. Publish › Storage › Download as vault turns a cloud project into a folder of Markdown files, and Publish exports Word, EPUB, PDF and more.
- Delete. You › Profile › Delete account asks what becomes of each shared project, signs you out everywhere and stops your plan. Everything is erased 30 days later, unless you sign in before then to keep it.
- Say no. You can turn the AI off entirely (You › Privacy), leave Help improve Shiro off, and unsubscribe from the newsletter.
- Complain. Write to us first, and we will try to put it right. You can also contact the Office of the Privacy Commissioner of Canada.
If something goes wrong with your information, such as a breach that could harm you, we will tell you and the Privacy Commissioner as the law requires.
Children
Shiro is not meant for children under 13, and we don’t knowingly hold information about them. If you think a child has an account, write to us and we will delete it.
Changes
When we change this policy in a way that matters, we will email account holders before it takes effect. The date at the foot of this page says when it last changed.