Privacy policy

This policy covers the Shely website, account services, browser client and native apps. Features differ by platform and release. Sign-in requires an account; direct native SSH does not make account or AI services offline.

Contact and scope

For privacy questions and requests, contact the Shely team at [email protected]. Your employer or team administrator may separately decide how shared servers, membership and recordings are used. Ask them about their policies and authority to process information about you.

Account and authentication information

We process your email address, account identifier, optional display name, verification status and settings to create and manage your account. Authentication records include password-derived verification material, public keys, encrypted identity material, passkey details and, if enabled, two factor and recovery records. Device sessions include labels, IP addresses, user agents, timestamps and token records so you can recognise and revoke access.

Your Shely account password derives authentication and vault keys on your device. The sign-in service receives a derived verifier, not that account password. This differs from a password saved for a remote server. Recovery codes can be used through password reset. Support cannot reconstruct an encrypted vault if you lose the material needed to unlock or recover it.

Vault items and saved host passwords

Vault item contents, including private keys and passwords stored as vault items, are encrypted on your device before upload. The account service stores encrypted contents and wrapped keys rather than decrypted secrets. Item names, types, public metadata, identifiers, revisions and sharing relationships are not all encrypted. Do not put secrets in labels or public metadata.

Saved server passwords use a separate design. When you save or sync a password on a host record, the API receives readable password JSON over HTTPS and encrypts it on the server. Authorised services can decrypt it for a gateway connection or return it to an authorised client. This does not prevent Shely from accessing the password. Host labels, addresses, ports, usernames, tags and folders can also be read by the account service.

Storage encryption does not cover every use of a secret. A browser connection may send a decrypted private key or other credentials to the gateway for SSH authentication. The gateway needs connection credentials in memory. Access to an unlocked device, a compromised client or relevant running services can expose data despite storage encryption.

Connections, files and recordings

Browser SSH and SFTP pass through the Shely gateway. It processes destinations, authentication, terminal input and output, file paths, file contents and transfer information to provide the session. Large downloads may be temporarily staged in server storage. Native direct SSH and SFTP connect from your device to the remote server without that gateway, but account synchronisation and AI requests still go to Shely.

Where gateway recording is enabled, recordings are encrypted for configured administrator recipients before storage. They can decrypt them; the storage service does not hold an ordinary playback key. The gateway still handles readable session data while recording. Redaction is a heuristic, not a guarantee: recordings can contain secrets in commands, output or files. Team administrators control recording settings and authorised access.

AI requests and provider sharing

Using the assistant sends your messages, relevant conversation history and selected server context to the Shely API. Context can include server details, commands and output you choose to submit. A server assistant request includes its server context as well as your question. Review the context and remove passwords, tokens, private keys, personal information and confidential material before sending it. You can use terminal and file features without submitting an AI request.

The API forwards requests to the selected or automatically routed model. The implementation supports Anthropic directly and OpenRouter, which routes requests to underlying model providers. Availability depends on configuration and the model selected. Provider retention, safety review and training practices depend on the provider, settings and applicable terms. We do not promise that every provider has zero retention or that no provider uses submitted information for training. Ask support about current provider arrangements before sending material with special confidentiality requirements.

The assistant API does not save conversation text or answers as account history. It retains usage records, including workspace identifiers, provider and model, timestamps, token counts, request duration, cost estimates and credit charges. Browser and current native Apple chats are held in app memory, not as a durable chat archive. These limits on Shely history do not determine what providers retain.

AI replies can be wrong. Proposed commands require client approval before typing or execution. Risk warnings are heuristic checks, not a sandbox or an independent security review. The assistant is not authorised to make binding decisions about your rights.

Service operation, teams and support

We use information to authenticate users, synchronise data, route sessions, manage team invitations and roles, enforce access and usage limits, prevent abuse and investigate failures. Team records include names, membership, roles and invitation email addresses supplied by team members. Shared data and recordings are accessible according to team permissions. Joining a team does not itself give administrators access to your personal workspace.

Operational and audit records can include identifiers, IP addresses, timestamps, destinations, file paths, actions and failure details. Verification email logs can include your email address. Assistant logging records usage and failure metadata rather than prompts or answers. This is not a promise that Shely produces no logs. Support correspondence contains what you send and what we need to respond. Do not include secrets in support requests.

Recipients and international processing

Information is handled by Shely services and their infrastructure and storage providers. Email delivery services receive recipient addresses and verification messages. AI providers receive the requests described above. Remote servers receive connections and content you send; authorised team members receive shared information. App distributors and external sites have their own policies for data they collect directly.

We may disclose information when required by applicable law or necessary to address security incidents or protect legal rights. Providers may process information in countries other than yours. Contact support for current providers, processing locations and any transfer safeguards relevant to your request. This policy does not claim a particular hosting region, certification or transfer mechanism.

Device storage and retention

The browser uses local storage for sign-in state and preferences and session storage for unlocked vault material. Native apps also keep local account, preference and credential data using platform storage. See cookies and device storage for details and controls.

Account and synchronised records remain until removed through the applicable process. Deleting a host or vault item currently uses soft deletion: the record is marked deleted for synchronisation, and stored fields or encrypted contents can remain in the database. Removing an item from the interface is not permanent erasure of every copy.

Gateway recordings and staged downloads have expiry and cleanup mechanisms based on configured retention or download windows. These are not fixed periods for account, audit, email or support records. We have not published a complete retention schedule for those records or backups. For deletion requests, we will explain any information that needs to be retained, the reason and the expected completion process. Local exports, recipients' copies and data on remote servers need separate handling.

Your choices and account deletion

You can manage saved items, revoke device sessions and change available settings. To request access, correction, deletion or an export of personal information, email [email protected] from your account address. You can also request restriction, object to processing or withdraw consent where processing relies on consent. Legal rights and exceptions depend on applicable law; this contact route is available to all users.

To request deletion of your account and associated personal information, use that address and say you want account deletion. We may verify ownership but will not ask for passwords or private keys. We do not currently promise an in-app deletion control, automatic deletion or a three day completion time. We will respond with next steps and applicable retention exceptions. Signing out or uninstalling does not delete the account. Save information you need first. Account deletion does not delete data on your own servers.

Where applicable, you may complain to your privacy regulator or supervisory authority without contacting us first. Encryption can limit the readable data we can supply; it does not remove applicable privacy rights.

Children and updates

Shely is a server administration tool, not directed to children. If you believe a child supplied information without required authority or consent, contact support so we can investigate. See the terms for account eligibility.

We update this page when practices change. Material new uses of personal information should be brought to your attention before they begin, with consent requested where required. Future releases may use different providers or storage.