Privacy Policy

Last updated September 27, 2026

Shellby keeps as little about you as it needs to run your account. We don't sell data, show ads or track you across sites.

What we store

• Account: your nickname, email address and whether it's verified, and your preferred language.
• Password: only a salted scrypt hash — never the password itself.
• Sign-in providers: if you use GitHub or Google, the provider's account id, username and verified email. We never receive your provider password.
• Computers: the public key each Shellby app generates, when it was connected and last used, and access tokens stored only as hashes.
• Sessions: browser sessions (hashed token, creation and last-seen time, browser user agent) so you can sign out remotely.

Local work and optional sharing

Terminal sessions and managed work areas are stored locally. The agents you run communicate with their own providers under those providers’ policies. Local terminal use does not require a Shellby account.

When you share a workspace with another Shellby app, terminal output, workspace structure, attention requests and requested files travel through our relay encrypted between the computers. The host controls access; operators can type and edit files, while observers can read. Our service stores membership and device-approval information and processes connection metadata to route the session.

Telegram and uploaded files

The app communicates directly with the Telegram Bot API using the bot token stored on your computer. Messages, prompts and output you enable for a chat are processed by Telegram. Invites are bound to your computer, account and workspace.

Files received through Telegram are temporarily uploaded to DigitalOcean Spaces. Our upload service records ownership, file name, type, size and expiration. The generated object URL is accessible to anyone who receives it; treat it as a sharing link. Objects expire after 24 hours and are removed by scheduled cleanup. Do not send a file through this feature if that temporary sharing is unsuitable.

Diagnostics

Computer diagnostics are copied only when you request them. The report includes app, operating system, shell, Git and detected CLI versions. It excludes tokens, personal paths and terminal contents. Shellby does not automatically send this report.

Email

Verification, password reset and security notices are sent through Resend, which processes your email address only to deliver those messages.

Retention and deletion

Expired sessions, links and tokens are deleted automatically. To delete your account and everything linked to it, open an issue or contact us through the shellby-org GitHub organization.

Security

All traffic uses HTTPS. Cookies are HTTP-only and same-site. Links sent by email expire quickly and work once.

Contact

Questions? Reach us at github.com/shellby-org.