ShelvdPrivacy Policy
Last updated: 2026-11-01
01.Who we are
Shelvd (shelvd.dev) is an idea-parking and reminder service for developers, with an MCP server for tools like Claude, Cursor and Codex. Contact for all privacy matters: connect@shelvd.dev.
02.What we collect
Email, name and Google account ID from Google sign-in (only verified emails), plus your timezone, default reminder time, email-notification setting and sign-up date. We never see or store a password.
Title, details, notes, context, due date, status, reminder (nag) settings, project name and timestamps.
Your browser's push subscription (endpoint and keys), and OAuth grants for MCP clients you authorize. Access and refresh tokens are stored only as hashes.
Page analytics (Vercel Web Analytics and Google Analytics), loaded only if you accept analytics in the cookie banner, and standard server logs kept by our host, which can include IP addresses.
03.How we use it
To run the service: store and show your ideas, send reminders and daily digests, secure accounts, rate-limit abuse, and improve the product.
- Never sold. We do not sell or rent personal data.
- No advertising. No ad networks, retargeting or tracking pixels.
- No AI training. We do not use your ideas to train AI models.
04.Encryption and security
Idea title, details, notes and context are encrypted at rest with AES-256-GCM using an application-level key. Traffic uses HTTPS. OAuth and refresh tokens are stored hashed.
Honest limits: due dates, status and project names are not encrypted, so reminders can be scheduled. We hold the encryption key to render your ideas and send reminders, so this is “encrypted at rest”, not zero-knowledge. Do not park passwords or secrets. No system is perfectly secure.
05.Subprocessors
These providers process data on our behalf:
Sign-in and analytics (Google Analytics)
Hosting and analytics
Database
Reminder and digest email
Reminder scheduling (QStash)
Google, Apple, Mozilla and Microsoft deliver web push for your browser
If we add paid plans, a payment processor will be added here. Card numbers will not pass through our servers.
06.AI clients and MCP
When you connect Claude, Cursor, Codex or another MCP client, idea content flows to Shelvd only when that client calls our tools, and the client handles what it receives under its own provider's privacy terms. The optional local MCP server stores ideas on your own disk and sends nothing to Shelvd.
07.Cookies
We set one essential session cookie (Auth.js). Optional analytics cookies (Google Analytics) and Vercel Web Analytics load only if you accept them in the cookie banner; you can change this any time via cookie settings. We use no advertising cookies.
08.Retention and deletion
We keep your data while your account is active. There is no in-app delete or export yet: email connect@shelvd.dev and we will export or delete your data within 30 days. Backups are purged on their normal rotation.
09.Your rights
Depending on where you live (including under the GDPR, UK GDPR and CCPA/CPRA) you can request access, correction, deletion, export, and object to certain processing. Email connect@shelvd.dev with “Privacy request” in the subject. We respond within 30 days.
10.International transfers
Data is processed in the United States and wherever our subprocessors operate. Where required, transfers rely on Standard Contractual Clauses via those subprocessors.
11.Children
Shelvd is not for anyone under 16 (13 in the US). We do not knowingly collect children's data; email us and we will delete it.
12.Changes
We date every revision above and will notify you by email or in the app about material changes.