1. Introduction

Shelly ("we," "our," or "us") is committed to your privacy. This Privacy Policy explains our approach to data and privacy when you use the Shelly macOS application and website (collectively, the "Service"). The short version: Shelly runs entirely on your Mac, retains zero data, and transmits nothing to us or any third party.

2. No Data Collection, No Data Retention

Shelly is designed with a zero data collection, zero retention architecture. We do not collect, store, transmit, log, or process any user data whatsoever. Everything Shelly does happens locally on your machine and nothing is ever persisted to a server we control. Specifically:

No sign-up required. There are no accounts, no email collection, and no registration of any kind.
No server-side storage. We do not operate any backend that stores your data. Hook events, permission prompts, conversations, project paths, and settings all live entirely on your device.
No analytics or tracking. We do not use cookies, analytics services, fingerprinting, or any form of usage tracking.
No telemetry. We do not collect crash reports, device information, or performance diagnostics.
No network calls by default. Shelly's only outbound network activity is checking GitHub Releases for app updates. It does not phone home.

3. How Shelly Works

Shelly is a native macOS overlay that intercepts hooks from AI coding agents running on your own machine (Claude Code, Codex CLI, Gemini CLI, and others). It runs a small local HTTP server bound to 127.0.0.1:21517 that only accepts connections from processes on your own computer. Nothing is exposed to the network.

All permission requests, questions, notifications, and session events are handled in memory and rendered in Shelly's UI. Once you respond (allow/deny/answer), the event is discarded. There is no database, no log file we upload, and no persistent record of your activity beyond what your AI agent itself writes to its own local files.

Your AI provider API keys and conversations belong to the agents you use — Shelly never sees, reads, or stores them. Shelly only sees the hook metadata (tool name, tool input) that the agent explicitly sends to its configured hooks, and only for as long as it takes you to click a button.

4. Third-Party Services

Shelly itself does not integrate with any third-party services. The AI agents you run (Claude Code, Codex CLI, Gemini CLI, etc.) communicate directly with their respective providers (Anthropic, OpenAI, Google) under their own privacy policies. Shelly has no visibility into those interactions beyond the hook events the agents emit locally.

Shelly's auto-update mechanism checks GitHub Releases for new versions. This is the only outbound request Shelly makes, and it contains no personally identifying information beyond what any HTTP request to github.com inherently includes.

5. Data Security

Because all data remains on your Mac and Shelly retains nothing, you are in full control of your data. The local HTTP server is bound exclusively to the loopback interface (127.0.0.1) and is not reachable from other machines on your network. We recommend keeping macOS and your AI agents up to date to maintain security.

6. Children's Privacy

Since we do not collect any data from any users, we do not collect data from children. The Service does not require any personal information to use.

7. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the revised policy.

8. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at:

cosmobiosis@gmail.com