Privacy draft

What SuperShell CLI and Cloud store, send to connected services, and keep in your browser.

Draft, last updated 2026-10-28

This is a working draft for review, not a final privacy policy. Operator and contact details, retention periods, and jurisdiction-specific rights still need legal review before publication as a final policy.

Account and Cloud data

Cloud uses Supabase for accounts and application data. This includes your account identifier and email, workspaces, threads, conversation messages, attached images, instructions, skills, tools, agents, linked terminals, and automation schedules and run history.

Provider credentials, GitHub user tokens, and saved website login secrets are stored in sealed form by the application. If you add a website login to the Vault, it can include a username, password, and two-factor authentication seed. Vault use history records the site, thread, time, and outcome.

Model providers and connected tools

Messages, files, tool results, and other context needed for a request are sent to the model provider or runtime you choose. Connected tools receive the inputs needed for their actions. Their own terms and privacy policies also apply.

The computer tool sends screenshots and page text to the selected model and saves them in conversation history. Browser pages can contain private information. Consider what is visible before asking the agent to inspect a page.

Hosted computers

Cloud computers run on Fly infrastructure. A hosted thread has a machine and persistent disk for its work and home files. A hosted personal browser also has a persistent disk, so browser sessions and sign-ins can remain between uses.

This draft does not promise that stopping a computer deletes its stored files. Retention and deletion details need to be finalized.

GitHub connections

If you connect GitHub, Cloud stores installation information and may store a sealed user access token. The GitHub App requests repository contents and pull-request write access, plus metadata read access. The repositories you authorize determine its scope; the application can use read-only access where appropriate.

Repository access lets agents read code and, when allowed, change files or open pull requests. Review the installation's repository choices and permissions on GitHub.

Older licenses and trials

Older license, trial, and payment requests continue to the previous SuperShell service. It uses Supabase for purchase, activation, device, trial, and verification records. These can include email, device IDs, IP addresses, license codes, payment identifiers, and the full payment event payload.

Stripe handles payments. The older service saves checkout events for processing, and Resend sends activation emails that can contain the buyer's name and license code.

Feedback

Feedback is stored in the Cloud feedback table. It can include your user ID, submission time, product, version, rating, tag, note, feedback moment, runtime, provider, model, permission mode, client details, and related thread and turn identifiers.

Technical context can include tool names, outcomes, durations, errors, latency, and token counts. A conversation excerpt is included only when you select the conversation-sharing option. The CLI can include up to the last twelve turns when selected.

The products attempt to redact known secrets before sending feedback; do not rely on that to remove every private detail. Check your note and the sharing choice. CLI feedback can wait in a local queue until a Cloud link is available.

CLI files and measurements

The CLI saves settings, credentials, and conversation history in local SuperShell files. Optional Cloud linking and sync send the configuration you choose to sync; shared or continued conversations also reach Cloud.

Measurements are recorded locally under ~/.supershell/measurements. Set SUPERSHELL_MEASUREMENTS=0 to disable local recording. Uploading measurements to PostHog is off unless sharing has been explicitly configured. SUPERSHELL_MEASUREMENT_SHARING=0 disables those uploads.

Shared measurements describe timing, outcomes, tool names, runtime and model information, token usage, and cost when available. They do not include prompt text. Exported session, agent, and call identifiers are hashed, and an installation identifier is added. This does not make every event anonymous.

Cookies and browser storage

Cloud uses Supabase session cookies to keep you signed in. Temporary sign-in cookies are also used for provider and connected-tool login flows.

The theme cookie remembers System, Light, or Dark for up to one year. On supershell.ai it is shared across the site and its subdomains, uses SameSite=Lax, and is marked Secure on HTTPS.

Browser local or session storage can hold message drafts, layout choices, and feedback frequency settings. Hosted browser sessions have their own cookies and stored site data.

Choices and details still under review

You can unlink terminals, change provider connections, choose whether to include a conversation with feedback, and disable measurement uploads. Review each action's scope before using it.

A final policy still needs the service operator's name and contact route, retention schedules, deletion-request handling, international-transfer details, and applicable privacy rights. This draft makes no fixed retention or response-time promise.