Know what Shifu can use before you connect it.

Beta waitlist information.

When you request beta access, Shifu stores your email address, the optional reason you select for joining, and the time of your request. We use this information to manage beta access and send beta-access emails you agree to receive.

Website analytics.

The landing page uses Vercel Web Analytics to count visits and see aggregate traffic patterns. It does not use analytics cookies, and we do not send waitlist email addresses or work content as custom analytics events.

You choose every connection.

Shifu shows the current access boundary for a source before you authorize it. Connect only sources you are allowed to use and that are relevant to the question you want to answer.

Work sync has clear boundaries.

New coding-harness connections sync redacted final-assistant notes every hour by default; you can choose another interval or manual approval. Raw session transcripts and user prompts are not uploaded. Supported files placed in your Shifu folder are sent for analysis on the next sync and are not redacted locally.

GitHub access has a clear boundary.

During the current beta, the GitHub connection lets you connect your identity and choose repositories for future use. It does not read repository contents today.

Google data we access.

Google Meet is an optional connection, authorized separately from signing into Shifu. When you connect it, Shifu requests openid, email, and https://www.googleapis.com/auth/meetings.space.readonly. We access:

• Your Google account identifier and email address, to identify the connected account and match your meeting contributions.
• OAuth access and refresh tokens, to maintain the connection and check for available transcripts.
• Meeting identifiers and dates, participant identifiers and display names, transcript identifiers and document links, and available transcript entries with text, speakers, and timestamps.

Shifu imports available transcripts for meetings that start after you connect. It checks periodically for delayed transcripts. Shifu does not join or record meetings, enable transcription, or download recordings or Google Drive documents through this connection.

How we use Google data.

We use meeting data to identify your contributions, extract work records with supporting excerpts, and provide your work history, summaries, and answers in Shifu. We match your Google identity to participant identifiers, label your turns, and redact other speaker labels and recognizable contact details before AI extraction. Other participants' words may be processed as context. Redaction reduces exposure but does not guarantee that every name, confidential detail, or personal identifier is removed. OAuth tokens are used for Google API access and are not included in AI prompts.

Google data sharing and AI processing.

Shifu's hosting and database service providers process Google data on our behalf to operate the service. For meeting contribution extraction, sanitized transcript sections are sent to OpenCode Go, an AI gateway, for processing by OpenAI's GPT 6 Luna model. Relevant saved work records and excerpts may also be sent through OpenCode Go to OpenAI's GPT 5.6 Luna for your summaries and answers, and through OpenCode Zen to TypeSafe AI's Jev model to assess relevance and supporting evidence. OpenCode's published Luna data policy states that inputs are not used for model training and that provider retention is 30 days. OpenCode's Jev policy states that inputs are not used for training. TypeSafe's Privacy Policy describes retention for as long as reasonably needed to provide its services or support its business purposes, without a fixed day limit. These are hosted API integrations; processing is not limited to your device.

We do not sell Google user data or use it for advertising. We do not use or permit the use of Google user data, including raw, aggregated, anonymized, or derived data, to create, train, or improve foundational or generalized AI or machine learning models. Transfers are limited to providing the features you authorize, security purposes, legal obligations, or a business transfer with your explicit prior consent. Human access to Google data is limited to your explicit consent for specific data, security investigations, legal requirements, or aggregated and anonymized internal operations permitted by Google's policy. If you authorize an external assistant to retrieve your Shifu context, relevant retained records may be returned to that assistant.

How we protect Google data.

Shifu uses HTTPS for Google API and AI API transfers. Stored Google OAuth credentials are protected with authenticated AES-GCM encryption, using a key held separately from the database. OAuth authorization uses PKCE and single-use, browser-bound state. Authenticated, account-scoped access checks and database isolation protect meeting connections and imports. We limit the text submitted for AI processing and redact recognizable identifiers. These controls reduce risk; no system can guarantee absolute security.

Google data retention and deletion.

• Google account connection details and encrypted OAuth credentials are retained while the connection exists. Disconnecting Google Meet deletes the local connection and credentials and stops future imports.
• Sanitized transcript sections are retained temporarily while processing or retries are pending. Their text is cleared when processing completes, reaches terminal failure, or you disconnect. Pending processing has no fixed time-based expiry.
• Saved work records, review candidates, selected supporting excerpts, and source metadata remain in Shifu after disconnect so your work history remains available. They have no automatic expiry; you can request deletion using the contact below. Rejecting a record changes its review status and does not erase it.
• The AI provider's separate retention period for Luna requests is 30 days. Jev follows TypeSafe AI's retention policy, which has no fixed day limit, as described above.

To request deletion of imported Google data, derived records, or your account data, email gorthi.shubham@gmail.com from the email associated with your Shifu account and specify what you want deleted. We verify the request before deleting the relevant retained data. We will explain any legal retention requirement or remaining backup or service-provider retention that applies to your request. Disconnecting Shifu does not delete the original transcript held by Google. You can also remove Shifu's authorization from your Google Account connections.

Google API Limited Use.

Shifu's use and transfer of information received from Google APIs, including raw and derived Google Workspace user data, adheres to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements.

You can remove access.

Use Sources in the dashboard to disconnect a Google Meet or GitHub account or revoke a coding-harness key. This stops the current connection from being used. Disconnecting a source does not erase previously retained work records; contact us to request deletion.

Generated work stays reviewable.

Shifu keeps the context behind summaries visible so you can check what is accurate and decide whether to use it. Source information remains in its original system, where any changes must be made.

Privacy questions and policy changes.

Contact the Shifu team at gorthi.shubham@gmail.com for privacy questions, corrections, or deletion requests. We update this policy and its date when our practices change and notify affected users before materially changing how we use or share Google data.