Privacy Policy

Last updated: July 31, 2026

Sheko is your work companion, and a companion respects your data. This policy explains what we collect, why, and how you stay in control. The simple rule: your data is yours, and we never sell it.

1. Who we are

Sheko (sheko.app) is a product run by STS. It is an AI companion that manages your projects, tasks, and attention, in your dialect, with optional AI via your own keys. For any privacy question, reach us at hello@sheko.app.

2. The data we collect

• Account data: your name, email, and country (to set your dashboard dialect). Your password is stored as a one-way hash, never in plain text.
• Your content: the projects, tasks, steps, habits, medicines, and notes you add. This is the heart of your service and we keep it to run it for you.
• Activity log: events like creating or finishing a task, to power your dashboard, streak, and morning podcast.
• AI keys: if you connect your provider keys (OpenAI, Anthropic, Groq...), they are encrypted with AES-256-GCM and never leave the server (details below).
• Limited technical data: browser and OS where needed to run and secure the service.

3. AI and your keys

The keys you connect (BYOK) are encrypted on the spot with a master key (ENCRYPTION_MASTER_KEY) before they are saved, and they are never sent to your browser or shown except masked (like ••••1234). They are used only at the moment the AI is called on your behalf, straight from the server to your provider. If the master key is lost, the old keys cannot be decrypted. Welcome and monthly credits are funded from our platform key (Z.ai GLM); when you use your own keys, you pay your provider directly at cost.

We never use your data to train AI models - ours or anyone else's.

4. How we use your data

• To run the service: your dashboard, tasks, reminders, and dialect.
• Smart suggestions based on your projects (the next-step line, for example), with your consent and at the autonomy level you choose.
• To reach you: transactional mail (verification, password reset) and lifecycle mail (reminders, subscription status), which you can turn off.
• To improve stability and security and detect abuse.

5. Payments

Subscription payments (Team and Business plans) are processed entirely by Stripe. We never see or store your card details; what we keep is your subscription status and the end of your period. Stripe is an independent processor governed by its own terms.

6. Cookies

We use only two kinds:

• Always strictly necessary: keep you signed in and remember your language and board. The service does not work without them.
• Optional analytics: anonymous stats to improve Sheko, off by default and turned on only with your consent from the consent bar at the bottom of the page.

You can review or change your choices anytime from the "Cookie settings" link in the footer of any page. We use no third-party advertising cookies, and we never sell your data.

7. Email

We send email through AWS SES. Our messages include: account confirmation, recurring reminders, and subscription / trial / dunning status. Every non-transactional message has an unsubscribe path, and we respect the quiet hours you set. We never send from development environments.

8. Data hosting and security

Your data is hosted on our servers in the European Union (Hetzner, Germany): a PostgreSQL database and Redis for queues, plus object storage (MinIO/S3) for attachments. Backups are encrypted and regular. Access is least-privilege and tightly scoped.

9. Retention and deletion

We keep your data for as long as your account is active. At any time you can:

• Export: download all your data (projects, tasks, habits, Sheko's memory) as a single JSON file from Settings.
• Delete: permanently delete your account from Settings (after confirming by email). Deletion is final and wipes everything, with no way back.

We may retain some records for security, compliance, or legitimate debt purposes, within legal limits.

10. Sharing

We do not sell your data or share it for advertising. We share it only with processors needed to run the product:

• Stripe (payments), AWS SES (email), Hetzner (hosting).
• The AI provider you choose when you use your key or welcome credits; the content sent is limited to what that operation needs.

We may disclose data when legally compelled by a valid court order, and as required by law.

11. Your rights

You have the right to access, export, correct, and delete your data, self-service from Settings or by contacting us. If your country grants additional privacy rights (such as the GDPR), we honor them.

12. Children

Sheko is intended for adults. It may not be used by anyone under sixteen.

13. Changes to this policy

We may update this policy as the product evolves. Any material change will be reflected on this page with an updated date above.

14. Contact

Email: hello@sheko.app · WhatsApp: +971 4 522 5777.