Draft. Not reviewed by a lawyer. Phase 1 definition of done requires that review before this is published. Everything it describes is implemented and enforced today.
Shellac is a free Unix shell host. This policy says what we keep, for how long, and why. It is short because we keep very little.
| What | Kept | For how long | Why |
|---|---|---|---|
| Username and public key fingerprint | Yes | Life of the account | It is the account |
| Email address or OAuth identity | Yes | Life of the account, then 90 days | To let you sign in, and to answer an abuse complaint about you |
| The IP address you signed up from | Yes | 1 year | To recognise a signup from an address with prior abuse |
| The IP address and time you logged in | Yes | 90 days | To answer "was this account used from somewhere else" |
| Network flows: addresses, ports, byte counts | Yes | 30 days | To attribute an abuse complaint to an account |
| Standing score and the events behind it | Yes | 1 year for the events, life of the account for the score | It decides your resource tier, and it is published so you can compute it yourself |
| Abuse complaints about you, in structured form | Yes | 2 years | To show a provider or a court that we acted |
| The original text of an abuse complaint | Yes | 30 days | So a person can read it while investigating |
| Agent proposals and the decision made on them | Yes | 1 year | So automated decisions about accounts are reviewable |
| Your name, phone number, address, payment details | No | — | We do not ask and there is nothing to pay |
| The contents of your files, shell history, or terminal | No | — | Nothing reads them and nothing records them |
Retention is enforced by a scheduled job that deletes on a per-row expiry set when the row is written. It has no policy of its own to get wrong, and it can be verified but not modified by the automated systems described below.
We do not read your files, your command history, or what is on your terminal. No tool exists that could: the systems that triage abuse have a fixed list of things they can ask for, and reading user content is not on it. That is a property of the software rather than a promise about our conduct.
We do not sell anything about you, and there is no advertising.
Each account runs in its own virtual machine with its own kernel, so the host cannot see what runs inside it. A small program inside your VM reports the *names of programs that are executed* — the path and the name of what started it, and nothing about arguments, files, or output. It exists to notice crypto miners and network scanners.
That stream is used to raise an alert for a person to look at. It is never used on its own to restrict an account.
An automated triage system reads the telemetry above and proposes what to do about an abuse report. During the alpha it only proposes: a person makes every decision, and the proposal and the decision are both recorded. If that ever changes, this policy changes first.
Ask us and we will tell you everything we hold about your account, or delete it. Deleting the account deletes the home directory immediately; the identity record and abuse history age out on the schedule above, because we need them to answer complaints about the period when the account existed.
Enforcement decisions are appealable to a person.
abuse@shellac.sh for reports about an account. The same address reaches a person for a privacy question until there is a better one.