Privacy Policy
Last updated: July 2, 2026
The short version: ShellBuddy is local-first. Everything you do in the app — lessons, progress, XP, flashcards — lives on your own device. If (and only if) you choose to sign in for cross-device sync, we store exactly two things: your email address and your learning progress. No analytics, no ads, no tracking, no cookies, and we never sell or share your data. You can delete your account and all synced data yourself, in one click, at any time.
Who is responsible
ShellBuddy is a personal project by Raffael Hüberli, St. Gallen, Switzerland (the "data controller" in legal terms). Questions, requests, complaints: hello@tschuebi.com.
Using ShellBuddy without an account
You can use the entire app without signing in. In that case no personal data reaches us at all. Your progress is saved only in your browser's local storage on your device. Clearing your browser data erases it. The app is a static website — our hosting provider (Netlify) processes your IP address transiently to deliver the pages, as any website host does.
If you join the beta waitlist
ShellBuddy is in a private beta. If you enter your email on the waitlist, we store that email for a single purpose: to send you a beta invite. The waitlist form is handled by Netlify Forms (our website host), and the emails are visible only to us. We won't add you to any mailing list, and we delete waitlist emails once the beta opens up. Legal basis: your consent (Art. 6(1)(a) GDPR) — you can ask us to remove your email at any time at hello@tschuebi.com.
If you sign in for sync
Sign-in is passwordless: you enter your email, receive a one-time code, and that's it. Signing in is entirely optional and exists for one purpose only — syncing your progress across your devices. We then process:
| What | Why | Where |
|---|---|---|
| Your email address | To sign you in (one-time codes) and identify your account | Supabase, hosted in the EU (AWS eu-west-3, Paris) |
| Your learning progress (completed lessons, XP, streak, flashcard schedule, your first name if you entered one, your device's RAM/chip setting for model recommendations) | So your progress follows you across devices |
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — you ask for sync by signing in, and this data is exactly what's needed to provide it. We collect nothing beyond that purpose.
Access control: your data sits in a database row that only your authenticated account can read or write, enforced at the database level (row-level security).
Who processes data on our behalf
- Supabase (database & authentication) — EU region (Paris, France).
- Resend (sends the sign-in code emails) — processes your email address to deliver the code.
- Netlify (website hosting & the beta waitlist form) — serves the app's files (transient IP processing in server logs) and receives waitlist email addresses.
These providers act as processors under our instructions. We have no other recipients, we don't sell or share data with anyone, and there is no advertising or profiling of any kind.
What we deliberately don't do
- No analytics or tracking scripts — we can't see what you do in the app.
- No cookies. (The app uses your browser's local storage purely to save your progress and enable offline use — functional storage, never tracking.)
- No marketing emails. The only emails you'll ever receive are the sign-in codes you request and, if you joined the waitlist, a single beta invite.
How long we keep data
Until you delete it. There's no retention beyond your account's lifetime: deleting your account erases your email and your synced progress immediately and permanently.
Deleting your account
In the app: Progress → Account & sync → Delete my account & synced data. This permanently removes your account and everything stored about you, immediately. (Progress saved locally on your devices stays on those devices — it's yours.) You can also email hello@tschuebi.com and we'll do it for you.
Your rights
Under the GDPR and the Swiss FADP you can ask for access to your data, correction, deletion, a portable export, or restriction of processing — email hello@tschuebi.com. (Honestly, the fastest "export" is the app itself: your progress is on your device.) You also have the right to complain to a supervisory authority — in Switzerland the FDPIC, or your local EU data-protection authority.
Changes
If this policy changes in a way that matters, the date above changes and significant changes will be noted in the app. This is a small, personal project — the promise ("local-first, two pieces of data, delete anytime") is the point, and it won't quietly get worse.