Privacy Policy

1. Who We Are

Shiko is an AI-powered mind mapping app. It is run by Jarosław Kudzia, Runowska 5b/3, 73-155 Węgorzyno, Poland, who is the controller of your personal data under the EU's General Data Protection Regulation (GDPR). You can reach us at support@shiko.app.

This policy explains what personal data we collect, why, who receives it, how long we keep it, and what rights you have. It applies to everyone who uses Shiko; section 7.8 adds what applies to residents of the United States.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address — to identify your account and contact you
• Password — stored in scrambled (hashed) form; we can't read it
• Display name — optional, shown to collaborators
• Profile details — an optional bio, picture and preferences you choose to add

2.2 Signing In With Google or GitHub

If you sign in with Google or GitHub, they send us your email address, name (or username) and profile picture. We never receive your Google or GitHub password.

2.3 Guests

You can join a shared map with a room code without an account. Shiko then creates a temporary guest account with the name you enter. A guest has no email address.

2.4 Content You Create

• Maps — titles, descriptions, nodes (text, tasks, code, images and more) and the connections between them
• Comments and reactions on shared maps
• Change history — who changed what on a map and when, so you can see and restore earlier versions
• Plugins, recipes and drafts you write or install, and any plugin reports you file

2.5 Usage and Billing

• How many AI actions you have used, to apply your plan's limit
• Your plan, billing period and payment history (amounts and dates) as reported by our payment seller, Polar. We never see your card details
• The notifications Shiko sends you (in the app, by email, and by browser push if you turn it on)

2.6 Technical Data

Our servers log your IP address, browser type and device details when you use Shiko. We use them to run the service, limit abuse and keep it secure.

2.7 What We Don't Collect

• Payment card details (the seller, Polar, handles them)
• Your location, phone number or contacts
• Analytics, advertising or tracking data: Shiko uses no analytics service, ad network or device fingerprinting

3. How We Use Your Information

Each use below names its legal basis; section 4 explains what they mean.

• Provide Shiko — store and sync your maps, let people you share them with work on them live, keep their change history, and send you notifications. Basis: contract.
• AI features you ask for — when you use an AI action (suggestions, connections, merges, node search, recipes or link summaries) we send OpenAI what the result needs: node text and tags, how nodes connect, the map's title and description, and what you type for AI (a recipe's instruction, a search query). For a link summary it is the text of the page. Text written by other people on the map can be part of it. Basis: contract (you asked for it).
• Billing — manage your plan and keep the records the law requires. Basis: contract and legal obligation.
• Emails — account and security emails (sign-in codes, password resets, account deletion confirmation), and updates when someone mentions you, replies to your comment or reacts to it. You can turn the update emails off in your account settings. Basis: contract for account emails; legitimate interest for updates.
• Push notifications — only if you allow them in your browser. Basis: your consent.
• Security and moderation — limit abuse, detect fraud, review plugins and handle reports of illegal or harmful content. Basis: legitimate interest.
• Legal requests — answer valid requests from courts and authorities. Basis: legal obligation.

4. Legal Basis for Processing (GDPR)

4.1 Contract

Processing needed to give you the service you signed up for, including AI actions you start yourself.

4.2 Legitimate Interests

Keeping Shiko secure and free of abuse, and telling you about activity on your maps. We weigh these against your rights, and you can object (section 7.6).

4.3 Consent

Used only for browser push notifications. You can withdraw it at any time by turning push off in your settings or your browser.

4.4 Legal Obligation

Processing needed to follow the law, such as keeping billing records or answering a court order.

4.5 No Automated Decisions

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Information Sharing

We do not sell your personal data. We share it only as described here.

5.1 Service Providers

These companies process data for us to run Shiko. The subprocessors page links each one's privacy policy.

Companies you deal with directly. Polar sells Pro subscriptions and receives your email, name and payment details when you buy. Google and GitHub receive your sign-in when you use them to sign in. Each handles your data under its own privacy policy.

5.2 Collaborators

When you share a map, the people on it can see your display name, picture and email address, what you change (including in the change history), and your live cursor and selection. Comments you write are visible to everyone with access to the map.

5.3 Plugins

Plugins add new kinds of nodes to a map. Only a map's owner can turn a plugin on, and Shiko reviews every plugin it offers. Plugins you load from your own computer in Developer mode run only for you.

• Most plugins work only with their own nodes and send nothing anywhere. Plugins that read other nodes, whether the nodes under them or the nodes you link to them, can't connect to any site, so what they read stays in your browser.
• A plugin that connects to another site, such as GitHub or Wikipedia, names that site and who runs it, with a link to their privacy policy, before anything is sent. It connects only when someone who can edit the map adds the plugin's node, edits it or presses Refresh. That person's browser sends the site what was typed into that one node (for example an issue address or a topic), along with what every browser request includes, such as their IP address. No cookies or Shiko account details are sent. The site handles that information under its own privacy policy.
• What the site sends back is saved in the map, so everyone else sees it without contacting the site. Viewing a map never makes your browser contact a plugin's site.
• If you report a plugin, Shiko's reviewers see your report and, only if you choose to attach it, the plugin data of the one node you selected. The plugin's author never sees who reported it or what was attached.

Sites that plugins connect to are not Shiko subprocessors: Shiko doesn't send them your data. The request comes from the browser of the person who adds or refreshes the node.

5.4 What You Publish

If you submit a plugin to the library, its code, name and your display name as author are visible to everyone signed in to Shiko. If you share a recipe by link, anyone with the link can read and copy it.

5.5 Push Notifications

If you turn push on, notifications travel through your browser maker's push service (for example Google, Apple or Mozilla). The content is encrypted so only your browser can read it.

5.6 Legal Requirements

We may disclose information if a law, court order or valid government request requires it.

5.7 Business Transfers

If Shiko is sold or merged, your information may move to the new owner. We will tell you first and your rights under this policy continue.

6. Data Retention

• Active accounts — we keep your data while your account is active.
• Deleted accounts — when you delete your account, we delete your profile and your maps, and everything in them, within 30 days. What you added to other people's maps (nodes, connections, comments and replies, and their change history) stays on those maps without your name or picture, shown as "Former member". Your reactions and your access to those maps are removed. To remove specific items, delete them before you leave or ask us. Plugins you published are removed; recipe copies other people already installed stay with them. We keep only what the law requires.
• Guests — a guest account that hasn't been used for 90 days is removed, and what it added to a map stays there as "Former member". The map owner can remove a guest sooner, and a guest can ask us to delete their account at any time.
• Backups — backups may hold deleted data for up to 90 days, then it is overwritten.
• Server logs — kept for a short time for security and debugging.
• Purchases — Polar keeps its own records of your purchases as tax law requires.

7. Your Rights

Under the GDPR you have the rights below. To use any of them, email support@shiko.app from the address on your account. We reply within 30 days.

7.1 Access

Ask for a copy of your personal data. You can also download your data yourself in your account settings.

7.2 Rectification

Correct your information any time in your account settings.

7.3 Erasure

Delete your account in your account settings, or ask us to delete it. You can also ask us to remove specific items.

7.4 Portability

Export your maps and data as a JSON file to use with another service.

7.5 Restriction

Ask us to pause using your data while you dispute its accuracy or our reasons for using it.

7.6 Objection

Object to processing based on our legitimate interests (section 4.2). Update emails can be switched off in your account settings.

7.7 Withdraw Consent and Complain

Where we rely on consent, you can withdraw it at any time; this doesn't affect what happened before. You can also complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO), or you can contact the authority in your own country.

7.8 United States Residents

If you live in California or another US state with a privacy law, you can ask to know what personal information we collect and why (this policy), get a copy, have it deleted, and have it corrected. We don't discriminate against you for using these rights. We don't sell personal information or share it for advertising across websites, and we use sign-in credentials only to sign you in. Email us from your account address to make a request. If we decline, reply to our answer to appeal. We respond within 45 days.

8. International Data Transfers

Shiko's database and hosting are in the United States, so your data leaves the European Economic Area (EEA). We rely on the EU–US Data Privacy Framework where a provider is certified under it, and otherwise on Standard Contractual Clauses, which are EU-approved contract terms with the provider. You can ask us for a copy at support@shiko.app.

9. Security

• Everything between you and Shiko is encrypted (HTTPS).
• Passwords are stored scrambled, so nobody can read them.
• A map is visible only to you and the people you share it with, and access to personal data on our side is limited to what running the service needs.
• We keep our software up to date to fix security problems.

No system is completely secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires. To report a vulnerability, email support@shiko.app.

10. Children's Privacy

Shiko is not meant for children under 16 (or 13 where the GDPR does not apply). We don't knowingly collect their personal information. If you think a child has given us any, email support@shiko.app and we will delete it.

11. Changes to This Policy

When we change this policy we update the "Last updated" date. For significant changes we also email you or tell you in the app before they take effect.

12. Cookies and Browser Storage

Shiko stores a few things in your browser so you can sign in and so the editor works the way you left it. We don't use advertising or analytics cookies, and nothing Shiko stores is used to follow you across other websites.

Everything listed below is needed for something you asked Shiko to do: sign you in, save your work, remember your settings. The law doesn't require consent for that, which is why Shiko shows a short notice and doesn't ask you to accept or refuse. If we ever add anything that isn't needed, we'll ask you first, and saying no will be as easy as saying yes.

12.1 What we store

12.2 Other websites

Shiko loads no third-party scripts, ads or trackers, and its fonts come from Shiko's own servers. A few things you do take you to, or load something from, another website, which handles your data under its own privacy policy:

• Paying for Pro takes you to Polar's checkout, which sets its own cookies.
• Signing in with Google or GitHub happens on their websites.
• An image that you or a collaborator add from another website loads from that website.
• Plugins that connect to a website work as described in 5.3 Plugins.

12.3 Do Not Track and Global Privacy Control

Shiko doesn't track you across websites and doesn't sell or share your personal information for advertising. If your browser sends a Do Not Track or Global Privacy Control signal, nothing needs to change, because Shiko already works the way those signals ask.

12.4 Clearing what's stored

You can delete Shiko's cookies and storage in your browser's settings at any time. Clearing it signs you out and resets your editor settings and tips. It also loses any changes that haven't been saved yet, so reconnect first if you've been working offline. On a shared computer, clear your browser data when you're done.

13. Contact Us

For questions about this policy or to use your rights:

• Email: support@shiko.app
• Controller: Jarosław Kudzia, Runowska 5b/3, 73-155 Węgorzyno, Poland