Shepi for Herdr collects almost nothing. Here is exactly what it touches.

What Shepi stores on your Mac

• Your settings (language, font, notifications, sidebar, Shepi's own shortcuts), your macros, the agents you pinned and the order your agents started in (so the Agents list keeps it), on this Mac only.
• In your Keychain: this Mac's own signing key for Shepi (it never leaves the Mac); the account you signed in with; and the signed record that unlocks Shepi: during the trial, its dates (good for 3 days at a time), and once you buy, the record that Shepi is yours on this Mac (your email, the sign-in service and its account ID, the Dodo Payments order number and date, this Mac's ID, good for 30 days at a time). A copy of that signed record is also kept in Shepi's folder in Application Support.
• The reply address you last gave Send Feedback, and an unsent feedback draft. Screenshots you paste into it are kept in a temporary folder until the report is sent, then deleted.
• A file an agent on another machine shows you is copied to ~/Library/Caches/Shepi/shown/ so it can open here.
• A picture you paste into a pane or into an answer to an agent's question is saved in Shepi's caches on this Mac, so the agent can read it.
• Nothing else. There is no copy of your terminal output outside the memory of the running app. Machines are saved by Herdr, not by Shepi.

What Shepi reads

• Herdr's configuration file on this Mac, to learn your key bindings and sound settings. It is never modified.
• Herdr's local connection, to show your spaces, tabs and panes and to send your keystrokes to them.
• The Host names in ~/.ssh/config, to suggest them when you add a machine. Shepi runs Herdr's own herdr and ssh commands; it never reads your keys.
• The Git status of the folders your panes are in, and which program each pane is running, to show the branch, the changes and the pane's command.
• When you open the diff view, the changed files of that folder, on this Mac or over the machine's own connection, to show what changed. They are shown, never stored or sent anywhere else.

What leaves your Mac

• SSH connections to machines you added in Herdr, authenticated with your own SSH keys. Shepi does not store or transmit keys, passwords or passphrases.
• Over those connections, Shepi installs its own Herdr plugin on each machine (a command, shepi-agent, and Herdr's own herdr skill for your coding agents), and updates it when Shepi updates. For each coding agent that can run a program at its events, Shepi also adds its own entry to that agent's hook settings (for example Claude Code's ~/.claude/settings.json or Codex's ~/.codex/hooks.json), which tells Shepi when the agent writes its to-do list or starts a new conversation; nothing else in those files is changed. For each coding agent with MCP, Shepi adds its own entry to that agent's MCP settings, pointing to Shepi on that same computer only (127.0.0.1): that is how agents use Shepi's tools; on a server, Shepi carries it over the SSH connection it already has. It also adds a short, marked Shepi section to each agent's own instructions file (for example ~/.agents/AGENTS.md or ~/.claude/CLAUDE.md), telling the agent how to ask you and show things in Shepi; your own lines in that file are never changed, and it is removed with the plugin. The command is shell script you can read; it only passes an agent's events (its to-do list, a new conversation) to Shepi. It only ever talks to Herdr on that machine, and Settings › Agents turns them off and removes them, entries included.
• Files and pictures you paste or drop into a pane, or into an answer, on another machine: copied to that machine over its own SSH connection, into a folder of Shepi's there, so the agent can read them. Nothing goes anywhere else.
• A feedback report, only when you press Send (below).
• Update checks, only if you allow them (Shepi asks once, and Settings can change it) or when you choose Check for Updates: one request to this website for the list of versions. It carries the version you have and nothing else. Updates are downloaded from this website and checked against the developer's signature before they are installed.
• When you sign in or buy: the sign-in page of Google, GitHub or X in a macOS sign-in sheet, then a request to this website, which asks Dodo Payments whether your account bought Shepi; when you buy in the app, Dodo Payments' checkout in a window inside Shepi. Shepi keeps the answer on your Mac, signed by the developer.
• The trial: the first time Shepi connects to Herdr on this Mac, and every few days during the 14 days, it sends this website this Mac's ID: a one-way hash made from the Mac's hardware ID and Shepi's own name, so it identifies this Mac to Shepi only and can't be turned back into the hardware ID, which never leaves the Mac. With it go Shepi's public key for this Mac and a signature. The website keeps one record per Mac: that ID and the trial's start and end dates, so reinstalling doesn't start another trial. It isn't linked to an email or account.
• Once you've bought: when Shepi starts, and about once a week while it runs, it checks with this website that your purchase still stands and gets a renewed record. It sends that record, a signature and a random number, nothing else. If the website can't be reached, nothing changes; only after 30 days without a check does Shepi ask you to connect and check again (it warns you a week before).
• Nothing else. No usage data, no analytics, no telemetry.

Purchases and sign-in

Shepi is sold by Dodo Payments, which acts as the reseller and merchant of record: it takes the payment and handles tax, receipts and refunds, and its privacy policy covers what you give it at checkout. To buy, and to unlock Shepi on a Mac, you sign in with Google, GitHub or X; that service then knows you signed in to Shepi. We receive the account's email address and ID (GitHub and X also send the account's public name and username, which we don't use), use them once to ask Dodo Payments whether that email bought Shepi, and keep neither. When you buy, Dodo Payments receives that email address, and which service you signed in with and its account ID, with your order. X's sign-in also grants read access to posts because X requires it; Shepi never uses it. We never see your card details or your password.

Downloads

Downloading and trying Shepi involves no account and no payment. Cloudflare, which hosts this website, keeps standard request logs (IP address, time, page) for a short time to run and protect the service; we do not use them to identify you. Apart from Google Analytics' (below), the website sets no cookies except while you sign in: one that holds the sign-in step for up to ten minutes, and on /buy one that keeps your sign-in for ten minutes. Only this website can read them, and both then expire. Dodo Payments' checkout on /buy and Cloudflare's spam check on the Support page load their own scripts and may set cookies of their own, covered by their policies. No third-party fonts. This website counts its visits with Google Analytics. In the EEA, the UK and Switzerland it loads only after you press Accept on the cookie pop-up, which asks once; elsewhere it loads at once. Cookie settings changes your choice. It records the pages you view, the site you came from, your browser, device and approximate location, and which of the Download and Buy buttons, the questions and the showreel's steps you use, with two cookies of Google's (_ga and _ga_…, kept up to 13 months). Google doesn't store your IP address, Google signals and advertising features are off, and none of it is linked to your purchase, your Mac or your sign-in. Google processes it for us under its data processing terms, possibly in the United States (EU–US Data Privacy Framework), and keeps it for 2 months. A content blocker or Google's opt-out add-on stops it too; the site works the same. The checkout, sign-in and thank-you pages carry no analytics. To limit abuse, the website keeps a scrambled form of your IP address for up to a day when you send feedback, sign in, or when Shepi checks its purchase as it starts; nothing can be read back from it.

Send Feedback

Help › Send Feedback, and the form on the Support page, send what you typed and attached to the developer by email, plus, from the app, a few lines of context (app, Herdr and macOS versions, the open view, the focused tab's layout with neutral names, your last ten shortcuts and menu commands, each with its time, the window size); from the Support form, only the versions you typed. Never terminal contents, names or paths; "What's included" shows it before you send. The form on the Support page runs Cloudflare's Turnstile spam check in your browser, so Cloudflare sees that request (your IP address and browser signals), as its privacy policy describes. Your email address is included only if you add one, and is used only to reply. The website keeps no copy: reports live only in the developer's mailbox, and are deleted there if you ask.

The diagnostic log

Shepi keeps a log of its own last three days in ~/Library/Logs/Shepi: connection states, errors, notification decisions, update checks and the licence's state (never a key or an account), with neutral names (space 1, machine 1) from the start, so no terminal contents, names or paths are ever written to it. It leaves the Mac only inside a feedback report you send with Include a diagnostic log on, together with a summary of each Shepi crash macOS kept from the last 14 days: what failed and where in Shepi's code, never the rest of the crash report. "What's included" shows all of it before you send. Each report gets a random ID (such as P-7K3Q-9M2X) that you can quote in an email; it says nothing about you or your Mac. Shepi also keeps the IDs of your last three reports.

Children, changes, contact

Shepi is a developer tool and is not directed at children. If this policy changes, the new version is published here with a new effective date, and material changes are noted in the release notes. Shepi is made by WIO. Email you send to support@shepi.app is kept only in the developer's mailbox, used only to answer, and deleted if you ask. You can ask what we hold about you, or for it to be deleted, at support@shepi.app. To have a Mac's trial record deleted, include its trial ID (Settings › Shepi in Shepi); a deleted record can't be restored, and that Mac's next trial would start again.