Shepi collects nothing on its own. Here is exactly what it touches.

Shepi has no accounts of its own, no analytics and no crash reporting. It connects only where you ask it to: SSH to your machines, a purchase check when you sign in and when Shepi starts, a feedback report when you press Send, and a check for a new version if you allow it. This page lists everything the app stores, reads and sends, so that "nothing" is a claim you can check.

What Shepi stores on your Mac

Your settings (font, notifications, sidebar, Shepi's own shortcuts) in Shepi's preferences file.
In your Keychain: the day your trial started; the account you signed in with; and, once you buy, the signed record that Shepi is yours (your email, the sign-in service and its account ID, the Paddle order number and date).
The reply address you last gave Send Feedback, and an unsent feedback draft. Screenshots you paste into it are kept in a temporary folder until the report is sent, then deleted.
Nothing else. There is no copy of your terminal output outside the memory of the running app. Machines are saved by Herdr, not by Shepi.

What Shepi reads

Herdr's configuration file on this Mac, to learn your key bindings and sound settings. It is never modified.
Herdr's local connection, to show your spaces, tabs and panes and to send your keystrokes to them.
The Host names in ~/.ssh/config, to suggest them when you add a machine. Shepi runs Herdr's own herdr and ssh commands; it never reads your keys.
The Git status of the folders your panes are in, and which program each pane is running, to show the branch, the changes and the pane's command.

What leaves your Mac

SSH connections to machines you added in Herdr, authenticated with your own SSH keys. Shepi does not store or transmit keys, passwords or passphrases.
A feedback report, only when you press Send (below).
Update checks, only if you allow them (Shepi asks once, on its second launch, and Settings can change it) or when you choose Check for Updates: one request to this website for the list of versions. It carries the version you have and nothing else. Updates are downloaded from this website and checked against the developer's signature before they are installed.
When you sign in or buy: the sign-in page of Google, GitHub or X in a macOS sign-in sheet, then a request to this website, which asks Paddle whether your account bought Shepi; when you buy in the app, Paddle's checkout in a window inside Shepi. Shepi keeps the answer on your Mac, signed by the developer.
When Shepi starts, it checks with this website that your purchase is still valid. It sends only your licence, nothing else; if the website can't be reached, nothing changes.
Nothing else. No usage data, no identifiers, no telemetry.

Purchases and sign-in

Shepi is sold by Paddle, which acts as the reseller and merchant of record: it takes the payment and handles tax, receipts and refunds, and its privacy policy covers what you give it at checkout. To buy, and to unlock Shepi on a Mac, you sign in with Google, GitHub or X; that service then knows you signed in to Shepi. We receive the account's email address and ID (GitHub and X also send the account's public name and username, which we don't use), use them once to ask Paddle whether that email bought Shepi, and keep neither. When you buy, Paddle receives that email address, and which service you signed in with and its account ID, with your order. X's sign-in also grants read access to posts because X requires it; Shepi never uses it. We never see your card details or your password.

Downloads

Downloading and trying Shepi involves no account and no payment. Cloudflare, which hosts this website, keeps standard request logs (IP address, time, page) for a short time to run and protect the service; we do not use them to identify you. The website sets no cookies except while you sign in: one that holds the sign-in step for up to ten minutes, and on /buy one that keeps your sign-in for ten minutes. Only this website can read them, and both then expire. Paddle's checkout on /buy and Cloudflare's spam check on the Support page load their own scripts and may set cookies of their own, covered by their policies. No analytics, no third-party fonts. To limit abuse, the website keeps a scrambled form of your IP address for up to a day when you send feedback or sign in; nothing can be read back from it.

Send Feedback

Help › Send Feedback, and the form on the Support page, send what you typed and attached to the developer by email, plus, from the app, a few lines of context (app, Herdr and macOS versions, the open view, the focused tab's layout with neutral names, your last ten shortcuts and menu commands, each with its time, the window size); from the Support form, only the versions you typed. Never terminal contents, names or paths; "What's included" shows it before you send. The form on the Support page runs Cloudflare's Turnstile spam check in your browser, so Cloudflare sees that request (your IP address and browser signals), as its privacy policy describes; Shepi's own Send Feedback has no spam check. Your email address is included only if you add one, and is used only to reply. The website keeps no copy: reports live only in the developer's mailbox, and are deleted there if you ask.

Children, changes, contact

Shepi is a developer tool and is not directed at children. If this policy changes, the new version is published here with a new effective date, and material changes are noted in the release notes. Shepi is made by WIO. Email you send to support@shepi.app is kept only in the developer's mailbox, used only to answer, and deleted if you ask. You can ask what we hold about you, or for it to be deleted, at support@shepi.app.