Privacy policy

What Shadow collects, why, who sees it, and how you can remove it. Last updated 11 November 2026.

Who we are

Shadow (the app, and the service at heyshadow.ai) is operated by Business Technology Solutions Ltd ("we"). Contact: shiftopus@gmail.com.

What we handle

• Account: your email address and name, used to sign you in.
• Your conversations and work: messages, memories, files, canvases, reminders and plans you create with Shadow. They are kept in your own private workspace and are used to give you the service.
• Mailboxes you connect: described in full below.
• Usage and security records: amounts used against your allowance, sign-in and security events, and error counts. We do not log the content of your conversations.

Google user data and your email

If you choose "Continue with Google" or connect another mailbox, Shadow asks for access to read your mail and to send mail you approve (Google permission https://mail.google.com/), plus your email address.

• What Shadow does with it: when you ask, Shadow searches and reads your messages and writes draft replies for you. A draft is only sent when you tap Send in the app. Shadow reads your mailbox without changing, moving or deleting anything.
• What we store: your sign-in credentials for the mailbox (an access and refresh token, or a password) are stored encrypted. Draft messages you have not sent or discarded are stored so you can review them. The contents of your mailbox are fetched when needed and are not copied into a database of ours.
• Who processes it: to answer you, the text of messages Shadow reads is passed to the AI model that powers Shadow, run for us by a model provider under terms that do not allow it to retain the content.
• Limited Use: Shadow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide and improve the user-facing email features you asked for. We do not sell it, do not use it for advertising, do not use it to build or train generalised AI models, and do not allow people to read it except where you ask us to (for example for support), where it is needed for security or abuse investigations, or where the law requires.
• Disconnecting: remove the mailbox in Shadow (Settings, Email accounts) and we delete the stored credentials immediately. You can also revoke Shadow's access at myaccount.google.com/permissions; for Microsoft accounts at account.live.com/consent/Manage.

Who else sees your information

We do not sell your information. We use service providers to run Shadow: cloud hosting and storage, an AI model provider, and push notifications. They process data only to provide those services for us. Plugins you add may send what is needed for that plugin to the service it uses, and each plugin page says what it can reach. We may disclose information where the law requires.

Where it is kept and how it is protected

Your work lives in a workspace that is separate from other customers'. Data is encrypted in transit and at rest, mailbox credentials are additionally sealed with a separate key, and access between people's workspaces is isolated. No system is perfectly secure, but protecting your information is the first rule we build to.

Keeping and deleting your data

We keep your data while you have an account. You can delete files, canvases and memories in the app, remove a mailbox at any time, and delete your whole account in Settings, which removes your workspace and records. You can also write to shiftopus@gmail.com to ask for a copy or for deletion. Some security and billing records are kept for a limited period where we must.

Children

Shadow is not for people under 16 and we do not knowingly collect their information.

Changes

If we change this policy in a way that matters we will tell you in the app before it takes effect. The date at the top shows the latest version.