Privacy in the Sheuli app.

Last updated 8 November 2026

This page is about the Sheuli app at app.sheuli.com: your account, your dashboard and the apps you connect to it. For the waitlist and the sheuli.com website, see Privacy on sheuli.com.

The short version:

• We only use your information to run your dashboard.
• We never sell it, use it for ads, or use it to train AI. Sheuli has no AI.
• There are no tracking or advertising cookies, and no third-party trackers.
• You choose which apps connect. You can disconnect any of them, or delete your account, at any time, and what’s deleted is gone from our backups within 30 days.

Who runs Sheuli.

Sheuli is run by Aleks Cheifetz, trading as Sheuli, in Sydney, Australia.

• For anything about your privacy, email privacy@sheuli.com.
• For help with the app, email support@sheuli.com.

What we keep about you.

Your account

• Your email address, and how you sign in: with an emailed code, with Google, or both.
• If you sign in with Google, Google tells us your name, email address and profile picture. We don’t get anything else from your Google account unless you connect Google Calendar (below).
• Your first and last name, which you give us when you start.
• Your date of birth, which you give us when you start, so we can check you’re 16 or older.
• Your city, if you choose one. It sets your weather, units, date format and the local cards we suggest. If you skip it, we guess your country from your internet connection instead, and you can change it in Settings.
• Your time zone, from your browser.
• Your preferences, such as units, the clock, date style and spelling.
• If you’re a founding member: when your free year started and when it ends.

Before you’ve set up your profile, including on the sign-in screen, Sheuli uses the country your internet connection seems to be in to choose American or British spelling, and how dates and times are written. That guess isn’t kept.

Your dashboard

• Your cards: which ones, their order and size, and their settings.
• What you put in them: countdowns, to-dos, notes, and the other cards you fill in yourself.

Your devices

• Each device you sign in on, such as a laptop, phone or TV, with its name (like “Chrome on Mac”, or one you choose), its settings and when it was last used. You can see them, and sign any of them out, in Settings → Devices.
• For each signed-in session: when it started, when it expires, and the IP address and browser it signed in from. We use them to name your devices and to help you spot a sign-in you don’t recognise.

Sign-in codes

• When we email you a code, we keep only a scrambled (hashed) copy, so we can check it. It can’t be turned back into the code. The code works for 5 minutes, and the copy is deleted the next day.
• To stop codes being misused, we count how many are sent to each email address and from each internet connection, for up to an hour. Each count is kept under a scrambled code, not the address itself, and deleted the next day.

Feedback you send

• If you use Send feedback in Settings, we keep your message with the screen you sent it from, the app version and the kind of device (phone, tablet, laptop or TV). Nothing else is included. A copy is emailed to Aleks with your name and email address, so Aleks can reply.

Counts

• To see how Sheuli is used and keep it running well, we count things: which days each account is used, how many calls we make to each connected app, and how fast the app loads. Speed counts don’t include who you are.

Errors

• When something goes wrong in the app, an error report goes to Sentry, with email addresses, tokens and anything personal removed first.

Cookies and your browser.

We use cookies only to sign you in and to recognise your device:

• Signing in: a cookie that keeps you signed in (for 60 days, renewed as you use Sheuli), and a short-lived one, for 5 minutes at most, while you sign in with Google.
• Your device: a cookie holding a random ID, so this device keeps its name and settings, even after you sign out. It holds nothing else and lasts up to 400 days.

Sheuli also keeps two things in your browser, so it opens quickly:

• the app’s own files;
• a copy of your dashboard, as you last saw it. It’s deleted when you sign out on that device, when that device is signed out from elsewhere, when your account is deleted, and when someone else signs in on that browser. It’s never shown if it’s more than 7 days old.

There are no cookies for analytics, tracking or advertising, so there’s no cookie banner.

The apps you connect.

You choose which apps connect to Sheuli, and you can disconnect them at any time. For every connection:

• Sheuli only reads. It never changes anything in your other apps.
• It asks only for what your cards show.
• The keys that let Sheuli read your data (tokens, private links and passwords) are encrypted, and are only ever used on our servers, never in your browser.

Calendars, by private link. You paste a calendar’s private address (an “iCal link”). We store the link encrypted, because anyone who has it can read that calendar. We keep only what your cards show, such as each event’s title and time, for today and the next 7 days. We never store the whole calendar.

Google Calendar (once Google has approved it). Sheuli asks Google for read-only access to your list of calendars and their events. We keep only what your cards show, for today and the next 7 days, the same as a private link. Disconnecting removes Sheuli’s access at Google.

Sheuli’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

We use Google user data only to show your calendar on your dashboard. We don’t transfer it to anyone else, don’t use it for advertising, and never use it to develop, improve or train AI or machine-learning models.

Strava. Sheuli reads your activities to show figures like this week’s running distance. It doesn’t keep them.

• Each time a Strava card updates, Sheuli asks Strava again. Only what the card shows is saved, such as its figures or an activity’s name and description, for 48 hours at most.
• Routes and locations are thrown away as soon as they arrive.
• If you disconnect Strava in Sheuli, remove Sheuli in Strava, or delete your account, we delete everything we hold from Strava, and email you to confirm it.

Todoist. Sheuli reads your tasks that are due today or overdue, to show them on your Todoist card. It never ticks off or changes a task. Disconnecting removes Sheuli’s access at Todoist.

Garmin (once Garmin has approved Sheuli). Garmin only sends new data as your watch syncs, and can’t send it again later, so Sheuli keeps a history:

• What we keep: a summary of each activity and each day, such as distance, duration, heart rate, steps, sleep and calories, and each activity’s name and description.
• What we never keep: second-by-second or through-the-day readings, routes or locations, or photos. We never ask Garmin for menstrual cycle or pregnancy data.
• How long: for as long as Garmin is connected. If you disconnect in Sheuli, or delete your account, it’s deleted straight away. If the connection stops working, or you remove Sheuli in Garmin Connect, we keep your history for 30 days so you can reconnect without losing it, and email you 7 days before it’s deleted.

This is health information, which the law treats as sensitive. We ask for your consent on the connect screen, which explains all of this before anything is sent, and we only use it to show your cards.

Weather. For a weather card, our servers send MET Norway (the Norwegian weather service) your card’s place, rounded to about a kilometre. They aren’t told who you are. Weather is shared between everyone in the same area.

Public transport. For a departures card, our servers ask Transport for NSW about the stop you chose. They aren’t told who you are. If you use “Near me”, your browser asks for your location once, to list the closest stops. Only the stop you pick is saved, never your location.

Finding your city. When you search for a city, the search stays on our servers. We use our own copy of a public list of places, so what you type isn’t sent to anyone else.

How we use it.

Only to:

• sign you in and keep your account secure;
• show your dashboard, with your connected apps’ data;
• send the emails Sheuli needs to (below);
• answer your feedback and help requests;
• keep Sheuli running: fixing errors, and staying within each connected app’s limits.

Nobody reads your connected data, unless you ask us to help with a problem and agree to it, it’s needed to keep Sheuli secure, or the law requires it.

We never sell your information, use it for advertising, or use it to train AI.

Emails.

Brevo, the service that sends our emails, sends:

• your sign-in codes, and the code to confirm deleting your account;
• your invitation to the beta;
• emails about your connections, such as confirming your Strava data has been deleted, or a warning before Garmin history is deleted.

Brevo also holds the waitlist (see Privacy on sheuli.com). When you sign in, we check with Brevo whether your email is on it. The first time you sign in, we note on your waitlist entry that you have, so you don’t get emails meant for people who haven’t.

Who handles your information.

These companies handle information for us, only to run Sheuli:

• Cloudflare hosts the app and its database, and delivers feedback emails to Aleks.
• Brevo sends our emails and holds the waitlist.
• Sentry receives error reports, with personal details removed.

When paid plans arrive, we’ll add our payment provider here before anyone is asked to pay.

The apps you connect (Google, Strava, Todoist and, once approved, Garmin) receive requests from our servers for your data, as described above. MET Norway and Transport for NSW receive requests for weather and departures, without anything about you.

Where it’s kept.

Sheuli’s database is in the United States, with Cloudflare. Cloudflare, Brevo and Sentry may also handle your information in other countries. Under Australia’s Privacy Act, that means your information is disclosed overseas, mainly to the United States.

How long we keep it.

Deleting your data.

Disconnecting an app removes Sheuli’s access at that app (where the app allows it), and deletes its keys, everything cached from it and any history, straight away.

Deleting your account (Settings → Your data) asks for a fresh code by email, then:

• deletes your account, dashboards, cards, connections and history;
• removes Sheuli’s access at your connected apps;
• signs out every device. A device that wasn’t online clears its saved dashboard the next time it opens Sheuli;
• if you tick the box, removes you from our mailing list.

A few things take a little longer, or stay:

• Backups are only used to recover from a failure. Deleted data, Strava’s included, is gone from them within 30 days.
• Other services: removing access at your connected apps, or updating our mailing list, can take up to 7 days if one of those services is down. We keep trying until it works.
• A record that the deletion happened, with nothing that identifies you, for 12 months. For 30 days we also keep the account’s ID (a random code, not your email), so that if we ever restore a backup, your account is deleted again.
• Founding members: deleting your account ends your founding membership, free year included. So the free year can’t be claimed twice, we keep a one-way code made from your email address (not the address itself) until Sheuli opens to everyone, and note on your waitlist entry that your founding membership has ended.

Keeping it safe.

• Everything travels over an encrypted connection (HTTPS).
• The keys to your connected apps are encrypted in our database.
• There are no passwords to steal. Sign-in codes last 5 minutes and work once, and we only keep scrambled copies.
• Sheuli only ever asks your other apps for read-only access.
• We never log what your connected apps send us.
• You can see every signed-in device, and sign any of them out, in Settings → Devices.

Your choices.

• See and download your data: Settings → Your data → Export gives you a file with everything we hold about you, including any history.
• Correct it: change your name, date of birth, city and preferences in Settings.
• Disconnect an app: in Settings → Connections, or in that app’s own settings (for example, your Google Account’s security page, or Strava’s settings).
• Delete your account: Settings → Your data.
• Leave our mailing list: use the unsubscribe link in any of our emails.
• Ask us: email privacy@sheuli.com to see, correct or delete what we hold, or with any question about your privacy.
• Complain: if you’re not happy with how we’ve handled a privacy question, you can contact the Office of the Australian Information Commissioner at oaic.gov.au, or the privacy regulator where you live.

Children.

Sheuli is for people 16 and older. When you start, we ask for your date of birth. If it shows you’re under 16, we delete the account straight away, without keeping your date of birth.

If you think someone under 16 has an account, email privacy@sheuli.com and we’ll delete it.

Changes.

If any of this changes, we’ll update this page and the date at the top. Before a change to what we collect or how we use it takes effect, we’ll tell you in the app.