This policy explains what Shelf-ish stores, what it does not collect, and how privacy-related questions or requests are handled.
Shelf-ish stores and processes the content you choose to capture so you can keep, find and reuse it. We do not operate a server that receives your clips, sell your content, build advertising profiles or use third-party analytics or telemetry in the app or browser extension. This does not mean the software handles no data: it handles your clips and associated information on your devices and, if enabled, through your own iCloud account.
Clips can contain text, links, files, images, screenshots, audio, transcripts, code, locations, contact details, tags, summaries and source metadata. Shelf-ish uses these to provide capture, search, previews, organisation, copying, sharing, expiry and optional on-device intelligence and personal-device sync.
The optional browser extension requires a compatible Shelf-ish app on the same Mac. Before capture starts, you must accept its capture disclosure, grant website access and connect the extension to the Mac app. You may enable website access across ordinary websites, pause individual sites or pause capture everywhere.
When you copy selected webpage text, or use the selection context-menu action, the extension reads the selection, page address, title and available source details. Depending on the page, these may include an author or sender, message or comment identifier, message time, heading or code line. It does not invent missing attribution. If you enable surrounding text, it also reads a short nearby passage or a preceding loaded AI prompt associated with the selected response. This can include personal communications or other sensitive information present there.
The extension sends that context to Shelf-ish on your Mac over an authenticated connection restricted to 127.0.0.1. It does not send it to a Shelf-ish server, advertising service or external AI provider. The Mac app can attach it to the matching copied clip; the explicit selection action can import the selection. The extension does not modify your clipboard or request unrestricted clipboard read/write access. It does not record a browsing history or capture every page.
The selected text is limited to 32,000 UTF-8 bytes, surrounding text to 6,000 bytes and the complete capture envelope to 64,000 bytes. Copy snapshots expire after five seconds for transport validation. These are size/transport bounds, not a promise that all personal or sensitive information is detected.
Private browser windows, browser-internal pages, input/password fields, known password-manager and sign-in surfaces, and explicitly private or hidden page elements are excluded. These checks cannot recognise every sensitive webpage or piece of text. Pause a site or disable surrounding text before copying material you do not want included.
The Safari extension is included in Shelf-ish for Mac. Before it sends context, you accept a one-time capture disclosure in the extension and choose whether to include surrounding text. Safari stores that choice per browser profile. Older Safari installs also need this disclosure; a previous Chrome-style permission or consent flag does not replace it.
The extension requests access to ordinary HTTP and HTTPS websites during setup. Safari controls the website grant, including the option to allow all websites. Shelf-ish does not silently grant access or require an extra enable step for each site. You may deny or restrict access in Safari, pause individual sites, turn off extension capture, or switch off Safari in Shelf-ish Settings → Connectors. Existing global and site pauses are preserved when you accept the disclosure.
Only a trusted Copy event or your explicit selection-capture action sends context. That context can include the selected text, page address/title and available source details. If you choose surrounding text, it can include a nearby passage or preceding loaded AI prompt and may contain personal communications or other sensitive information. The same ordinary-page, sensitive-field and private-window exclusions described above apply. The browser does not request general clipboard read/write access or keep a browsing-history archive.
Safari uses Apple's packaged native messaging and the local Shelf-ish App Group, not Chrome's localhost connection. No pairing code or browser credential is required. The native handler only accepts fresh, bounded envelopes while the Mac host is available and Safari capture is allowed. Captured text is limited to 32,000 UTF-8 bytes, surrounding text to 6,000 bytes and the full envelope to 64,000 bytes. Safari's native freshness limit is three seconds. Transport expiry is not a guarantee of physical deletion while the apps are closed: temporary staging files are consumed and removed by the host or pruned on subsequent writes. Saved clips and context follow the retention, iCloud and deletion rules below.
Safari keeps the disclosure version, surrounding-text choice, capture preference, paused-site list and content-free delivery status in local extension storage. The native App Group also holds a content-free host-availability timestamp and capture-status flags. These are used for the connection status and privacy gates, not analytics. Safari context is not sent to a Shelf-ish server, advertising service or external AI provider. Summaries run on the Mac; saved context may sync through your own iCloud account when sync is active.
Disabling or removing the extension stops future handoffs but does not delete saved clips. Remove source context or delete clips in Shelf-ish to remove saved content; supported deletions propagate when sync is active. Safari manages the extension's website access, profiles and removal of its local storage.
Chrome stores your consent version, capture preferences, paused/previously enabled sites, browser choice, connection/profile identifiers and pairing credential in local extension storage. The credential is restricted to trusted extension contexts. A temporary connection proof is held in trusted session storage or memory and expires after two minutes. Native connection credentials are held in the Mac Keychain. The last delivery status contains a time, success/state and an error code, not clip text, source URLs, filenames or author details. The extension does not keep a separate archive of captured passages.
Disconnect revokes a current per-browser connection. Legacy shared-code clients may only forget their local credential; revoke/rotate that shared code in the Mac app if you need to invalidate all clients using it. Disconnecting or uninstalling the extension does not delete clips already saved in Shelf-ish. Chrome controls removal of its extension storage on uninstall; the Mac connection can also be revoked in Shelf-ish. Paused-site preferences remain until you change them or remove the extension's stored data.
Saved clips, source context and summaries live in Shelf-ish's local app store. When iCloud is enabled and available, clip contents and associated source details may sync through Apple's CloudKit service to your other devices. Apple handles that data under its privacy policy. A local browser handoff does not mean a saved clip will remain on one device. We do not claim that every sync field or every older app version has end-to-end encryption. Concealing a clip is a display/privacy control, not a guarantee that it is excluded from sync.
Saved content follows the app's retention/expiry and pinning settings. You can remove source context or delete a clip in Shelf-ish. With sync active, supported deletions propagate to your devices; backups and Apple's service retention follow their own lifecycle. Disconnecting capture stops new handoffs, not prior copies, exports, backups or saved clips. Local deletion markers may remain to prevent older devices restoring deleted clips; they do not retain the deleted clip body.
Summaries and other intelligence features use Apple frameworks on your device. The Chrome extension does not itself generate summaries. Neither it nor the Mac context summariser sends your passages to an external AI service. Availability depends on your Mac, OS, language, Apple Intelligence settings and model readiness. Model output can be inaccurate; the captured source remains available to inspect.
Link previews may fetch metadata/images directly from websites you save; those sites receive the network request under their own policies. Apple model assets may be downloaded when needed. Saving to Reminders uses Apple's Reminders store, which can separately sync through iCloud. If you deliberately share/export a clip or contact support, your chosen recipient receives what you send. We do not receive routine clip content or source passages from normal extension use.
The Chrome extension uses local storage for settings/connection state, scripting and optional website access to read context on authorised pages, active-tab access to identify the current site when you open the menu, and a context menu for explicit selection capture. Its mandatory host access is limited to the local Mac connection. Website permission alone does not replace capture consent. You can manage permissions in Chrome and pause capture in the extension.
The native app requests protected access only for relevant features, such as microphone, speech recognition, system-audio recording, Reminders or input control. You can manage that access in System Settings.
Shelf-ish Context's use of information obtained through Chrome APIs complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use that information only to provide the disclosed source-context features and their necessary connection/security functions. We do not sell it, use it for advertising or credit/lending decisions, or allow people to read your captured content through a developer-operated service. Any content you expressly send to support is used to handle that request.
Shelf-ish is not directed at children under 13. We do not knowingly receive their personal information through a developer-operated collection service. If data practices materially change, we will update this policy and provide appropriate notice and consent before the changed handling begins.
Contact shelfishapp@gmail.com for privacy questions or support. Public policy: https://shelfishclipboard.com/privacy.
