Privacy Policy

Shiro Labs ("we") operates SHIRO Terminal OS. This policy explains what we collect, why, and how we treat it. We collect as little as possible. SHIRO is non-custodial — we never see your private keys.

1. What we collect

• Wallet address. When you connect a Solana wallet we store your public address. This is on-chain public data.
• Email (optional). Only if you join the waitlist or sign up for alert email delivery. We use it to contact you.
• Display name (optional). If you set one.
• Activity logs. Pages viewed, searches run, alert rules created, trades placed, sessions and IP/User-Agent of the requesting browser. Used for product analytics, security, and audit.
• Trading metadata. Order parameters, intent hashes, fills, fees, and tx hashes for trades you initiate through SHIRO. Stored in our database for your history and for the audit trail.
• Trendline (prediction-market) data. Your paper account balance, open and closed positions, individual trades (side, shares, average price, unrealized/realized PnL), and any markets you propose (title, description, category, deadline, resolution criteria). Stored for your history, the leaderboard surface, and to settle resolutions.
• Risk acknowledgments. Timestamps when you accept the live-trading and Trendline risk disclosures. Used so you only see each acknowledgment once and to evidence that it was given.
• Cookies. A session cookie for login and preferences. We do not use third-party advertising cookies.

2. What we do NOT collect

• Private keys or seed phrases — these never leave your wallet.
• Personal identifying documents (ID, passport, address proof). We are not a regulated custodian.
• Off-platform browsing or third-party site data.

3. Why we collect it

• To operate the Service and route signed trades.
• To bill subscriptions and accrue platform fees.
• To detect and respond to abuse, fraud, and security incidents.
• To improve the product (anonymized usage analytics).
• To comply with applicable legal requests (subpoenas, court orders, regulatory inquiries).

4. Third-party sub-processors

We use the following service providers, each of which has its own privacy policy:

• Vercel — frontend hosting.
• Railway — backend hosting.
• Helius — Solana RPC and DAS API.
• Birdeye — token market data.
• Jito — MEV-protected transaction routing.
• Jupiter — DEX aggregation quotes and swap routes.
• YouTube Data API v3 (Google) — public video metrics used as an oracle input for some Trendline markets.
• Stripe — subscription payment processing.
• Sentry — error monitoring (no payload bodies).
• PostHog — product analytics (event names + anonymized properties).

5. Sharing

We do not sell your data. We share data only with the sub-processors above as needed to operate the Service, or with law-enforcement when legally compelled. We will push back on overbroad requests where reasonably possible.

6. Retention

We retain account data while your account is active and for up to 24 months after closure for audit, dispute, and legal compliance. Aggregated/anonymized analytics may be retained indefinitely.

7. Security

Data is encrypted in transit (TLS) and at rest (cloud-provider managed keys). Wallet authentication uses standard signed-message challenges. Admin access requires JWT + IP-allowlist. No system is impenetrable — see the Risk Disclosure for trading risk.

8. Your rights

You may: request a copy of your data, request deletion (subject to retention requirements above), correct inaccurate data, and opt out of non-essential analytics. To exercise these rights, contact us via the link in the footer.

9. International transfers

Your data may be processed in jurisdictions outside your country of residence. By using the Service you consent to that processing.

10. Changes

We may update this Policy. Material changes are posted in-app and at this URL with an updated date.

11. Contact

Privacy questions, data requests, or complaints: reach us at the contact link in the footer or via the channels published at shiroterminal.com.