Effective: 2026-10-23

Shuichi — Privacy Policy

This policy is issued by Konstantin Lebedev, an individual entrepreneur registered in Georgia (registry details and address: Legal information), who is responsible for the processing described here, and is governed by the law of Georgia, without prejudice to any mandatory consumer-protection or data-protection law of your own country that cannot be displaced by agreement.

If you are in the European Union or the United Kingdom, the GDPR (or the UK GDPR) applies to the personal data we process about you when we sell and renew Shuichi, whatever law governs our contract, and you have the rights listed under "Why we process your data, and your rights" below.

---

Overview

Shuichi is a Mac menu-bar app. Most of what it does — clipboard history, dictation, notes, calendar, audio mixing, system monitoring — happens on your Mac, in local files it creates on your Mac, with no server involved. It does make a handful of network calls: checking for software updates once a day, downloading a speech-recognition model if you pick a larger one, and, if you have a subscription, renewing your subscription key about once a month and opening the billing portal when you ask for it. Buying Shuichi gives your name and email to Creem, the seller; Creem passes them to our key server, which drops them at once without storing them (see "Buying Shuichi"). None of these calls carry the content you type, say, copy, or write. The rest of this document is the actual policy, not a summary of it.

What Shuichi stores on your Mac, and where

Unless stated otherwise, the following live in ~/Library/Application Support/NotchOne/ on your own Mac. Nothing in this list is uploaded anywhere by the app, with two exceptions, both only for a subscription: your subscription key — which carries no name or email, only an opaque subscription id and dates — is sent to our key server when it renews and when you open the billing portal — see "Buying Shuichi".

• Clipboard history — clipboard.db. Text, and other pasteboard content, that you copy while the app is running. The file is created with permission 0600 (only your account can read it) inside a 0700 directory, and the database runs SQLite's secure_delete so deleted rows are zeroed rather than left recoverable on disk.

• Shuichi does not record content a source app marks as concealed, transient or auto-generated under the org.nspasteboard.* standard (the convention password managers and browsers use to say "don't save this") — that content is dropped at the moment of copy, never written to disk.

• Shuichi also recognizes the shape of common secrets — AWS, GitHub, Stripe, Slack, Google and OpenAI key prefixes, JWTs, PEM key blocks, and a general high-entropy-token heuristic — and drops those the same way, even from a source that set no privacy flag.

• You control how long history is kept (a retention setting) and there is a single "Clear history" action that removes everything.

• These filters reduce the chance that a secret is stored; they cannot recognise every secret. If you copy something sensitive that carries no privacy marker and does not look like a known key format, it is stored like any other clipboard item until you delete it or it ages out.
• Notes — notes.db, the notes you write in the app's Quick Notes feature. Deleted one note at a time, or by deleting a whole folder (which removes its notes with it) — there is no single "delete all notes" action in the interface today.

• Dictation history — dictations.db, the transcripts of what you have dictated or transcribed from a file, kept locally so you can find past dictations again. Retention is adjustable (default: forever) and there is a single "Clear" action, the same shape as clipboard history.

• A temporary dictation audio file, while a recording is being transcribed. Written with 0600 permission in the system temp directory (not Application Support), and deleted the moment transcription finishes. If the app crashes mid-recording, a leftover file is swept the next time you dictate, but only once it has sat untouched for at least an hour — so it never deletes audio that might still be in progress.

• Downloaded speech-recognition models — the Whisper/Parakeet model files you choose to download (see "Speech recognition" below), and the one small model shipped inside the app itself.
• Your key, once you enter one, so you do not have to paste it on every launch. A subscription key carries no name or email; a Lifetime key includes the name and email it was issued to and never leaves your Mac. For a subscription Shuichi also keeps when it last tried to renew, the answer it last got (for example "refunded"), and the date it first saw the "payments open" line in the update feed (see "Software updates"). All of this is in macOS UserDefaults, on your Mac.

• The date you first launched Shuichi, in UserDefaults and, as a second copy, as one item in your login Keychain (service app.notchone.license, account firstLaunch). The copy exists so that deleting the app's settings does not restart the 14-day trial. It is a date and nothing else, it is not synced to iCloud, and Shuichi never shows a Keychain prompt for it. Uninstalling the app does not remove it; you can delete it in the Keychain Access app.

• A cache for the optional "AI tool limits" display — see that section below for what feeds it.

• Settings and small feature flags — stored with macOS's own UserDefaults, e.g. whether keyboard auto-switch or its typo-fix feature is on.

If Shuichi is not licensed (the trial ended, a subscription ended, or no key was entered), it does not delete or hide anything stored above because of that — it only stops starting new work. The retention settings you chose keep working as before. Your notes, clipboard history and past transcripts stay readable, searchable and exportable.

What Shuichi reads, without storing it

• Calendar — with your permission, Shuichi reads today's events from Calendar (EventKit) to show them in the Focus tab, and can create a calendar event when you use quick-add. This stays in Calendar (Apple's own store) — Shuichi does not keep its own copy of your calendar.

• Keystrokes (Input Monitoring) — used only to detect that you typed in the wrong keyboard layout and switch it for you. Never recorded, never transmitted, and confirmed by the code: the auto-switch feature persists only two on/off settings flags, not what you typed.

• Microphone — captured only while you are actively dictating, transcribed on your Mac (see "Speech recognition" below), never uploaded anywhere.

Shuichi turns speech into text only. It does not identify who is speaking and does not create a voiceprint or any other biometric identifier.

• Screen / window contents (Screen Recording) — used only to capture a live thumbnail for the Dock-preview feature; the thumbnail is cached in memory for as long as you hover and is overwritten on the next capture. No code path in the Dock module writes a captured image to disk.

• Other apps' audio (audio-capture entitlement) — read so Shuichi can show a per-app volume mixer and route audio to a different output device. Processed live, not recorded to a file.

• What's playing (media metadata: track/app name) — read from the system's Now Playing state for the media-hub feature. Local only.

• System performance (CPU, memory, and similar) — read locally for the SysMon feature. Not stored, not transmitted.

Shuichi does not have a login or an account system. There is nothing to sign into, and no profile of you exists on any Shuichi server tied to how you use the app.

The "AI tool limits" display

This is a real feature, on by default whenever the app's main panel is open and Shuichi is in its trial or licensed — not an opt-in you have to turn on. If you use Codex CLI or Claude Code on the same Mac, Shuichi shows their usage limits at the foot of its panel.

What it reads, exactly, while the panel is open (every 2 seconds, only while open — it stops the instant you close the panel):

• ~/.claude/projects/** — walks the directory listing (file names and modification times only) to find the single most-recently-touched session file, then reads at most the last 32 KB of that one file.

• ~/.codex/sessions/**/rollout-*.jsonl — the same pattern, for Codex CLI's own session logs.

• ~/.claude/settings.json — read-only, and only to show you, in Settings, the statusline command you already have configured (so a suggested change can preserve it rather than overwrite it). Nothing here is ever written back to this file.

What it never does: make a network call, or read an authentication token or API key. The comment in the code is explicit about this being a deliberate choice, not an oversight: the design specifically avoids touching account credentials.

What it writes: its own small script (limits/statusline-hook.sh, only readable/writable/runnable by you) and its own cache file (limits/claude-statusline.json), both inside Shuichi's own data folder — never inside ~/.claude or ~/.codex.

Speech recognition (dictation) happens on your Mac

Dictation is transcribed locally, using either of two bundled engines (whisper.cpp or a second engine, sherpa-onnx/Parakeet) — never sent to a cloud speech-to-text API.

The app ships with one small model built in. If you choose a larger or different model in Settings, Shuichi downloads it from a public file host over HTTPS:

• Whisper models, from Hugging Face (huggingface.co/ggerganov/whisper.cpp) — a well-known public model repository, not a Shuichi server.

• The Parakeet model, from GitHub Releases (github.com/k2-fsa/sherpa-onnx).

This download carries your IP address to that host (ordinary for any file download) and the name of the model file you asked for. It never carries anything you have said, typed, copied or written. The file's hash is checked against a pinned value before Shuichi will use it.

Buying Shuichi

Creem sells Shuichi to you as merchant of record. Creem collects your payment details, runs the charge and any refund, and handles tax, as an independent controller under its own privacy notice. We never see your card details.

Our key server does not keep your name or email address. For each purchase Creem notifies our key server (a Cloudflare Worker we run, at keys.shuichi.app). Creem's notification contains your name and email; our server drops them at once, before anything is written to storage or to a log, and keeps only Creem's identifiers (order, checkout, subscription and customer ids), what you bought, dates and, for a subscription, its status. We send no email with your key. Our server uses this to:

1. show your key on the page you return to after checkout. That page opens with your order id and checkout id in its address; our server checks with Creem that this checkout is completed, belongs to that order and is for Shuichi, and only then shows the key. Reopening the same link shows the key again, so keep the link private: anyone who has it can see the key;
2. keep your subscription key renewed while you pay, and stop renewing it after you cancel, after the paid period, or after a refund or chargeback.

A subscription key carries no name or email: an opaque subscription id, the plan, dates and our signature. A Lifetime key includes the name and email you gave Creem: our server asks Creem for them when the page opens, signs them into the key in memory and does not store them. That key stays on your Mac and is never sent back to us, because it never renews.

If you close the page before saving your key, write to hello@shuichi.app from the email address you paid with, with the date of the purchase and the order number from Creem's receipt if it shows one; we find the purchase in Creem's records and send you a link to the same page.

Renewing a subscription key

A subscription key is short-lived on purpose: each covers at most 30 days, yearly plans too. From three days before the date your current key is paid through, Shuichi asks our key server for a fresh key, at most once every six hours, until it gets one — in practice about once a month. A Lifetime key never does this.

Each renewal request is an HTTPS POST to keys.shuichi.app/renew and carries:

• your current subscription key — the key id, an opaque subscription id (a random string that means nothing outside our server), the plan, the date the key was issued, the date it is paid through, its last day and our signature. It does not contain your name or email address;
• once you have seen a renewal reminder in the app, the renewal date that reminder was about — not when or where you saw it. Our server keeps this date in your subscription record, so that a yearly renewal whose reminder did not reach you is refunded (see the Refund Policy);
• fixed headers that are the same on every Mac: User-Agent: Shuichi and Accept-Language: en — no app, library or system versions and no list of your languages;
• what every HTTPS request carries: your IP address and the technical headers Host, Content-Type, Accept, Content-Length, Connection, Cache-Control and Accept-Encoding.

No cookies, no device identifier, nothing you have typed, said, copied or written. Our server checks the key's signature, looks up your subscription, and may ask Creem for its current status; it does not store your IP address or these headers. Cloudflare, which hosts the server, processes them to deliver the request. If the server does not recognise the key or cannot be reached, Shuichi does not decide anything and tries again later, still no more than once every six hours.

Withdrawal and cancellation forms

The Withdraw from your purchase here and Cancel your subscription here links open one form at shuichi.app/withdraw. It asks for your order number or license key, not for your name or email address. Our key server keeps your statement — its text (for an extraordinary termination, with the reason you gave), the subscription or order id, the type, the dates, the refund and the country of your purchase from Creem's record (it decides whether Germany's rule applies) — as the record that we received it, and the page shows it to you as your receipt. We do not email the receipt for now. Please leave your name and email address out of the reason.

Opening the billing portal

When you press Manage subscription, Shuichi sends your current key to keys.shuichi.app/portal (the same request information as above). Our server asks Creem for a link to your customer portal, using your Creem customer id, and Shuichi opens that link in your browser.

How long we keep each kind of data

You can ask us to delete your data earlier at hello@shuichi.app. We will delete what we are not required to keep and tell you what we had to keep and why.

Until deletion on these schedules is automated, we do it by hand once a month, so a record may stay up to one month past its date.

Checking a key never calls a server. Every key — trial, subscription, Lifetime — is verified on your Mac against a public key built into the app. Only two requests use the network, both for a subscription: renewing the key and opening the billing portal. Buying does not create an account with us.

See the Sub-processor list for every company that touches data on Shuichi's behalf, and the Refund Policy for what happens to a key after a refund.

Software updates

Shuichi checks updates.shuichi.app (our own host, on Cloudflare) for a signed update feed once a day by default, without asking you first each time — this is Sparkle's own default behavior, and we have not changed it.

Each check carries your IP address (ordinary for any web request) and a User-Agent string with Shuichi's own version number and the Sparkle library's version — e.g. Shuichi/1.2.3 Sparkle/2.6.0 — so we can tell how many machines are asking, and on which version. It does not carry your name, email, or anything you have typed; a separate setting Sparkle supports for sending a fuller machine profile (SUSendProfileInfo / "system profile") is off, because we never turned it on.

We use requests to appcast.xml as our nearest honest estimate of how many copies of Shuichi are out there and checking in, from the same Cloudflare request logs described under "Cookies" below, not a separate tracker. To tell copies apart without knowing who anyone is, we may reduce an IP address to a one-way hash; a hash like that is still treated as personal data, so we use it only for counts, do not combine it with purchase records, and delete the hashes 30 days after the request; only the resulting counts, which say nothing about anyone, are kept.

The "payments open" line. The same update feed can carry one extra line telling Shuichi that paid plans are on sale. Shuichi reads it from the feed it already downloads — there is no extra request — and keeps the date it first saw it on your Mac. It decides when an unlicensed copy whose trial has ended stops starting new work. It carries nothing about you.

Update installation itself is verified with the EdDSA signature Sparkle checks before ever offering to install anything — a forged or tampered update is refused.

Cookies

Shuichi's website does not set cookies and does not load a third-party analytics script. Traffic numbers, where we look at them at all, come from Cloudflare's own server-side request logs for our own domains — nothing runs in your browser to collect them.

Contacting us directly

Two things in the app open your own mail client rather than sending anything themselves — you see the message and choose whether to send it:

• Send Feedback fills in a pre-written email (to feedback@shuichi.app) that includes your Shuichi version, build number, macOS version, Mac architecture (Apple Silicon/Intel), your distribution channel, the current state of each permission (granted/denied/not asked), and which optional features you have turned on — deliberately never your clipboard, notes, file paths, or window titles. You see the whole message in your mail app before it sends.

• Refund and support requests, the same way, to hello@shuichi.app.

What we do NOT do

• We do not run analytics, crash reporting, or a telemetry SDK inside the app.

• We do not sell your data. There is no data of yours to sell beyond what is described above.
• We do not use your content — clipboard, notes, dictation transcripts, calendar — to train any model, ours or anyone else's.

Your choices

• Clipboard history and dictation history each have an adjustable retention window and a single "Clear" action. Notes are deleted one at a time, or by deleting a whole folder — there is no single "delete all notes" action today.
• Revoke any permission (Microphone, Calendar, Screen Recording, Input Monitoring, Accessibility, Audio Recording) in System Settings → Privacy & Security at any time; the corresponding feature simply stops working until you grant it again.
• Uninstalling the app and deleting ~/Library/Application Support/NotchOne/ removes everything described in "What Shuichi stores on your Mac" above, except: the temporary dictation WAV (already gone by the time transcription finishes); the first-launch date in your login Keychain (delete the item app.notchone.license in Keychain Access); settings in UserDefaults (they go when you delete ~/Library/Preferences/app.notchone.plist); and the purchase record kept by our key server (see "How long we keep each kind of data").

Where your data is processed

We are in Georgia, outside the EU. Data reaches us and our providers in these ways:

• From Creem to us. Creem, in the EU, passes your purchase data to our key server under its Data Sharing Agreement, part of Creem's Merchant Terms, in which Creem and we each act as a controller. We need this data to deliver the key you bought from Creem, and our server keeps only Creem's identifiers, what you bought and dates — never your name or email address.

• Cloudflare runs our key server, website, update feed and the routing of our email, and may process data in the US and other countries. Its data processing addendum is part of our agreement with Cloudflare and includes the EU standard contractual clauses, and Cloudflare is certified under the EU–US Data Privacy Framework.
• Our support mailbox is a Gmail mailbox, which Google provides under its own terms (see the Sub-processor list).

You can ask us for a copy of the safeguards that apply to your data at hello@shuichi.app.

Why we process your data, and your rights

Creem needs your name and email to sell you Shuichi; we do not. Without a purchase we cannot issue or renew a key. A subscription key that cannot renew stops working as described in Terms of Service §6.

You can ask us for a copy of the data we hold about you, to correct it, to delete it, to restrict or object to its use, or to receive it in a portable form, as far as the GDPR or the law of your country gives you that right; write to hello@shuichi.app. To find your data we need your order number from Creem's receipt email. We answer within one month. If you are not satisfied, you can complain to the data-protection authority of the country where you live or work. For data that Creem holds as the seller, use Creem's own process in its privacy notice.

Children's privacy

Shuichi is made for adults. Buying it requires being old enough to make a contract where you live. We do not knowingly collect personal data from children; if you believe a child has sent us personal data, write to hello@shuichi.app and we will delete it.

Changes to this policy

We will update the date at the top of this page when this policy changes, and describe what changed in the app's release notes if the change is material.

Contact

Questions about this policy: hello@shuichi.app (privacy) or feedback@shuichi.app (feedback).

---

Note: Creem is the merchant of record and sells Shuichi to you (see "Buying Shuichi" above); the maker of the software, who runs the key server and answers for this policy, is named at the top of this document.