Privacy Policy
Last updated 7 July 2026
Sheaf is a local-first writing app. Your writing lives on your device by default and never leaves it unless you choose to turn on cloud sync. This policy explains what we collect, when, and why — in plain language.
Writing without an account
You can use Sheaf without creating an account. In that mode your projects, manuscripts, and settings are stored only in your device's local storage. They are never sent to us, and we have no way to see them. We don't use third-party analytics, advertising, or behavioural tracking.
When you turn on cloud sync
If you create an account to sync and back up your work across devices, we store:
- Your email address — used only to sign you in and send essential account emails, like your one-time sign-in link.
- Your synced content — the projects and text you choose to sync — on our infrastructure, so it's available on your other devices.
Sync is off by default. You choose if and when your writing leaves your device.
Vault mode (end-to-end encryption)
If you enable Vault mode, your writing is encrypted on your device with a key only you hold before it is ever sent to our servers. We store only ciphertext and cannot read your work — not for support, not for anyone. If you lose your Vault passphrase and your recovery code, we cannot recover your writing; that is the trade-off of true zero-knowledge encryption.
Artificial intelligence: none
Sheaf contains no AI features. We do not use AI to read, process, analyse, or generate from your writing, and we never use your writing — or anything derived from it — to train AI models, ours or anyone else's. We do not share your writing with AI providers, and we never will. This applies to everything you create in Sheaf, in every mode; in Vault mode it is additionally enforced by encryption we cannot undo. If Sheaf ever offers an AI-assisted feature in the future, it will be strictly opt-in, and this no-training pledge will still hold — your words will never teach a machine unless that machine is you.
Who processes data for us
When you use sync, a few trusted providers process data on our behalf:
- Supabase — database, authentication, and storage of your synced content.
- Resend — delivery of account emails (sign-in links, etc.).
- Vercel — hosting the Sheaf app.
Each only processes what's needed to provide the service. We never sell or share your data for advertising.
We use your email address solely to authenticate you and to send essential account messages. We don't send marketing email unless you opt in.
Local storage & cookies
Sheaf stores your work and preferences in your device's local storage so it works offline and remembers your setup. We don't use third-party advertising cookies or cross-site trackers.
Keeping and deleting your data
You can stop syncing at any time and keep working locally. To delete your account and any synced content, email us at privacy@sheaf.ink and we'll remove it. Vault (encrypted) content can only ever be read by you, regardless.
Children
Sheaf isn't directed at children under 13, and we don't knowingly collect their data.
Changes
We may update this policy as Sheaf evolves. We'll post the new version here with an updated date.
Contact
Questions? Email hello@sheaf.ink.