SharedOS

Privacy Policy

Effective October 18, 2026

Who we are

This policy covers the SharedOS website at sharedos.ai and SharedOS Cloud at cloud.sharedos.ai — its console, and the managed machines and agents you create there. Both are operated by SysteMind, Inc. (“we”). Questions about this policy or about your data go to support@systemind.io.

The open-source SharedOS packages you run on your own computers send nothing to us. They only report to SharedOS Cloud if you connect them to a Cloud project with a project key, and then only the audit events described below.

What we collect

• Your account. Your email address and the name you give. If you sign up with a password, it is stored only as a salted hash.
• Signing in with Google. If you choose to sign in with Google, we ask Google only for the openid, email and profile scopes, and receive your name, email address and profile picture. We do not ask for access to your Gmail, Drive, Calendar, contacts or any other Google data.
• Signing in with GitHub. If you choose to sign in with GitHub, GitHub gives us your public profile (username, name and profile picture) and your email address. We do not ask for access to your repositories.
• Sign-in sessions. A session cookie keeps you signed in. Our sign-in provider records the IP address and browser of sign-in requests in its logs.
• Projects and keys. The projects and environments you create and their names. Project keys are shown to you once and stored only as one-way digests.
• Audit events. When a SharedOS kernel is connected to your project, it sends the authorization decisions it makes: which agent asked for which tool or resource, whether it was allowed, and why. These are what the console shows you.
• Managed machines. For each machine you create: its name and size, its agents and the model each one uses, and everything the agents and you put on it — files, commands, background jobs, previews and agent conversations. Model-provider credentials you give a machine (for example an OpenRouter API key or a Claude credential) are encrypted before they are stored, and are used only to run that machine’s agents.

We do not use analytics or advertising services on the website or in the console, and the only cookies we set are the ones that keep you signed in, remember that you asked to see the walkthrough, and let you open your machines’ previews. We do not collect payment card details, precise location or your contacts.

Google user data

Information we receive from Google is used only to create your account and sign you in, and to show your name and picture in the console. We do not use it for advertising, we do not sell it, and we do not transfer it to anyone except as needed to provide sign-in, to comply with the law, or as part of a merger or acquisition. No person at SysteMind, Inc. reads it except with your permission, for security, or to comply with the law.

SharedOS Cloud’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use it

• To run the service: sign you in, keep your projects, run your machines and agents, and show you their audit trail.
• To keep it safe: detect abuse, look into reports, and protect accounts.
• To write to you about your account or the service, when we need to.

We do not sell your data, we do not use it for advertising, and we do not train models on it.

Who handles it for us

We share personal data only with providers that process it on our behalf:

• Supabase — sign-in and the database that holds accounts, projects and machines.
• Microsoft Azure — the virtual machines that run the console and your managed machines, the key vault that holds our encryption keys, and DNS.
• Vercel — hosting for the sharedos.ai website.
• Google and GitHub — only if you choose to sign in with them.

Your agents send their prompts, and the material they work on, to the model provider their harness uses (for example OpenRouter or Anthropic), with the credential you supplied. That provider handles it under its own terms and privacy policy. Each managed machine also has a SharedNet Room, which is covered by the SharedNet Privacy Policy.

We may also disclose information when the law requires it, or to protect the safety of people or of the service. If SysteMind, Inc. is part of a merger or acquisition, the service and its data may move with it under this policy.

How long we keep it, and deleting it

We keep account data for as long as your account exists. When you destroy a machine, its containers and the files on its disk are removed and the credentials it held are deleted. Our hosting providers keep request logs briefly for security and operations.

To delete your account and the projects, machines and audit events that belong to it, write to support@systemind.io from the address on the account. We will confirm when it is done.

Your choices and rights

To ask for a copy of your data, a correction or its deletion, or to object to a use of it, write to support@systemind.io. Depending on where you live — for example in the European Union, the United Kingdom or California — you may have further rights, including to complain to a data-protection authority. Using them will never count against you. You can also revoke SharedOS’s access at any time from your Google or GitHub account settings.

Security

The website and the console are served only over HTTPS. Passwords are hashed, project keys are stored as digests, and model-provider credentials are encrypted at rest. Commands on a managed machine run in isolated containers. No system is perfectly secure; if you find a vulnerability, please tell us at support@systemind.io.

Children

SharedOS is not meant for children under 13, and we do not knowingly collect their personal data. If you believe a child has given us personal data, write to us and we will delete it.

Where data is processed, and changes

We and our providers process data in the United States and in other countries where they operate. If this policy changes, this page and its effective date change with it, and we will say so in the console when a change matters. See also the Terms of Service.