Security

How Sheevs keeps you safe.

Plain answers about your payments, your conversations and your account.

Payments by StripeYour card goes straight to Stripe. Sheevs never sees or stores your card number.
Encrypted conversationsChats are encrypted before they are saved, so a stolen database alone can’t be read.
Never used to train AINot by Sheevs, and not by the AI providers we use.
No ads, no trackersNo advertising, no ad trackers, and we never sell your data.
You’re in controlDownload or delete your data whenever you want.

Payments

Memberships are paid through Stripe, a payment processor certified to PCI DSS Level 1, the highest security level in the card industry. You type your card into Stripe’s own secure page; Sheevs never receives, sees or stores your card number.
Sheevs only learns what it needs to run your membership: your plan, its status and whether a payment went through.
Free trials: Stripe checks your card for $0 when your trial starts. Nothing is charged until day 15, and we email you 3 days before. Charges show as SHEEVS on your statement.
You can cancel, change plan or update your card any time in Settings → Plan & billing.

Your messages, chat titles, memories, the text of PDFs you share and images Sheevs creates for you are encrypted (AES-256-GCM) before they are stored, and each one is tied to your account so it can’t be moved to another.
Photos you send are shrunk on your device (which also removes location data) and sent to the AI with that message only. They are never stored.
To be clear about the limits: this is encryption at rest, not end-to-end encryption. Sheevs’ servers unlock your chats to show them to you and to answer you.
Our team’s tools have no way to browse chats. If you report a reply, only that reply is shared with us, sealed so only our team can open it.

Is my data used to train AI? Not by Sheevs, and not by our AI providers. Providers may hold messages briefly (up to 30 days) for safety checks, then delete them. This is always on.
We only route your messages to model providers that agree not to train on them, and every request asks for no data retention.
Each request carries an anonymous ID instead of your name or email, so abuse checks don’t identify you to the provider.

Sign-in is passwordless: a one-time code or link sent to your email, so there is no password to steal or reuse.
Sign-up is protected against bots, and every member has sensible rate limits.
Our team’s admin area requires two-factor authentication on every sign-in.

Every page is served over HTTPS only (with HSTS), behind a strict Content Security Policy that blocks scripts we didn’t write, and can’t be embedded in other sites.
Database access is locked down: every table is closed by default and the website can only call specific, checked functions. The public site never holds the database master key.
We keep the minimum: no IP addresses or browser fingerprints are kept in your Sheevs profile or chats, and our visit counts are anonymous totals. (Our sign-in provider keeps short-lived security logs, as every sign-in system does.)

Download a copy of your data, turn off chat history, set chats to delete themselves, or delete your account (and everything in it) from Settings → Data & privacy and Account.
Questions, or think you’ve found a security problem? Email us and we’ll respond quickly.