Privacy Policy

At Shiori, we take your privacy seriously. This Privacy Policy explains how we collect, use, and protect your personal information when you use our website and services.

Company Information

Shiori is operated by Appit Studio, located at Boris Rumenov 9, Sofia, Bulgaria. We act as the data controller for all personal information collected through our services.

Contact Email: support@appitstudio.com

What Information We Collect

We collect the following types of information:

• Identification Information: Name and email address when you register an account or contact us
• Bookmark Data: URLs, titles, descriptions, folders and tags that you save in Shiori
• Technical Data: IP address, browser type, device information, and operating system version
• Usage Data: Bookmark counts, feature usage patterns, and service interactions
• Transaction Records: Subscription history and payment information (processed securely by Stripe)
• Communications: Messages you send us through support channels

How We Collect Your Information

We collect information when you:

• Visit our website
• Register for a Shiori account
• Use the Shiori service, ExtraBar widget, or Chrome or Safari extension
• Subscribe to a paid plan
• Contact our support team
• Subscribe to our newsletter

Chrome and Safari Extensions

The Shiori extensions help you save and manage bookmarks using your Shiori account. They connect to api.shioriapp.io for bookmark synchronization and app.shioriapp.io for sign-in and account management.

• When you choose to add the current page, the extension reads its URL and title. It sends that information to Shiori when you save the bookmark. It does not collect your browsing history, monitor other tabs, or read the contents of bookmarked pages.
• Sign-in takes place on the Shiori website. The extension uses a one-time authorization code with PKCE to obtain access. Safari asks for access to the Shiori sign-in website so its return page can relay that code and the sign-in state to the extension.
• The extension keeps its access credentials in browser session storage, rather than persistent local storage. Signing out or closing the browser clears those credentials.
• Bookmarks, folders and tags are cached locally for offline use. Signing out or a rejected session clears this local library.
• A random device identifier and device name identify this browser in your Shiori account. These and the last signed-in account identifier can remain locally after sign-out; they are not sign-in credentials.
• Chrome uses the browser favicon service to display bookmark icons. Safari displays placeholder icons.
• The extensions do not include advertising, analytics or crash-reporting services, and we do not sell extension data. Website analytics and cookie choices are described separately in this policy.

The use of information received through Chrome APIs follows the Chrome Web Store User Data Policy, including its Limited Use requirements. Chrome Web Store User Data Policy

You can start account deletion from the Account panel in the extension or on the Shiori website. The website asks you to confirm before deleting your account. Delete your Shiori account

Legal Basis for Processing

We process your personal information under the following lawful grounds:

• Contract Performance: To deliver the service you registered for
• Consent: For marketing communications and cookie usage
• Legal Compliance: To meet our legal obligations
• Legitimate Interests: For security, fraud prevention, and service improvement

How We Use Your Information

We use your information to:

• Provide and maintain the Shiori service
• Synchronize your bookmarks across devices
• Process subscription payments and manage billing
• Respond to customer support requests
• Send administrative communications about your account
• Improve our website and services
• Prevent fraud and enhance security
• Send marketing communications (with your consent)

We do not sell your bookmark data or engage in profiling or automated decision-making.

How We Share Your Information

We do not sell your personal data. We share information only with trusted service providers who help us operate our business:

• Payment Processors: Stripe for secure subscription payment processing
• Email Services: Email platforms for sending account notifications and newsletters
• Analytics Services: Analytics services to understand website and service usage
• Hosting Providers: Cloud infrastructure providers for data storage and service delivery

All service providers are contractually bound to protect your data and use it only for the purposes we specify.

Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Correction: Request correction of inaccurate information
• Right to Deletion: Request deletion of your personal data
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Request your data in a portable format (we support JSON, CSV, and HTML export)
• Right to Object: Object to certain types of processing
• Right to Withdraw Consent: Withdraw consent for marketing or cookies at any time
• Right to Complain: Lodge a complaint with your local data protection authority

To exercise any of these rights, please contact us at support@appitstudio.com. We will respond within one month.

Data Security

We implement appropriate technical and organizational measures to protect your personal information, including TLS 1.3 encryption in transit, encryption at rest, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Data Retention

We retain personal information as needed to provide the service and meet legal obligations. When account deletion completes, we remove your bookmarks, folders, tags, account, sessions and access tokens from the active service and delete the linked WorkOS identity. Paid Shiori subscriptions are cancelled; deletion does not automatically refund previous payments. Stripe may retain invoices and payment records for legal and accounting purposes. Copies in rotating backups and security logs expire according to their retention cycles. Newsletter subscriptions are separate: use the unsubscribe link in a newsletter to stop them. An independently purchased ExtraBar licence is not deleted with your Shiori account.

Cookies

Our website uses cookies to improve your browsing experience and analyze website traffic. You can control cookie preferences through our cookie consent banner or your browser settings.

Third-Party Links

Your bookmarks may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

Children's Privacy

Shiori is not intended for use by children under 13 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 13, we will delete it promptly.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email. Changes will also be posted on this page with an updated "Last Updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us: