Privacy, written by the person who holds the data.
Shiba is a one-person open-source project. This page describes what this website collects and what the software stores when you deploy it yourself. No law firm wrote it, so it says exactly what the code does and nothing more.
The short version
The waitlist stores your email, your interest choice, an optional GitHub username, and a one-way hash of your IP. That is the whole list. When you self-host Shiba, your code and run data live in your own Cloudflare account, not in anything operated by this project.
What the waitlist collects
The form at /waitlist/ is the only place this site asks you for anything, and it only submits when you tick the consent checkbox:
- emailRequired. Used to send release updates and contributor notices you asked for.
- interestRequired. One of: self-host feedback, contribute, or both.
- githubOptional. Your GitHub username, for contributor recognition.
- ipHashSHA-256 hash of your IP, computed at the edge. Used only to rate-limit submissions. The raw IP is not stored.
There is also a hidden honeypot field that rejects bots. Filling it in just marks the submission invalid.
Where it lives
Submissions go to a dedicated SQLite-backed Cloudflare Durable Object on the project's Cloudflare account. It is not published, indexed, or shared with any third party. Responses are sent with Cache-Control: no-store.
Cloudflare processes the request itself to serve the site and API; Cloudflare's own privacy policy ↗ applies to that edge handling.
What we do not collect
- No analytics, tracking pixels, ad networks, or fingerprinting on this site.
- No cookies beyond the theme preference stored in your own browser's localStorage.
- No data resale, no data sharing, no marketing profiles. There is no ad business here.
- Signing up is never required to access the software. Shiba is AGPL-3.0-only source on GitHub.
When you run Shiba yourself
Shiba is self-hosted software. When you deploy it, every byte of your installation (run logs, task history, repository checkouts, sandbox output, secrets) lives in your Cloudflare account and on your infrastructure. The project never receives telemetry from your deployment. You are the controller of that data, not us.
Provider credentials are deliberately kept out of the container: sandboxed runs receive a dummy key and provider requests are forwarded at the Worker's egress layer, and your GITHUB_TOKEN is attached in the Worker, never inside the container. Details and limitations are in Security & credential boundaries.
Access, correction, deletion
To see, fix, or delete your waitlist entry, open an issue on GitHub ↗ or contact the maintainer through the repository. Include the email address you signed up with. Removal is an admin delete against the Durable Object and is permanent.
The only change that will ever happen to this page is that it gets more specific as the project does. It will not get vaguer.