Privacy

Last updated September 13, 2026

Shun runs on your machine. There is no account to create, no telemetry to opt out of, and no service of ours in the loop. This page lists every case in which data leaves your device, and what is stored where.

What this policy covers.

This policy applies to the Shun desktop application for macOS, Windows, and Linux; the connector plugins you choose to enable inside it; the Shun Browser Use extension for Google Chrome; and this website. The same text is kept with the application source.

No account, no telemetry.

No Shun account: There is nothing to sign into. Shun has no user database, no licensing server, and no identifier that follows you between machines.
No telemetry: No analytics library or crash reporter is linked into the application. Diagnostics stay in a local log you can read yourself.
No advertising or data sale: Shun does not sell, rent, or share personal data with advertisers or data brokers, and does not use it to determine creditworthiness or for lending purposes.

What stays on your device.

Shun writes to its own application data directory and to the workspaces you open. None of it is uploaded to us.

Task records: Conversations, tool results, attachments, and conversation checkpoints, kept as plain files under the application data directory so a task can be resumed after a restart.
Workspace content: The files a task reads or edits stay in the workspace you bound it to. Shun does not copy a workspace into a service.
Browser findings: Accessibility snapshots, screenshots, console output, and network findings captured by Browser Use while a tab is attached.
Connector credentials: Described separately below, because they are the only secrets Shun stores.

When data leaves your device.

Three cases, each one initiated by something you configured or asked for.

The model provider you select: A task sends its prompt, its conversation, and the tool results relevant to that task to the provider you chose — either a runtime on your own GPU or a hosted API. A local runtime keeps the task on the machine; a hosted provider is governed by that provider's terms and privacy policy. Nothing is sent to a provider you have not selected.
A connector you authorize: When you connect Gmail, Figma, Render, Cloudflare, or GitHub, Shun calls that service's API directly from your device with the credential you granted. The request goes from your machine to that service; it does not pass through a server of ours.
Update checks and web research: Shun asks the published release feed — and any update mirror you configure — whether a newer version exists. When a task asks for web research, that request goes to the research path configured for it. Both are initiated per task and never run quietly on your behalf.

How connector credentials are stored.

Shun refuses to keep a secret it cannot protect.

Operating system encryption: Connector credentials are encrypted with the platform's own facility — the macOS Keychain, Windows DPAPI, or the Linux secret service — through Electron's safeStorage. If the operating system cannot provide encryption, Shun declines to store the secret instead of writing it in the clear.
GitHub is not copied: GitHub access comes from the GitHub CLI login you already have. Shun reads that credential where the CLI keeps it and does not duplicate it into its own store.
Disconnecting removes it: Disconnecting a connector deletes its credential from the device. For Google it also revokes the token at Google, so the authorization cannot be reused even from a stale copy.

Google user data.

Shun talks to Google for one feature — the Gmail connector — and only after you authorize it yourself with your own Google credentials.

What is accessed: With the gmail.modify scope: message and thread content and metadata, labels, drafts, and sending mail that a task explicitly requests. The scope is requested only when you connect Gmail, and you can revoke it at any time from your Google Account's third-party connections page.
How it is used: Only to perform the Gmail work you ask a task to do — searching, reading, organizing, drafting, or sending. Google user data is never used for advertising or profiling, and never used to train a model.
What is stored, and where: OAuth access and refresh tokens are stored on your device only, in the operating system's encrypted credential store. Mail that a task reads appears in that task's local transcript so you can review what the model was shown, and remains there until you delete the task.
How it is shared: Google user data is not transferred to anyone except the model provider you selected for that task, and only to the extent the task needs it. It is not sold, not shared with advertisers, and not read by any human at Shun. There is no Shun server that receives it.
Retention and deletion: Disconnecting Gmail deletes the tokens from your device and revokes them at Google. Mail content that reached a transcript is deleted with that task.
Limited use: Shun's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Shun Browser Use for Chrome.

Browser Use lets the desktop application inspect and control a Chrome tab that you explicitly hand to a task. Its single purpose is that browser-control connection.

What it can process: While a task controls a tab: the tab's URL and title, visible page text and accessibility information, screenshots the task requests, page console messages and errors, and the navigation, clicks, scrolling, and text entered through the task. It also handles local files a task explicitly selects for upload, and reports the path and status of downloads started by the controlled tab.
What it does not do: It does not request access to Chrome's cookie store, does not read saved passwords, and does not ask for broad website host permissions. Because it works with a tab you were already using, that page may already be signed in through Chrome's normal session.
Where the data goes: Browser data travels only over a loopback connection on the same device, to the locally running Shun application, which accepts connections only from the extension's own origin. The extension has no analytics, advertising, or developer-operated endpoint. Browser results may then be included in that task's requests to your selected model provider, under the rules above.
Why each permission exists: debugger obtains accessibility snapshots and screenshots and performs the navigation and input a task requests, and detaches as soon as the run finishes, fails, or is cancelled. tabs lists, selects, creates, and navigates the tabs a task uses. downloads starts a download the user asked for and waits on downloads begun by the controlled tab, keeping Chrome's normal directory, conflict handling, and safety checks. alarms wakes the background worker after Shun restarts so the local bridge can reconnect.
Your controls: Access starts only during a task you started, and Chrome shows its debugging notice only while a tab is attached. You can cancel debugging, disable or remove the extension, or quit Shun at any time; Shun releases attached tabs when a run ends or the local connection drops.

This website.

shunagent.com is a pre-rendered static site. It sets no cookies and loads no analytics, advertising, or third-party scripts. Our host processes ordinary request data — IP address, user agent, requested path — to serve the page and protect the domain.

Changes to this policy.

This policy is updated when Shun's behavior changes. The date at the top of this page is the version in effect, and material changes are described in the repository's release history.

Contact.

Privacy questions and data requests can be filed on the Shun repository. Issues are public; say so if your request needs a private channel and we will arrange one.