Last updated June 27, 2026
Shotoku is a local-first, open-source tool. This policy explains what data exists, where it goes, and what we do with it — which is very little.
Shotoku runs entirely on your machine. Authorization decisions, your policy file, and the decision ledger never leave your device unless you explicitly move them. We do not have servers that receive or store your decisions.
We collect nothing automatically. Specifically:
This landing page (shotoku.dev) is a static site hosted on Vercel. Vercel may collect standard server access logs (IP address, request path, timestamp) as part of their infrastructure. We do not use cookies, tracking pixels, or third-party analytics.
The Shotoku source code is hosted on GitHub. If you open an issue, submit a pull request, or interact with the repository, GitHub's own privacy policy applies to that activity.
Installing Shotoku via npm goes through the npm registry. npm may log your IP address and the packages you download as part of their standard infrastructure. We do not receive this data.
Questions about this policy can be sent to peschardjulius03@gmail.com.