Privacy Policy

Effective October 27, 2026

Your cards stay on your Mac

Your collection (cards, notes, decks, review history, settings and media) is stored on your Mac, inside Shiori's own folder. Automatic backups are stored next to it. Nobody else can see them, including the developer.

When Shiori uses the network

Shiori only connects to the internet when you ask it to, or when you turn on a feature that needs it:

• iCloud sync (off by default). Your collection is synced through your own private iCloud database, between Macs signed in to your Apple Account. Apple stores it under Apple's privacy policy. The developer can't read it.
• Media from a link. When you, or a dictionary app you've connected, add an image or a sound by its web address, Shiori downloads that file into your collection.
• Images from the web in cards (off by default). If you turn this on, cards that show a web image load it from the site that hosts it, like a browser does.
• Links in cards open in your web browser.
• Check for Updates (only in the version downloaded from the web, not the App Store version) asks GitHub for the newest version when you choose it, never in the background.

Other apps on your Mac

Dictionary apps like Yomitan and Yomitori can add cards and read how well you know words, through a connection on your own Mac (127.0.0.1). It's off by default. Requests from web pages are refused unless you allow them, and you can require a key.

AI assistants like Claude can read and change your cards through MCP, but only after you set them up. Shiori asks you before an assistant deletes anything. What you share with an assistant is handled by that assistant's provider, under its own privacy policy.

Microphone and notifications

Shiori asks for the microphone only when you record audio into a card, and the recording is saved in your collection. Study reminders are notifications scheduled on your Mac.

The deck generators

On the generators page, what you choose (sets, the text you paste, the deck name and options) is sent to the Shiori server, api.shiori.study, which makes the deck and sends it back. Nothing you send is stored or logged, and no account is needed. To limit abuse, the server counts requests per IP address for one minute, in memory only.

This website

shiori.study has no cookies, no analytics and no third-party scripts or fonts. The only script is the generators page's own, and it talks only to api.shiori.study. It's hosted by Railway, which processes visitors' IP addresses to deliver the site, as described in Railway's privacy policy.

Children

Shiori collects no data from anyone, children included.

Changes to this policy

If this policy changes, the new version will be posted here with a new effective date.

Contact

Questions about privacy: support@shiori.study.