Privacy Policy

Last updated: June 1, 2026

This Privacy Policy explains how Shovel ("we," "us," or "our") collects, uses, and shares information about you when you use the Service. We are committed to handling your data responsibly and transparently. By using Shovel, you agree to the practices described in this policy.

1. Information We Collect

We collect information you provide and information generated through your use of the Service. Account information includes your email address, display name, and profile image. Authentication is passwordless: we use magic links sent to your email and sign-in with Google, and when you connect Google we store the OAuth tokens needed to authenticate you. We create and store session records so you stay signed in, and these records include technical details such as your IP address and device or browser information. We also collect the content you create, including universes, wikis, posts, comments, and shovels, along with any images you upload.

2. How We Use Your Information

We use your information to operate and provide the Service; to authenticate you and keep your account secure; to store and display the content you create; to communicate with you, including sending magic-link sign-in emails and important account notices; to understand how the Service is used and to improve it; and to protect against fraud, abuse, and security threats. We process your data on the legal bases of performing our contract with you, our legitimate interests in operating and improving the Service, your consent (where required, such as for certain analytics cookies), and compliance with legal obligations.

3. Where Your Data Is Stored

Account data and content are stored in our application database. Images and other media you upload are stored on Cloudflare R2 and served from our content delivery network at cdn.shovel.one. We retain your information for as long as your account is active or as needed to provide the Service, and afterward only as required for legitimate business or legal purposes.

4. Analytics & Cookies

We use PostHog for product analytics to understand how people use Shovel and to improve it. PostHog may set cookies and collect usage events, such as pages viewed and actions taken, along with associated technical information. We use strictly necessary cookies to keep you signed in and to operate the Service, and analytics cookies as described here. Where required by law, we obtain your consent before setting non-essential cookies, and you can control cookies through your browser settings.

5. How We Share Information

We do not sell your personal information. We share data with service providers who help us operate Shovel, including our email delivery provider for magic links, Google for authentication, Cloudflare for media storage and delivery, and PostHog for analytics. These providers process data on our behalf under appropriate agreements. We may also disclose information when required by law, to enforce our Terms, or to protect the rights, safety, and security of our users and the public. Content you choose to make public on Shovel is visible to other users and visitors.

6. Data Deletion & Your Rights

You can request deletion of your account and associated personal data at any time by contacting us at privacy@shovel.one. Depending on where you live, you may have rights under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), including the rights to access, correct, delete, and port your personal data; to object to or restrict certain processing; and, for California residents, to opt out of any sale or sharing of personal information (note that we do not sell your data). To exercise any of these rights, email privacy@shovel.one and we will respond as required by applicable law. You also have the right to lodge a complaint with your local data protection authority.

7. Children's Privacy

Shovel is not directed to children under the age of 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, please contact us so we can delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Service or by email and update the "Last updated" date above. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

9. Contact