Privacy

Shape is a writing app in a free, open beta. This page says plainly what it keeps and what it doesn’t. Last updated November 1, 2026.

What Shape stores

• Your account email, so you can sign in with a link instead of a password. The person building Shape is emailed when you sign up and keeps a private list of accounts, and may write to you, for example to say thanks. Deleting your account removes you from that list.
• Your work: your stories, their restore points, your Hole notes and projects, the requests you send to Claude and its replies.
• A Workshop usage counter: how many Workshop requests and roughly how many tokens your account used this month, so the free beta allowance can be capped. You can see your own count under Account; no other user can. If you reach a limit, the person building Shape gets an email with your account address, so it can be lifted if you ask.
• Sharing, if you use it: the frozen copy of a story version you chose to share, and the favorites, comments and notes readers leave on it. A reader’s feedback is stored with the name they chose to show. Readers of a link can leave feedback without an account (unless you require sign-in for that link): their browser keeps a random code so they can see and remove their own marks, and Shape stores only a one-way hash of it. They may optionally leave an email if they’d like a reply; it’s shown only to the author of that link, marked unverified, and never required.
• Waitlist email, if you join one: the address you enter on the Shape Terminal waitlist page, the date, and where you came from (for example a video link). It’s stored in Supabase and used only to email you about Shape Terminal. Email hi@ckai.co to have it deleted.
• Feedback, if you send it: what you write in Feedback, its kind (bug, idea, other) and, unless you untick "Include this page’s details", which page you were on, your screen size, light or dark theme, your browser’s user-agent and that page’s recent error messages. Never your story text. The person building Shape reads it to fix and improve Shape, and may reply; you see the status and the reply in the app.

This is stored in a Postgres database run by Supabase in the United States. Database rules let each signed-in account read only its own rows. Readers of a link you share see only that frozen copy and their own marks.

What Shape doesn’t do

• No analytics or tracking. No ad pixels, no third-party trackers, no selling or renting data.
• No ads. Nothing you write is used for advertising.
• We don’t read your work and don’t use it to train anything.

Workshop and Anthropic

Workshop answers come from Claude, made by Anthropic. When you press Send or ask a question, the passage, your request and the story text it needs are sent to Anthropic to generate the answer.

• Free beta Workshop: the request goes from your browser to Shape’s server function, which checks your monthly allowance and forwards it to Anthropic with Shape’s own API key. Shape keeps the request and reply in your account (as above), not in server logs.
• Your own key (optional): if you add your own Anthropic API key, it stays in your browser and your requests go from your browser straight to Anthropic, under your agreement with Anthropic. Shape’s server and database never receive the key. Remove it any time under Account.

Anthropic’s API does not train its models on this data by default; see Anthropic’s privacy policy.

Other services involved

• Supabase (database and sign-in).
• Resend (delivers sign-in emails).
• Vercel (serves the app’s files and this website).
• jsDelivr and Google Fonts (code libraries and fonts your browser downloads).
• Anthropic (Workshop answers, see above).
• Cloudflare Turnstile: when someone leaves feedback on a shared link without signing in, Cloudflare checks they’re human (usually invisibly). Cloudflare processes that check, including the reader’s IP address and browser signals, under its Turnstile privacy policy. Shape keeps only the time a link’s guest passed it. Readers who only read, and signed-in readers, never load it.

Export and delete

In the app, open Account:

• Export my work downloads everything as a JSON file and a readable Markdown file.
• Archive and delete a story: Archive keeps a story until you restore it. Delete forever, from the archive, removes it with its restore points and shared links.
• Delete my account and data permanently removes your account, your work, the links you’ve shared and the feedback you’ve left on others' stories. Database backups made by Supabase expire on their own schedule.

Contact

Questions or requests: hi@ckai.co.