This Privacy Policy explains how Shenra collects, uses, shares, stores and deletes personal data when you use the
website shenra.io and the web app app.shenra.io (including the installable app/PWA).
1. Who is responsible
Christopher Hollweck (Shenra)
Simmelsdorfer Straße 8
90482 Nürnberg, Germany
Email: info@shenra.io
Contact us at this address for any privacy question or to exercise your rights.
2. What Shenra is
Shenra is a security-awareness app. It offers short lessons, announced and unannounced phishing exercises, a way to
report suspicious messages, the AI assistant “Luna” and collectible cards for motivation. Shenra can be used privately
or provided by an employer for work. Private and work accounts are completely separate: they are never linked and
neither can access the other.
3. Google user data (Sign in with Google)
You can create and sign in to a private Shenra account with your Google account. This is optional; you can also sign in with email.
3.1 Data accessed
Shenra requests only the scopes openid, email and profile. From Google we receive:
your email address and whether Google has verified it;
your name (we store only your first name, as your display name);
the URL of your Google profile picture;
your unique Google account ID, used to recognise you when you sign in again.
Shenra does not request or access Gmail, Contacts, Calendar, Drive, Photos or any other Google
service, and never receives your Google password.
3.2 How we use Google user data
to create your Shenra account and sign you in securely;
to show your first name and profile picture inside the app;
to send you account-related emails (security and service notices);
only if you start it yourself: to check your email address against known data breaches (section 4).
We use Google user data only to provide and improve these user-facing features.
3.3 Sharing of Google user data
Google user data is shared only with our database and authentication provider Supabase (servers in the EU), which
stores it on our behalf under a data processing agreement. If you start the breach check, your email address is sent
to Have I Been Pwned for that check only. We do not share Google user data with anyone else, including your employer.
We do not sell Google user data.
We do not use or transfer it for advertising, retargeting or interest-based ads.
We do not use it to determine creditworthiness or for lending purposes.
We do not use it to develop, improve or train generalised AI or machine-learning models.
No human reads it unless you give consent, it is needed for security or abuse prevention, or the law requires it.
3.4 Storage, protection and deletion
Google user data is stored in our EU database, transmitted only over HTTPS and protected by row-level access control.
We keep it as long as your account exists. When you delete your account in the app (Profile → Security) or by emailing
info@shenra.io, your Google user data is deleted together with your account.
You can revoke Shenra's access to your Google account at any time at
myaccount.google.com/permissions.
3.5 Limited Use
Shenra's use and transfer to any other app of information received from Google APIs will adhere to the
Google API Services User Data Policy,
including the Limited Use requirements.
4. Other data we process
Account: email address, sign-in data (for email sign-in a password stored only in hashed form),
optional display name and picture, language and settings. For work use, your employer provides the account via
Microsoft Entra ID/SCIM (name, work email, group and organisation attributes).
Learning progress: completed lessons, exercise answers, reactions to phishing exercises
(e.g. reported, clicked), collected cards and the resulting protection status. Only you can see these.
Breach check (optional): which known data breaches contain your email address and which data
types were affected. We never receive or store passwords from breaches.
Luna (AI assistant): your messages and images you attach, used to generate answers. Luna can
remember facts about your security setup; you can view, edit and delete them under “What Luna knows”. Luna never
asks for passwords, one-time codes or card data.
Reported messages: messages you report as suspicious, processed only to check them and show you the result.
Push notifications: your browser's push subscription, if you enable them.
Security and technical data: daily usage counters to prevent abuse (no message content) and
technical logs (IP address, time, errors).
Sign-in with the respective account (only if used)
incl. USA
Transfers outside the EU rely on EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
7. What we never do
No sale of personal data, no advertising, no advertising or tracking cookies, no third-party analytics.
Employers never see private data. For work use they see only basic account data, mandatory-training records
and group statistics; groups of fewer than five people are not shown.
No use of learning data for performance reviews, disciplinary action or rankings.
No automated decisions with legal or similarly significant effects (Art. 22 GDPR).
8. Retention
Account and sign-in data (including Google user data): until you delete your account.
Private Luna chat history: set by you to 1, 7, 30, 90 or 180 days.
Learning data: as long as the account exists.
Technical logs: only as long as needed for operation and security.
9. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction, data portability and objection,
and the right to withdraw consent at any time. You can also lodge a complaint with a supervisory authority, e.g. the
Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.
Contact: info@shenra.io.
10. Changes
We update this policy when features or the law change. The version published on this page applies.