Privacy
Last updated: 2026-04-28
This page covers the marketing site at sheaf.sh. The hosted instances (test.sheaf.sh, app.sheaf.sh) are covered by a separate Hosted Service Privacy Policy, because those process substantially more data.
What this site collects
Nothing, as far as we intentionally do. No analytics, no tracking pixels, no cookies, no embedded third-party scripts, no fingerprinting.
Your browser fetches HTML, CSS, an SVG, a PNG favicon, and an Atom feed. That's it.
Server logs
The marketing site is served from AWS EC2 (eu-west-1) behind nginx. nginx keeps standard HTTP access logs (IP address, timestamp, URL, user agent) for operational and abuse-prevention purposes. Logs are retained for the minimum time operationally practical and in no case longer than 30 days, and are not combined with any other data about you.
If you email [email protected] we receive and store that message in order to reply. The mailbox is self-hosted on infrastructure operated by Lupine Systems LLC — no third-party mail provider is involved on the receiving side. Messages are retained only as long as needed to handle your query, plus a reasonable period afterwards for records.
Who controls your data
The data controller for this site is Lupine Systems LLC. See the Legal page for company details, or contact [email protected] for anything related to your personal data.
Your rights
Under GDPR, UK GDPR, CCPA/CPRA and comparable laws you have rights to access, correct, delete, export, and object to processing of your personal data. Since this site stores essentially nothing tied to you personally, most requests will be very fast to handle. Email [email protected].
Where your jurisdiction does not grant you these rights as a matter of law, we extend them as a matter of policy: anyone may exercise the rights set out above by emailing [email protected], regardless of where they are. Practical limitations apply only where retention is required by law that does bind us (e.g. billing records under US tax law).
Changes
If this policy changes we'll update the Last updated date at the top. Since this site sets no cookies and stores nothing tied to you personally, there is nobody to email and no account to warn: the dated page is the notice.
This covers the marketing site only. The hosted service has its own policy and its own notice mechanism, described in Terms §14.