Security at Shelvio

Your photos, voice notes, and listings are your inventory. Here is how we look after them, in plain language.

Your data stays yours

  • We never sell your personal information.
  • We do not use your photos, voice notes, or listings to train AI models, and the AI providers that help generate your drafts are not allowed to either.
  • We do not use the contents of your listings, photos, or recordings for advertising.
  • Your workspace is private and not publicly accessible. We check that requests for listings and photos come from an authorized member of the correct workspace.

How it is protected

  • We use encryption in transit and at rest.
  • Sign-in is handled by a dedicated identity service using Sign in with Apple and Google. Shelvio's own servers never store a password for you.
  • Shelvio does not receive or store your full card number. Payments are handled by the App Store, Google Play, or our web payment processor.
  • If you connect a marketplace account, its authorization credentials are stored encrypted and are used only to keep that connection working and to carry out the actions you ask for.
  • Your photos and recordings live in private storage. Uploads and views go through short-lived, signed links rather than public URLs.

You are in control

  • Delete any listing from your dashboard and its photos and recordings are removed from the active service.
  • Delete your whole account at any time from inside the app. Your content is removed from the active service, subject to the limited backup and legal-retention exceptions described in the Privacy Policy.
  • Guest workspaces that are never linked to an account are cleaned up automatically after a period of inactivity.

The full details, including exactly what we collect and why, are in our Privacy Policy and AI & Data pages.

Found a security issue?

We welcome reports from security researchers and from anyone who spots something that looks wrong. Email security@shelvio.ai with the steps to reproduce and what you found. We aim to acknowledge reports within two business days and will keep you informed as we investigate and address valid issues. We do not currently operate a bug bounty program, and submitting a report does not create an entitlement to compensation. Machine-readable contact details are at https://shelvio.ai/.well-known/security.txt.

Scope

In scope:

Out of scope:

  • Denial of service or volume-based testing of any kind
  • Social engineering of our team or our users
  • Vulnerabilities solely within third-party services we use. Please report those directly to the provider. Issues caused by Shelvio's configuration or integration of a third-party service remain in scope.
  • Automated scanner output without a demonstrated impact
  • Missing best-practice headers, TLS configuration suggestions, or email DNS (SPF, DKIM, DMARC) suggestions
  • Dependency or version reports without a working exploit
  • Clickjacking on pages with no sensitive action, self-XSS, or purely theoretical issues
  • Rate-limit observations without a demonstrated security impact
  • Issues that require physical access to a device or an already compromised device

Good-faith research

Research conducted in good faith and consistently with this policy is considered authorized. Limit testing to accounts and data you own or have permission to use, avoid disrupting the service, stop once you have confirmed the issue, and give us reasonable time to investigate and address it before public disclosure. We will not initiate legal action for accidental, good-faith violations of this policy.

For account, billing, or product help, use support@shelvio.ai or the support page.