$_ShellRiderBack to the site

Privacy

What we keep, and why.

Last updated October 31, 2026. Plain English, because that's how we'd want to read it.

The short version

ShellRider keeps the smallest amount of information it can. Practice runs in your browser. If you make an account, we keep your email, your name if you give one, and your practice progress, so your progress can follow you between devices. We don't sell any of it and we don't show ads.

What we collect

• The waitlist. If you join it, your email goes into a Google Form and a Google Sheet that only Keenan can see. It's used for one thing, telling you when ShellRider opens up.
• Accounts. Your email address, your name if you add one, and the date you signed up. If you sign in with Google, Google tells us your email, your name and a Google account number so we can recognize you next time. We never see your Google password.
• Passwords. If you set one, we store a scrambled version of it, never the password itself. We can't read it back.
• Two step verification. If you turn on an authenticator app, we store its secret in an encrypted form. If you add a passkey, we store its public half, which can't be used to sign in from anywhere else. Backup codes are stored scrambled, like passwords.
• Progress. Which rungs you've earned, your streaks, your ride history and your Fast Lane schedule. That's the whole point of the account.
• Sign in records. When you sign in, we note the time, a rough version of your browser and your network address, so you can see your active sessions and so we can stop password guessing. These expire with the session, within 30 days.

What we don't do

• No ads and no ad trackers.
• No selling or renting your information to anyone.
• No reading your emails or your files. The practice terminal is a simulation in your browser.
• No ad trackers and no analytics from other companies. Cloudflare, which hosts the site, counts page views with a small script that sets no cookies and doesn't follow you across sites. If anything about that changes, this page changes first.

Who else touches the data

• Cloudflare hosts the site, the accounts database and the email sending for sign in codes, and counts page views.
• Google handles the waitlist form and, if you choose it, Google sign in. Google's own privacy policy covers what Google does.
• Google Fonts serves the fonts, which means Google sees that your browser loaded them.

Cookies

One cookie keeps you signed in. A couple of short lived ones hold the state of a Google sign in or a passkey check for a few minutes. Your light or dark choice is saved in your own browser and never sent to us.

Your choices

• You can practice without an account. Progress then stays in your browser only.
• You can delete your account yourself from the account page. That removes your email, your progress and everything else tied to the account.
• You can ask for a copy of what we hold, or ask us to delete it, by emailing hello@shellrider.app.

Kids

ShellRider is made for adults and students in training programs. It isn't meant for anyone under 13, and we don't knowingly keep accounts for them. If one slipped through, email us and we'll remove it.

Changes

If this page changes in a way that matters, the date at the top changes and account holders hear about it by email.