ShortcutsBridge Privacy Policy

Last updated: July 15, 2026

ShortcutsBridge lets you use your Apple Shortcuts from AI assistants such as ChatGPT. It is built so that your shortcuts live on your own Mac — the service relays requests, it does not host your shortcut data.

Data we collect and why

• Account data: your email address and a salted, hashed password (scrypt). Used solely to operate your account. We never store plaintext passwords.
• Device pairing tokens: a signed token identifying the Mac agent you paired. Used to route your requests to your own device.
• Shortcut data in transit: when your assistant lists or searches your shortcuts, or runs one you name, the request and its result pass through our relay queue — this covers the names of your shortcuts and folders, any text input you provide, and a shortcut's output when it runs. This content is transient: it is held in encrypted storage (Supabase Postgres, in our own project) with a time-to-live of 45–60 seconds and is not logged, indexed, or retained. We do not maintain any copy of your shortcuts or their output. (Demo/reviewer accounts use fictional sample shortcuts stored server-side instead.)
• OAuth tokens: standard access/refresh tokens so your assistant can act on your behalf. Refresh tokens rotate on every use.

What we do NOT do

• No selling or sharing of personal data with third parties for their own purposes.
• No advertising, tracking, surveillance, or behavioral profiling.
• No storage of your shortcut data at rest, and no reading of other apps on your Mac — ShortcutsBridge does not read your Reminders, Notes, Mail, Messages, Contacts, or files, and it does not see a shortcut's internal steps, only its name and its output when you run it.
• No collection of payment card data, health records, or government identifiers.

Data recipients (subprocessors)

Infrastructure only: Vercel (application hosting), Supabase (transient job queue & account records, Postgres), and Resend (sends the one-time email-address verification message — receives only your email address, never shortcut data). Your assistant provider (e.g., OpenAI) processes the content you exchange with it under its own privacy policy.

Retention

Shortcut data in transit: ≤ 90 seconds (automatic expiry). Account records and pairing tokens: until you delete your account. OAuth refresh tokens: 90 days or until revoked/rotated.

Your rights & deletion

Email us to access or delete your account data at any time. Unpairing your Mac (deleting ~/.shortcuts-agent.json and stopping the agent) immediately severs all access to your shortcuts, regardless of any tokens outstanding.

Security

All traffic is TLS-encrypted. Authentication uses HMAC-signed tokens with PKCE-protected OAuth flows. Running a shortcut requires explicit confirmation in your assistant before it executes. Because a shortcut is automation you authored, running it can take real-world actions the shortcut is built to do — for example sending a message, controlling HomeKit devices, or calling a web service. ChatGPT confirms with you first, it can only run shortcuts you already created, and the first time a given shortcut runs macOS may ask you to approve it once.

Contact

Questions or requests: isaiahdupree33@gmail.com · Support