Raw personal data never leaves your device. This is the load-bearing constraint, not a marketing line.
The community version — hosted at shenas.ai/oss — is the open-source version: the plugin SDK, the architecture, the code, the way you extend or replace any piece. The local pipeline, the on-device models and the privacy primitives stay in the community version, forever.
shenas is open-core. What is sold is the operation of a service: either it needs a party who is not you, or it is a convenience over something the community version already does for free.
Nothing on this list is for sale yet.
Needs someone other than you: the namespace and identity operator; a name has to be issued and kept unique by whoever runs the namespace
If you leave: the community version runs with no account; keys and data are untouched; the name lapses
Needs someone other than you: two devices behind NATs cannot both be the relay between them
If you leave: direct paths keep working; anyone can run the same upstream relay
Needs someone other than you: someone holds ciphertext for a peer that is offline
If you leave: live and relayed delivery continue; only store-and-forward for offline peers stops
Needs someone other than you: the holder of the app's push credential at the platforms; a push sender is the app's publisher, not its user
If you leave: the app fetches when opened
Needs someone other than you: a witness holding a recovery shard; a user who has lost every device cannot be their own witness
If you leave: the user's own copy of their key material, kept where they choose
Needs someone other than you: custody that outlives the user; someone holds the instruction and acts when the user no longer can
If you leave: the user hands the key to a person themselves
Needs someone other than you: a vouch is someone else's statement; the company reviews and signs as one signer among those the user trusts
If you leave: the trust store and every plugin stay; only the company's signature stops being renewed
Needs someone other than you: the account holder at the model provider is the company, so the provider sees the company's account, not the user's, though prompt content can still identify the person; later, the anonymity set of the other users
If you leave: the community version calls a provider with the user's own key, or a local model
Needs someone other than you: storage the user's own devices do not provide, holding ciphertext the operator cannot read
If you leave: export to a place the user holds and replication across their own devices; the company's copy is never the only copy
Already free: the same worker runs on the user's own always-on machine
If you leave: the user runs the worker themselves; a hosted worker holds only a cache and its configuration
The distinction matters: a feature that requires sending raw data to a server cannot ship in the community version, regardless of how useful it would be. The on-device constraint is enforced at the architecture level, not by policy.
~/.shenas/shenas.db. Source plugins write directly to this database. No relay, no cloud storage.