Privacy Policy

Shipproof is an automated security audit service. [PLACEHOLDER: the operating legal entity and address will be listed here once incorporated.]

• Account data: email, sign-in method (email or GitHub), password hash (if you register by email), GitHub identifier (if you sign in via GitHub).
• Project data: source type (GitHub repository or ZIP archive), repository link or uploaded filename, project name. Your actual code is not part of this category — see section 3.
• Scan data: score, findings (category, severity, title, description, masked evidence — file, line, snippet with no real secret values), executive summary.
• Subscription data: plan tier, subscription status, Paddle customer/subscription identifiers. Actual payment details (card number, etc.) are handled by Paddle — we never receive or store them.
• Technical data: IP address (for abuse prevention and rate limiting), server logs, usage metrics (scan count, source size, LLM token counts) — never code content.

When you connect a repository or upload an archive, the code is cloned or extracted into an isolated, one-time (ephemeral) container: with no network access at all for a ZIP archive, or with access limited to github.com when cloning a repository.

The code is analyzed statically — as text and file structure. We never execute your code.

Secrets (API keys, passwords, and similar) found in the code are masked before anything leaves the isolated container. Neither the masked nor, obviously, the real secret values are ever sent to external LLM services or shown unmasked in the report.

Once a scan finishes, the source code, the repository clone, and any uploaded archive are deleted immediately. We do not retain your source code after a scan completes — in any form, for any length of time. If you upload an archive and never run a scan, it's automatically deleted after a technical timeout (currently 24 hours).

The database and the report only ever store the finding metadata listed in section 2 — never the code itself.

Account and project data is processed to provide you the service (performance of a contract). Technical and log data is processed for security and abuse prevention (legitimate interest).

Where we use an LLM to explain findings, we rely on a legitimate interest in providing clear, actionable guidance; only the finding's own text fields (category, severity, title, description) are sent to the model — never evidence, secrets, or your source code.

• Paddle.com Market Limited — payment and subscription processing, acting as merchant of record.
• Anthropic — finding explanations and the executive summary via the Claude API; receives only a finding's own text, never code or secrets.
• Our hosting provider — hosts the service's infrastructure. [PLACEHOLDER: name the provider and data center region.]

We do not sell your data to third parties.

Account data and finding metadata are kept for as long as your account exists.

Source code is never retained at all — see section 3.

Technical logs containing IP addresses are kept for a limited period for security purposes. [PLACEHOLDER: confirm the exact log retention period.]

• access to your personal data;
• correction of inaccurate data;
• erasure of your data ("right to be forgotten");
• restriction of processing;
• data portability;
• objection to processing based on legitimate interest;
• the right to lodge a complaint with the data protection authority in your country.

Honestly, about where we are today: self-serve account deletion through the interface isn't built yet — it's in progress. To request deletion of your data right now, email us at the contact address below and we'll handle it manually.

If you're located in the EU/EEA, your data may be processed outside the EEA by the sub-processors listed in section 5. [PLACEHOLDER: confirm and name the specific safeguards in place for each sub-processor — e.g. Standard Contractual Clauses.]

• each scan is isolated in a one-time ephemeral container with no network access, or with tightly restricted access;
• secrets are masked before they ever leave the isolated environment;
• all traffic to the service is encrypted (HTTPS);
• access is scoped per user — you only ever see your own projects and findings.

The service is not directed at anyone under 16. We do not knowingly collect data from children.

We'll notify you ahead of any material change to this policy — by email or an in-app notice.

Questions about data processing: [PLACEHOLDER: contact email / data protection contact].