Privacy Policy

1. What this covers

This document describes what ShipShape collects when you scan a website, what we do with it, and how to get rid of it. It covers this website and the scanning service behind it.

It does not cover the websites you scan. When ShipShape fetches a page, that page's own operator sees an ordinary HTTP request and may log it under their own policy.

2. What we store

On our side, in a Supabase-hosted Postgres database:

• The URL you asked us to scan, and the report we produced from it: an overall score, per-category scores, the list of issues found, the scan log, and any error message.
• If you have an account: the email address you signed in with. We use magic links, so we never receive or store a password.
• If you have an account: your workspace name and plan, and for each project you create, its name, its URL, your monitoring preference, and a Slack webhook URL if you supply one.
• A per-report share token, generated automatically so a report can be given a link that does not require signing in.
• An email address, if you join a waitlist for a feature that is not built yet. No part of the product currently writes to this table.

3. Reports can be public

This is the part most worth reading carefully. A scan run without an account is readable by anyone who has its report link. The link contains a long random identifier and is not listed or indexed anywhere, but it is not protected by a password and we do not check who is opening it. That is deliberate — being able to send someone a report without making them sign up is the point of the free scan — but it means you should treat a report link as semi-public.

A report for a scan attached to a project in your workspace is private to your account, unless you generate a share link for it. If you do, the same reasoning applies to that link.

A report contains the URL you scanned and what we found wrong with it. Do not scan a URL you would not want the recipient of the link to see.

4. Analytics

We record page views using Cloudflare Workers Analytics Engine. For each view we store the page path, the referring site's hostname, the interface language, and whether the device is mobile or desktop.

We do not store your IP address, we do not set an analytics cookie, and we do not attach your account to the record. Identifiers are stripped from the path before it is written, so we record that a report was viewed, never which report.

This data is aggregate and cannot be traced back to an individual, which also means we cannot delete your entries from it on request — there is nothing there that identifies you to delete.

5. What stays on your device

If you sign in, your session is kept in your browser's local storage so you stay signed in. Signing out removes it.

Your language choice is kept in a cookie named shipshape_lang, so the page renders in the right language on the server and does not flash the wrong one. It contains a language code and nothing else.

We do not use advertising or tracking cookies.

6. Who else sees this data

We do not sell your data and we do not share it for advertising. Data reaches the following providers because the product cannot function otherwise:

• Supabase — hosts the database and the authentication system, and sends the magic-link emails.
• Cloudflare — hosts and serves the site, and receives the analytics described above.
• Cloudflare's public DNS resolver — before fetching a URL, we resolve its hostname over DNS-over-HTTPS in order to check that it does not point at a private or internal address. The hostname of every URL you scan is sent to this resolver.
• Google PageSpeed Insights — when the operator has configured it, the URL you scan is sent to Google to obtain performance measurements.
• Anthropic — only if you explicitly request an AI-suggested fix for an issue, and only when the operator has configured it. The issue and the relevant details of your report are sent to generate the suggestion.

7. Deleting your data

You can delete your account from the account page. Deletion is immediate and permanent: your account, workspaces, projects and their scans are removed by database cascade, and your sign-in identity is destroyed. There is no recovery and no grace period.

Two honest limits. First, a scan you ran anonymously before creating an account may not be linked to your account, in which case account deletion does not remove it. Second, the aggregate analytics described in section 4 are not affected, because they contain nothing that identifies you.

If you joined a waitlist, write to us and we will remove the address. An automatic mechanism for this is designed but not yet built.

8. How long we keep things

We currently keep scans and reports until you delete them or delete your account. We have not yet set a maximum retention period, and we would rather say so than state a number we do not enforce. Setting one is an open decision, and this section will be updated when it is made.

9. Your rights

Depending on where you live, you may have the right to access, correct, export or erase your personal data, and to object to how it is processed. Signing in gives you direct access to everything we hold about you, and the account page gives you erasure. For anything else, write to us at the address below.

10. Current status of the service

ShipShape is pre-release and under active development. It has not undergone an independent security review. We say this because it is relevant to your decision: do not put data into it that you could not afford to have exposed.

11. Changes

When we change how data is handled, we change this document in the same release. The date at the top reflects the last such change.