Privacy
What we store, what we never see, and how to get rid of it.
LAST UPDATED 17 August 2026
The short version
- Your source code never leaves your machine. Verification runs locally through the CLI.
- We store what a run was — check names, pass/fail, timings, file paths, counts — not what your files contain.
- We never see your card. It goes directly to PayPal.
- No advertising, no tracking pixels, no analytics scripts, no data sold to anyone.
What we store
| Account | Your name, email address, and a salted PBKDF2 hash of your password. The password itself is never stored. |
| Organization | Name, slug, members and their roles. |
| Projects | Project name, slug, and optionally the repository remote URL you provide. |
| Runs | Verdict, per-check status and duration, the commands that ran, test counts, changed file paths, and the reasons behind a verdict. |
| Machines | A label (usually your hostname), OS string and CLI version for each machine connected with `shipsure login`. |
| Billing | Plan, cycle, status, period dates, and your card’s brand, last four digits and expiry month. Plus a PayPal vault token, which is an identifier — not card data. |
| Sessions | A SHA-256 hash of your session token, its expiry, and the IP address it was issued to. |
| Invitations | The email address invited, the role offered, who sent it, and a SHA-256 hash of the invitation token. Kept until the invitation is accepted, revoked or expires, then swept. |
| Password resets | A SHA-256 hash of the reset token, its expiry, and the IP that requested it. Single-use, one hour, then swept. The reset link itself is never stored. |
What we never receive
- File contents. Diff bodies are not uploaded. Paths and statistics are, because the dashboard has to be able to tell you which files changed.
- Full card numbers, expiry or CVV. These are typed into PayPal-hosted iframes on our page. They never touch ShipSure’s servers or even our own JavaScript, which is what keeps a custom-styled card form out of PCI scope.
- Secrets in your output. Redaction runs on the CLI before anything is hashed or uploaded, so an API key printed by a failing test is removed on your machine rather than on ours.
- Your keystrokes, screen or agent conversations. ShipSure watches a folder and runs your project’s own commands. It does not hook into your editor or your AI tool.
Who else processes it
These are the only third parties involved, and each one is load-bearing:
| Cloudflare | Hosts the application, database (D1), cache (KV) and evidence storage (R2). Also terminates TLS, so it necessarily sees request metadata. |
| PayPal | Processes payments and stores your card. We hold a reusable token, not the card. |
| Cloudflare Email Service | Delivers the two transactional emails ShipSure sends — a password reset link, and a team invitation. There is no mailing list and no marketing email. |
There is no analytics provider, no session recorder, no error-tracking SaaS and no email marketing platform in the request path.
Cookies
One cookie: your session. It is HttpOnly, Secure, carries the __Host- prefix, and holds a random token — no personal data is encoded in it. It exists so you stay signed in, and it is deleted when you sign out.
Your theme choice and whether the dashboard sidebar is collapsed are kept in localStorage on your own device. They are never sent to us.
There are no tracking or advertising cookies, so there is no consent banner to dismiss.
How long we keep it
- Run history and evidence follow your plan’s retention window: 7 days on Starter, 90 days on Pro, 365 days on Scale.
- Account and billing records are kept while your account is open. Charge records are retained afterwards where tax and accounting rules require it.
- Sessions expire after 30 days. Device codes expire after 15 minutes and are swept hourly.
- Cancelling deletes your stored card. Keeping a reusable payment token for an account we will never bill again is exactly the kind of data not to retain.
Your rights
Email privacy@shipsure.space to get a copy of your data, correct it, or have it deleted. We will action deletion within 30 days, and it removes your account, organizations, projects, runs and stored card.
If you are in the UK or EU, the lawful basis is contract — we process this data because it is what running the service requires. There is no legitimate-interest profiling to opt out of, because there is no profiling.
Security
- Passwords are hashed with PBKDF2-SHA256 at 600,000 iterations, salted per user.
- Session and API tokens are stored only as SHA-256 hashes — a database leak does not hand over live credentials.
- Agent tokens are short-lived and rotate on refresh; reusing a retired one fails and signals a copied credentials file.
- Every request is TLS-only, with HSTS and a Content-Security-Policy.
- Tenant isolation is enforced in the database query itself rather than checked afterwards, so it cannot be forgotten by a later change.
If you find a vulnerability, email security@shipsure.space. We will not pursue anyone who reports one in good faith and gives us a reasonable window to fix it.
Changes
Material changes to this page will be announced in the changelog rather than quietly edited in.