Privacy

Who we are

Shippable (shippable.dev, the shippable-dev CLI and its MCP server) is run by Shippable, a company of Rodolfo Egarter in Brazil, which is responsible for the data described here. Questions or requests: hello@shippable.dev.

Scans on the website

• The app you scan. We read your app the way a visitor would, only after you prove you own it. When we prove a database table is open, we read at most a few rows as evidence and show them to you. The cookie-consent check also loads your app once in a real browser from Frankfurt, and keeps nothing from that visit except the findings.
• Reports. If you aren't signed in, the report stays in your browser (the last scan of each app is kept there to show what changed). If you are signed in, we save your apps and their reports so you can see your history and re-scan.
• Fair use. For each scan we record the app's host name, the time, your account if signed in, and a salted, one-way hash of your IP address (never the IP itself), to enforce the daily scan limit.
• Library checks. Library names and versions found in your app are checked against the public OSV vulnerability database (run by Google).

The CLI and the MCP server

• They run on your machine. Your code, URLs and findings are never sent to us.
• Package names and versions from your lockfile go to the public OSV vulnerability database.
• Each scan sends us an anonymous usage count: the version, which command ran, local or live, how many findings per severity, whether it ran in CI, and a random install id. We count these in our database and in PostHog. Turn it off with SHIPPABLE_TELEMETRY=0.
• The report link the CLI opens keeps your findings after the #, which your browser never sends to our server.

Accounts, email and other things you send us

• Sign-in. Your email address, to send sign-in links and, if you turn it on, watch-mode alerts about your apps.
• Waitlist. Your email and a hashed IP (to stop spam), to tell you once when paid features open.
• "This looks wrong?" feedback. Which finding, your reason and any note you write, with a hashed IP.

Analytics and cookies

We count page views and steps like "scan started" with PostHog, without cookies or storage in your browser, with session recording and autocapture off, and with web addresses stripped of anything after ? or #. We don't run ads or ad trackers. Billing steps (checkout started, payment completed, subscription changed) are counted from our server with your account id and the amount, never your email or card details. The only cookies we set are functional: your sign-in session, and one that ties your ownership tag to your browser.

Who processes data for us

• Vercel (hosting), Neon (database), Resend (email), PostHog (analytics), OSV by Google (vulnerability data).
• Stripe (payments), for extra apps.
• Some of them store data outside Brazil, mainly in the United States.

We never sell or rent your data, and we never use scan results to train AI models.

Why we're allowed to use it

• To provide the service you asked for (contract): sign-in, scans, saved reports, watch alerts and payments.
• Legitimate interest: fair-use limits and spam protection (hashed IPs), cookieless analytics and anonymous CLI usage counts to improve Shippable, and keeping Shippable secure.
• Consent: the waitlist. You can unsubscribe or ask us to remove you at any time.
• Legal obligation: payment and tax records, once paid features open.

How long we keep it, and your rights

We keep data only as long as it's useful, then delete it automatically: saved scans and "this looks wrong?" feedback after 12 months, anonymous CLI usage pings after 12 months, scan-rate records (hashed IPs) after 90 days, and waitlist emails after 24 months. Expired sign-in links are removed daily. You can delete your account yourself from the bottom of My apps, which removes your sign-in, saved apps and scans straight away. You can also ask us to see, correct or export your data, or delete it, by emailing hello@shippable.dev. We'll answer within 15 days. If you're in Brazil, you can also contact the ANPD (Autoridade Nacional de Proteção de Dados).

If this policy changes in a way that matters, we'll update the date above and, for big changes, tell signed-in users by email. See also the Terms.