Privacy Policy

Last updated: June 2026

Short version: We collect the minimum data needed to operate the service. We don't sell your data. We don't use it to train AI. You can request deletion at any time.

Who we are

ShipLock is operated as an independent product. Our contact email is support@shiplock.app.

What we collect and why

Account information — When you sign up, we collect your email address and the password you set (stored as a secure hash via Supabase Auth). We use this to authenticate you and contact you about your account.

App content — The HTML files you deploy and the JSON data stored via the ShipLock data API are stored on your behalf in Amazon S3. You own this content.

Usage data — We log page view counts per app (no IP addresses, no fingerprinting). This is used to show you view counts on your dashboard. We do not sell or share this data.

Session tokens — We store opaque session tokens in DynamoDB (30-day expiry) to keep you logged in. These are deleted when you log out or your session expires.

Invite emails — If you invite someone to a group-access app, we store their email address and send a one-time magic link. This record is deleted once they open the link (or after 7 days if unused).

What we don't collect

We do not track you across the web.
We do not use third-party analytics (no Google Analytics, no Meta Pixel).
We do not sell or share your personal data with advertisers.
We do not use your content or data to train AI models.
We do not store credit card numbers — payments are processed by Stripe, who have their own privacy policy.

Cookies and local storage

We use an sl_session HttpOnly cookie to keep you authenticated. Your browser's localStorage stores your session token and basic profile info (email, display name) for the dashboard UI. No tracking cookies are used.

Third-party services

ShipLock uses the following infrastructure providers:

Supabase — authentication (email + password)
Amazon Web Services — file storage (S3), database (DynamoDB), email (SES), compute (Lambda), CDN (CloudFront)
Stripe — payment processing (paid plans only)

Each provider has their own privacy policy and data processing agreements. We only share data with them to the extent necessary to operate the service.

Data retention

Active account data is retained while your account exists.
If you close your account, your data is deleted within 30 days.
Session tokens expire automatically after 30 days.
App view count logs are retained for 90 days.

Your rights

You can:

Update your email or display name from the account settings in the dashboard.
Delete your apps at any time from the dashboard.
Request a copy of your data or full account deletion by emailing support@shiplock.app.

If you are in the EU or UK, you have additional rights under GDPR/UK GDPR, including the right to object to processing and the right to lodge a complaint with your local supervisory authority.

Children

ShipLock is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us and we will delete it.

Changes to this policy

We may update this policy. We will notify you by email if we make material changes. The date at the top of this page always shows when it was last updated.

Contact

Privacy questions or requests: support@shiplock.app

ShipLock — Ship, lock & share micro apps with storage.