Privacy Policy
Last updated: October 19, 2026
This policy explains what information ShipGuard (getshipguard.com) (“ShipGuard”, “we”, “us”) collects, why we collect it and what we do with it. We try to collect as little as possible.
What we collect
- URLs you submit. The website address you ask us to scan, normalized to its domain name.
- Scan results. The report for that domain: grade, findings, where each finding was observed (page or file URLs without query strings), response headers we checked, and which technologies we detected. If we find something that looks like a secret (such as an API key), we keep only its first 6 characters; the full value is never stored.
- Your email address, if you give it to us — for example when you join a checkout waitlist, buy a plan, or apply to be a remediation partner (with your company name, website and description).
- Payment information. Card and payment details are entered on Stripe's checkout pages and handled by Stripe. We never see or store your full card number. We receive limited details from Stripe, such as your email, the plan, the domain and payment status.
- IP address, briefly. We use your IP address to apply rate limits (for example, a maximum number of scans per hour). These counters expire automatically after about an hour.
- Server logs. Our hosting provider keeps standard request logs (such as IP address, time and requested page) for security and debugging.
We don't use advertising trackers or third-party analytics cookies, and we don't sell personal information.
How we use it
- to run scans and show reports;
- to deliver what you bought (for example, emailing your private full-report link) and to manage subscriptions;
- to tell you when checkout opens, if you joined the waitlist;
- to prevent abuse and keep the service secure;
- to meet legal and accounting obligations.
We may also email a security scorecard to a publicly listed contact address of a website we have scanned. Every such email is reviewed by a person before it is sent, and if you reply that you don't want to hear from us, we add your domain to a do-not-contact list.
Who processes data for us
- Stripe — payment processing.
- Upstash — database (Redis) that stores reports, waitlist entries and rate-limit counters.
- Vercel — website hosting and request logs.
- Resend — sending transactional email (such as receipts and report links).
These providers process data on our behalf under their own terms and privacy policies, and may store it in the United States or other countries.
How long we keep it
- Scan reports: until the domain is rescanned (the new report replaces the old one) or until the site owner asks us to delete it.
- Waitlist emails: until checkout opens and we've notified you, or until you ask us to remove you.
- Customer and partner records: while your purchase or subscription is active and afterwards as long as needed for tax, accounting and legal reasons.
- Rate-limit counters: about one hour.
- Hosting logs: according to our hosting provider's standard retention.
Your choices and rights
You can ask us to access, correct or delete your personal information, to remove a scan report for a site you own, or to stop contacting you. Email hello@getshipguard.com and we'll respond as required by the law that applies to you. We may need to verify that you own the email address or domain.
Security
We use access controls, encrypted connections and minimal data collection. No system is perfectly secure, but we never store full secrets detected during scans.
Children
ShipGuard is a tool for developers and businesses and is not directed at children under 16.
Changes
If we change this policy, we'll update the date above. Material changes will also be noted on this page.
Contact
ShipGuard (getshipguard.com)
67 Forest St
Marlborough, MA 01752
United States
Legal & support email: hello@getshipguard.com
See also our Terms of Service.