Privacy Policy

ShipX collects as little personal data as it can while still running a fair launch platform. This page explains what we collect, why, who processes it, and how long we keep it.

What we collect

• From X when you sign in with X: your X user ID, username, display name, profile image, bio, verified status, account creation date, and follower count. We use the follower count only to determine eligibility, and keep a history of eligibility checks (date, follower count, result) so decisions can be reviewed.
• From Google when you sign in with Google: your Google account ID, email address, name and profile picture. We use them to sign you in, to find your account by its confirmed email address, and to show your name and picture on your profile. We ask Google for nothing else.
• Email sign-in links: when you ask for one, your email address and a hashed one-time token that expires after 15 minutes. Signing in with a link (or with Google) confirms that address on your account.
• OAuth tokens: stored encrypted (AES-256-GCM) and used only to re-verify your follower count. We request read-only access, never post on your behalf, and can’t read your DMs. Stored tokens are cleared and revocation is requested when you deactivate your account.
• What you add: profile details, products, logos and screenshots, comments, supports, bookmarks, follows and reports. Uploaded images are re-encoded, which strips embedded metadata such as location.
• Product analytics: page views and outbound clicks for listings, so makers can see how their launch is doing. Signed-out visitors are counted with a salted hash of IP address and browser that changes every day, so their visits can’t be linked across days.
• Member activity (when you’re signed in): the product pages you open, the product websites you visit from ShipX, and when you come back after a break are recorded against an ID derived from your account, not your name or X handle. With what you do on ShipX (launches, supports, comments, follows and saves), we use this only in aggregate, to measure whether ShipX is useful over time, for example how many members come back and do something again. No one looks at it for an individual member. It’s deleted with other analytics after about 13 months, and anonymised if you delete your account. Do Not Track or Global Privacy Control stops the recording.
• Site analytics: pages visited, referrer, country, device and browser type, page speed and errors, through Vercel Web Analytics and Speed Insights (cookie-free; query strings are removed first), DataFast (cookie-free; a random session ID kept in session storage until you close the tab) and Databuddy (a random visitor ID kept in local storage, plus clicks on buttons and links, links you follow off the site, and JavaScript errors). None of these identify you by name, and we don’t combine them with your account.
• Google Analytics (optional): only if you choose “Allow analytics” in the banner on public pages. It then sets Google’s cookies and measures visits to public pages; ad features and Google signals stay off. Before you choose, Google’s tag script may load, but it stores nothing and sends no measurements. Change your choice at any time on the cookie policy page.
• Email (optional): if you add an address in settings, we use it only after you confirm it, only for notifications about your own account (launch updates, comments and replies, upvote alerts, new followers, payments and sponsorships) and for the weekly newsletter with your monthly maker report, and never for third-party marketing. Every category is on by default, as set out in the terms. Your address is never shown publicly. Switch off any category, remove the address, or use the unsubscribe link in any email.
• Newsletter without an account (optional): if you subscribe at /newsletter, we keep your address, when you confirmed it and, if you unsubscribe, the reason you picked. We use it only to send The ShipX Weekly, and every issue has a one-click unsubscribe link.
• Sign-in details: the browser and device type of each signed-in browser and connected extension, and when it was last used, so you can see them and sign them out. For sign-in alert emails we also remember the device type and country of the last alert, worked out from your IP address, which we don’t store.
• Payments: handled by Dodo Payments. We store the amount, status and Dodo Payments reference, never card details.

ShipX doesn’t store IP addresses in its database. Abuse limits use a keyed hash of your IP that expires within an hour. Our hosting provider processes IP addresses to deliver the site and protect it from abuse. We honour Do Not Track and Global Privacy Control: when your browser sends either signal, none of the analytics above load, and Google Analytics never does.

What’s public

Your username (your X username, or a ShipX handle if you signed in with Google or email), name, avatar, profile fields, launched products, comments and supports are public. Your exact follower count is private unless you turn on “show my follower count”; otherwise listings say “ShipX verified maker”.

Cookies

Our own cookies are essential ones: a session cookie, a signed-in flag, and a short-lived state cookie during X or Google sign-in. Google Analytics adds its cookies only if you allow it. Databuddy keeps a visitor ID in local storage, and small conveniences like your light/dark preference live there too. The badges in the footer load from the sites that issued them, and Product Hunt’s may set a short-lived Cloudflare bot-protection cookie on producthunt.com. There are no advertising or cross-site tracking cookies. Every cookie and stored value is listed in the cookie policy.

How long we keep data

• Account data: while your account is open, and for 30 days after you delete it (see below).
• Sign-in sessions: 30 days, renewed while you’re active.
• Analytics events: about 13 months, then deleted automatically.
• Rate-limit counters: under an hour.
• When you choose Delete account, we hide your profile, products, comments, reviews, supports, follows and notifications at once, sign you out everywhere, clear stored X credentials and request token revocation. 30 days later your account and everything in it, including uploads and eligibility history, are permanently deleted. Payment records are kept, without your account, for as long as tax and accounting law requires.

Who processes data for us

• Vercel: hosting, content delivery, and site analytics (Web Analytics and Speed Insights).
• DataFast and Databuddy: site analytics, as described above. DataFast also counts visits from AI assistants and search crawlers.
• Google: Google Analytics, only if you allow it, and sign-in with Google, only if you use it.
• MongoDB Atlas: our database, hosted in Mumbai, India.
• Upstash: rate limiting and de-duplicating page views (hashed identifiers only).
• Cloudinary: storing and serving the logos and screenshots you upload.
• X: sign-in and follower verification.
• Dodo Payments: payments, when paid features are available.
• Resend: delivers notification emails, only to addresses you have confirmed.
• DeepSeek: optional AI help with listings, and the feature post written for Premium launches. Only your product’s public website content, your listing text and, for the feature post, your public name and bio are sent. DeepSeek processes data in China.
• Ahrefs, Google PageSpeed Insights and Google search suggestions, domain registries (RDAP) and Cloudflare DNS: the free SEO tools send them the website, domain or keyword you enter, and nothing else.
• Product Hunt, TrustMRR, NoonLaunch, CodeHype, Nick Launches and Findly.tools: the “featured on” badges in the footer are images loaded from their sites, which see your IP address and browser as with any image.

These providers may process data outside your country, including in the United States and, for DeepSeek, China.

Browser extension

The ShipX extension for Chrome, Edge, Brave, Opera and other Chromium browsers is optional. It talks only to shipx.live.

• Kept on your device: a copy of the launches you last loaded (so it opens instantly and works offline), your settings, and, if you sign in, a sign-in token. Removing the extension deletes all of it.
• Sent to ShipX: requests for launches, product pages and search results, and, when you’re signed in, your upvotes, saves, follows, comments and reports, exactly as on the website. The token identifies your account; we store only a hash of it. It also sends anonymous counts of the product pages you open and the sponsored slots it shows, without your account or cookies, counted like the website’s product analytics above.
• Not collected: your browsing. To tell you that a site you’re on launched on ShipX, the extension downloads the public list of launched websites and compares the open tab with it on your device. The address of the page you’re on is never sent. It requests no access to other websites.
• Removing it: the browser then opens a ShipX page with one optional question. Its address carries the extension’s version and the day it was installed. If you answer, we keep your answer with those two details, your browser’s name, and your account if you’re signed in to shipx.live.
• Disconnecting: sign out in the extension, or disconnect any browser in Settings → Connected browsers. Tokens also expire after 90 days without use, and signing out of all devices or deleting your account revokes them.

Your choices

• Edit your profile, or show or hide your follower count, at any time in Settings.
• Delete your account from Settings → Danger zone. It’s hidden at once and permanently deleted after 30 days. To have it erased sooner, email suhail@shipx.live.
• Change your Google Analytics choice on the cookie policy page, or turn on Do Not Track or Global Privacy Control in your browser to switch off all analytics.
• For access, correction or export requests, email suhail@shipx.live.

Children

ShipX isn’t meant for children. You must be 18 or older to have an account, and you confirm this when you first sign in. If we learn that an account belongs to someone younger, we delete it.

Changes

If we change this policy we’ll update the date above, and announce material changes on the site.