Privacy Policy

ShipX collects as little personal data as it can while still running a fair launch platform. This page explains what we collect, why, who processes it, and how long we keep it.

What we collect

• From X when you sign in: your X user ID, username, display name, profile image, bio, verified status, account creation date, and follower count. We use the follower count only to determine eligibility, and keep a history of eligibility checks (date, follower count, result) so decisions can be reviewed.
• OAuth tokens: stored encrypted (AES-256-GCM) and used only to re-verify your follower count. We request read-only access, never post on your behalf, and can’t read your DMs. Tokens are revoked when you delete your account.
• What you add: profile details, products, logos and screenshots, comments, supports, bookmarks, follows and reports. Uploaded images are re-encoded, which strips embedded metadata such as location.
• Product analytics: page views and outbound clicks for listings, so makers can see how their launch is doing. Unique visitors are counted with a salted hash of IP address and browser that changes every day, so visits can’t be linked across days.
• Site analytics: cookieless, aggregate page views and page-speed measurements through Vercel Web Analytics and Speed Insights. Query strings are removed before anything is sent.
• Payments: handled by Stripe. We store the amount, status and Stripe reference, never card details.

ShipX doesn’t store IP addresses in its database. Abuse limits use a keyed hash of your IP that expires within an hour. Our hosting provider processes IP addresses to deliver the site and protect it from abuse. We honour Do Not Track and Global Privacy Control: when your browser sends either signal, no analytics are recorded for your visit.

What’s public

Your X username, name, avatar, profile fields, launched products, comments and supports are public. Your exact follower count is private unless you turn on “show my follower count”; otherwise listings say “ShipX verified maker”.

Cookies

We use only essential cookies: a session cookie, a signed-in flag, and a short-lived state cookie during X sign-in. Your light/dark preference is kept in your browser’s local storage. There are no advertising or cross-site tracking cookies. See the cookie policy.

How long we keep data

• Account, profile, products and contributions: until you delete them or your account.
• Sign-in sessions: 30 days, renewed while you’re active.
• Analytics events: about 13 months, then deleted automatically.
• Rate-limit counters: under an hour.
• When you delete your account we remove your profile, products, comments, supports, bookmarks, follows, notifications, eligibility history, uploaded images, and analytics for your products. Payment records are kept without a link to your account where we need them for accounting, and records of moderation decisions may be kept to prevent abuse. Deleted data can persist in our providers’ backups for a short period.

Who processes data for us

• Vercel: hosting, content delivery, and site analytics.
• MongoDB Atlas: our database, hosted in Mumbai, India.
• Upstash: rate limiting and de-duplicating page views (hashed identifiers only).
• Cloudinary: storing and serving the logos and screenshots you upload.
• X: sign-in and follower verification.
• Stripe: payments, when paid features are available.
• Anthropic, via Vercel AI Gateway: optional AI help with listings. Only your product’s public website content and the text you ask it to improve are sent.

These providers may process data outside your country, including in the United States.

Your choices

• Edit your profile, or show or hide your follower count, at any time in Settings.
• Delete your account from Settings → Danger zone. This permanently removes your data as described above and revokes X access.
• For access, correction or export requests, email privacy@shipx.live.

Children

ShipX isn’t meant for children. You must be old enough to use X in your country, and at least 13.

Changes

If we change this policy we’ll update the date above, and announce material changes on the site.