Privacy Policy
ShipStory is built for developers. We believe your code, commit history, and audience are yours alone. Here is precisely how we collect, handle, and secure your information.
Our Core Privacy Commitments
- •No Training on Your Code: We never use your private code or commit diffs to train public AI models.
- •AES-256 Vault: GitHub Personal Access Tokens and OAuth tokens are encrypted at rest with military-grade keys.
- •No Hidden Data Brokerage: We never sell, rent, or trade your contact info or repository telemetry.
- •1-Click Disconnect & Delete: Disconnecting a repository permanently removes cached candidates from your workspace.
1. Information We Collect
When you use ShipStory, we only collect data necessary to provide our Git-to-X draft studio:
- Account Information: Your email address, name, and profile avatar provided through GitHub OAuth or Google OAuth sign-in.
- GitHub Repository & Commit Evidence: When you connect a repository or paste a public commit URL, we retrieve bounded evidence (commit message, diff statistics, modified file tree, and commit timestamps) solely to craft story drafts.
- Connection Keys & Vault Secrets: Personal Access Tokens (PATs) or OAuth connection tokens are encrypted using AES-256-GCM before storage.
- Billing Records: Transactions are handled by our Merchant of Record, Dodo Payments. We receive payment statuses, customer emails, and subscription IDs. We do not store credit card numbers.
2. How We Use Your Information
Your data is processed strictly for the following operational purposes:
- Generating three distinct story angles (Founder, Customer Changelog, Technical Breakdown) based on your selected commits and context.
- Maintaining your live studio workbench, draft history, and character count counters.
- Managing your ShipStory Plus subscription plan and billing entitlements.
- Preventing malicious misuse, abuse of the AI Gateway, and unauthorized access attempts.
3. Third-Party Service Providers
To provide high reliability and strong security, ShipStory utilizes vetted infrastructure partners:
Processes commit diff evidence in real-time server functions. Code is bounded, transient, and never retained for foundation model training.
Hosts user authentication, session verification, and encrypted connection metadata with strict row-level security (RLS).
Manages PCI-DSS compliant checkout sessions, global tax remittance, and subscription lifecycles.
Posts are published via official browser-based Web Intent. ShipStory does not store your X account password or posting tokens.
4. Data Security & Storage Architecture
Security is foundational to ShipStory. We enforce multiple layers of defense:
- All network communications are encrypted in transit via TLS 1.3.
- Database records are protected by PostgreSQL Row Level Security (RLS) policies ensuring users cannot view other workspaces.
- API keys, webhook secrets, and user connection keys are securely injected via server-only environment variables.
5. Your Data Rights & Deletion
You retain complete control over your data. At any time, you may:
- Disconnect your GitHub profile or revoke authorized OAuth tokens via your GitHub Settings.
- Delete individual draft stories or connected repositories directly within the studio.
- Request complete account deletion and erasure of all associated database records by emailing support@shipstoryai.com.
6. Contact & Legal Requests
If you have questions about this Privacy Policy, your rights under GDPR or CCPA, or wish to submit a data request, please contact our team:
Entity: ShipStory Technologies