Privacy.

Account and sign-in

We store your name, email address and account identifiers to authenticate you, keep your projects together and provide support. Email passwords are stored as salted hashes. Verification and recovery links expire and can be used only once. Essential session cookies keep you signed in.

If you choose Google, we receive your basic profile, email address and unique Google account identifier. We use these to create or sign in to your Shipvela account, or connect Google when you request it in Settings. We do not store Google access or refresh tokens, read your Gmail or access your Drive. Google account information is not used for advertising or sold.

Repositories and hosted projects

If you connect GitHub, we use your authorized connection to list repositories, inspect project configuration and deploy repositories you select. We retain encrypted GitHub credentials needed for this connection. Project files, build settings, environment variables, domains and deployment records are processed to publish and operate your sites. Published website content is accessible at its public URL.

Assistant connections and publishing reviews

When you connect an assistant, Shipvela stores the client registration, approved permissions and expiring OAuth authorization needed for that connection. Approved tools return your owned project information, deployment status, allowance and, if permitted, bounded build logs to the connected client. That client processes the returned information under its own policies. Environment values are not returned by these tools. You can revoke access in Settings.

Small static websites prepared through an assistant are staged in encrypted storage until you confirm or cancel the publishing request. Unconfirmed drafts expire after one hour. A running worker clears staged file contents after submission, cancellation or expiry; interrupted requests are cleared during regular worker cleanup. Request identifiers, file manifests and deployment receipts remain for status checks and duplicate prevention. Published content is processed by the hosting provider and served publicly. Backups rotate with the normal retention schedule.

Service providers

Amazon Web Services provides application infrastructure, project hosting, backups and email delivery. Repository hosting may require sharing the authorized GitHub connection with AWS Amplify. Stripe processes checkout, subscription management and payment information; Shipvela stores billing identifiers and subscription status, not full payment card details. Google and GitHub process sign-in requests when you choose those providers.

Email preferences

We send essential verification and password recovery messages through Amazon SES. Setup tips and product updates require your opt-in. You can unsubscribe through a message or Settings. We retain consent, delivery, bounce, complaint and suppression records to honor your preferences and prevent unwanted delivery. Shipvela onboarding emails do not use open-tracking pixels or tracked click redirects.

Optional campaign measurement

On a tagged launch link, you can separately opt in to first-party campaign measurement. We remember the campaign, source and creative labels in a secure, host-only cookie for up to 30 minutes to carry your choice through signup. For a newly created account, we retain those labels and completed verification and successful publishing milestones for up to 90 days; unverified signup labels expire after seven days. You can register without opting in and withdraw in Settings. This choice is separate from setup emails.

These measurements stay in Shipvela. We do not use a Meta Pixel, send account information to Meta for conversion tracking, or retain Facebook click identifiers, IP addresses or browser fingerprints for this measurement. Google account identifiers and emails are not advertising measurement fields. Expired campaign records are removed during regular preference and reporting operations; backup copies rotate with our normal backup schedule.

Social messages

If you contact our social profiles, an automated assistant may answer questions about Shipvela. We process the incoming message to choose an answer and retain account identifiers, event identifiers, timing and response status for delivery and duplicate prevention. We do not retain the raw incoming message text in our reply system. Completed response records rotate after 30 days. Send STOP to pause automated replies and START in a direct message to resume; opt-out records remain so that your preference is honored. Meta separately processes messages on Facebook and Instagram under its own policies.

Retention and requests

Account and project information is retained while needed to operate the service, provide support and maintain security. Expired authentication records are removed during regular account operations. Backups rotate according to the service retention schedule; billing or security records may need to remain after an account is closed.

To request access, correction or deletion of your account information, contact hello@shipvela.com. We may ask you to verify ownership before processing a request. You can also revoke Shipvela access from your Google or GitHub account settings.