PreShipDRAFT - requires attorney review. Not in effect.
Privacy Policy
Last updated: [DATE] · [OWNER LLC NAME]
We keep nothing readable (reports self-destruct)
PreShip is designed for ephemeral, no-storage delivery. Launch Review and Guard reports (HTML, PDF, and fix patch) are encrypted at rest with a per-report key, delivered by download link and/or email, and automatically deleted after 24 hours (configurable). After expiry we cannot recover findings. A scheduled worker purges expired ciphertext and keys.
What we collect and keep
- Account: email and password hash (or magic-link tokens), and session records.
- Orders / payments: plan, amounts, status, and Stripe references, retained as legally required for billing and tax. We never receive your full card details.
- Cached Basic Scan result (30 days): for each scanned domain, the grade, issue counts by severity, general issue areas, and whether active checks were included. We use it to enforce one Basic Scan per domain every 30 days and delete it after 30 days. It contains no specific findings, file names, keys or table names.
- Ownership verification: the domain and the time it was last verified.
- Grade-only badge / trust record: grade, scan date, and domain, never findings, evidence, or secrets.
- Guard (opt-in only): envelope-encrypted connection tokens (key from environment), revocable from your dashboard; weekly history stored only as severity counts and issue categories, not finding detail.
- Audit log (90 days): security-relevant actions (sign-ins, purchases, scans requested, denied targets, report and patch downloads, admin actions) with the time, the account or target involved, and the IP address of the request. We use it to prevent abuse and investigate incidents, and delete entries after 90 days.
- Rate-limit events (7 days): the IP address or account identifier and time of scan and checkout requests, deleted after 7 days.
- Server and email logs: our hosting and email providers keep standard request and delivery logs under their own retention policies. Our application logs are redacted of tokens and findings.
What we do not store
- Secrets, API keys, JWTs, or tokens found during a scan. They're redacted in reports and never persisted in plaintext.
- Rows from your database. When a table is readable, we record only that it's readable, never its contents.
- Cloned repositories, uploaded zips, fetched bundles, and DB metadata. These are held only in a temporary directory and in memory, and wiped after each job (including on failure).
- Full findings after the report TTL. Ciphertext and keys are purged.
Cookies
We use a strictly necessary session cookie to keep you signed in. We don't use advertising or analytics cookies. [Attorney to confirm wording.]
How we use data
To deliver Scans and reports, bill, send service emails with time-limited download links, show public grade badges you choose to publish, run weekly re-checks for Guard, and prevent abuse. We do not sell or share personal data for advertising. No AI or LLM provider receives your data; report text is generated deterministically.
Processors
| Processor | Purpose | Data involved |
|---|---|---|
| Railway Corp. | Application hosting in the United States (US West): application, database, temporary scan workspace | All data described above, encrypted where stated |
| Cloudflare, Inc. | DNS, TLS, CDN and DDoS protection in front of our site | IP addresses, request metadata, and page traffic passing through its network |
| Stripe (Stripe, Inc. and affiliates, including Link) | Payments. Stripe is the merchant of record through Stripe Managed Payments and handles tax, receipts, refunds and disputes | Name, email, billing details, payment method, purchase details. Stripe also acts as an independent controller under its own privacy policy |
| Resend | Transactional email (sign-in links, receipts, report delivery, Guard alerts) | Email address, and email content including time-limited report download links |
Services you connect (GitHub, Supabase, Google/Firebase, Vercel) receive our API requests under your authorization; they're your providers, not our processors. Trust pages show grade, date and domain only.
Retention
Encrypted reports: 24 hours, then purged. Cached Basic Scan results: 30 days. Audit log (including IP addresses): 90 days. Rate-limit events: 7 days. Expired sessions and sign-in links: deleted on expiry. Account and payment records: as required by law. Badge/trust: grade/date/domain until you remove the site or ask us to delete. Guard tokens: until you revoke them or cancel Guard.
Your rights
Access, correction, deletion and export on request to hello@preshipsecurity.com. [CCPA/GDPR sections, international transfers (Railway hosting in the US, US processors): attorney to confirm applicability.]
Security
TLS in transit; AES-GCM per-report encryption at rest; envelope encryption for Guard tokens; strict security headers; access limited to operators. No method is 100% secure.