Privacy Policy
Last updated: 2026-09-25
1. Who we are (data controller)
Ship & Shout, operated by Monryte SRL (“Ship & Shout,” “we,” “us”), is the data controller for the personal data described in this policy. For any privacy question or to exercise your rights, contact our privacy team at privacy@shipandshout.com. General support is available at hello@shipandshout.com.
2. Data we collect
We collect only what we need to run the service:
Account data
- Your name, email address, and authentication identifiers. You sign in with GitHub, Google, Facebook, X, or email and password, through Supabase Auth.
- Your plan, delivery schedule, timezone, and theme preference.
Connected source data (read-only)
- Code hosts (GitHub, GitLab, Bitbucket): commit metadata and merged pull requests — counts, titles, timestamps, and authors. We never read your file contents or source code.
- Payment processors (Stripe, Lemon Squeezy): revenue totals and new / churned customer counts. We never move money and never see full card numbers.
- Product analytics (first-party): product events such as sign-in, draft generated, and post copied, recorded in our own database.
Web analytics (only if you consent): if you accept the “analytics” cookie category, we load Vercel Web Analytics and Speed Insights. Both are cookieless: they report aggregated page views, referrers, country, device type, and Core Web Vitals (page-load performance) — never anything tied to your identity. See our Cookie Policy for how to change your choice.
Content we generate
- The metric summaries behind each week, the drafts produced from them, and the revenue charts rendered as images.
The Weekly and the Monday Digest
- Follows: which makers you follow on The Weekly. Only you can see your list; makers see a follower count, never who.
- Digest subscription: if you subscribe to the Monday Digest (no account needed) we store your email address, when and where you gave consent, and whether you confirmed it (double opt-in). Emails are sent through Resend. Every digest has a one-click unsubscribe link; unsubscribing stops all digest email immediately. Legal basis: your consent, which you can withdraw at any time.
Technical data
- Essential session cookies, and standard server logs (IP address, timestamps) kept briefly for security and abuse prevention. See our Cookie Policy for details.
- Error monitoring: when something breaks, technical details (stack trace, URL path with query strings stripped, browser/ server context) are reported to Sentry, hosted in the EU (Frankfurt). These reports carry no personal data beyond your pseudonymous account id — no email, name, cookies, or draft content — and never include session replay or screen recording.
Access tokens for the sources you connect are encrypted at rest with AES-256-GCM, decrypted only server-side at the moment of use, never written to logs, and never sent to your browser.
3. Purposes & legal bases
Under the GDPR we rely on the following legal bases for each purpose:
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and operate your account | Account data | Contract (Art. 6(1)(b)) |
| Read connected sources to draft your weekly post | Connected source data | Contract (Art. 6(1)(b)) |
| Generate drafts and charts via LLM providers | Metric summaries | Contract (Art. 6(1)(b)) |
| Billing and subscription management | Account data, plan | Contract (Art. 6(1)(b)) |
| Security, fraud and abuse prevention | Technical data, logs | Legitimate interest (Art. 6(1)(f)) |
| Error monitoring and debugging | Technical data (pseudonymous user id only) | Legitimate interest (Art. 6(1)(f)) |
| Product and service emails | Account data | Legitimate interest / Contract |
| Publishing to LinkedIn or the public timeline | Draft content | Consent (Art. 6(1)(a)) |
Where we rely on consent — such as publishing on your behalf — you can withdraw it at any time without affecting processing that already took place.
4. Subprocessors
We use a small set of vetted providers to run the service. Each processes data only on our instructions and under a data processing agreement.
| Subprocessor | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication, and file (chart) storage | EU / US |
| Vercel | Application hosting, the weekly cron job, and — only if you consent — cookieless Web Analytics and Speed Insights | US / global edge |
| Lemon Squeezy | Billing and subscriptions (merchant of record) | US |
| Resend | Transactional email delivery | US |
| Sentry | Error monitoring (no session replay, no personal data beyond a pseudonymous user id) | EU (Frankfurt) |
| AI providers (Groq, OpenRouter, Cerebras) | Draft generation. OpenRouter forwards requests to the host of the chosen model, which may be outside the EU and US | US / model host |
| OAuth identity providers (GitHub, Google, Meta, X) | Authentication — you sign in via one of these providers | US / global |
| Data-source connectors (GitHub, GitLab, Bitbucket) | Read-only commit and PR metadata for draft generation | US / EU |
To write a draft we send AI providers your weekly metric summary (commit, pull-request and release counts, revenue and visitor totals) and the titles of the commits and pull requests you shipped that week. We never send access tokens, source code, customer records or your email address. Some providers, in particular free models offered through OpenRouter, may log prompts and use them to improve their models under their own terms. If that matters for a private project, keep sensitive details out of commit and pull-request titles. When no AI provider is available, the draft is built from your numbers by a fixed template and nothing is sent to an AI provider.
Business customers: if you need a data processing agreement (Art. 28 GDPR) with us, email privacy@shipandshout.com and we will send ours, including the current subprocessor list.
5. Retention
- Account, drafts, charts, and tokens: kept while your account is active. When you delete your account, they are erased immediately (see the GDPR & Your Data page).
- Public timeline entries: taken offline within one hour of deletion.
- Backups: purged within 30 days of deletion.
- Billing records: retained by our merchant of record as required by tax and accounting law.
- Error reports (Sentry): kept for up to 90 days.
- Hosting and security logs (Vercel): kept for a few days at most, then rotated.
- Website analytics: aggregated and cookieless; collected only with your consent.
6. Security
Third-party tokens are encrypted at rest (AES-256-GCM) and decrypted only server-side when used. All data is encrypted in transit over TLS. Every database table enforces Row-Level Security so each user can only reach their own rows. We use read-only OAuth scopes wherever a provider offers them and never request write access to your code. More detail is on our Security page.
7. International transfers
Some subprocessors are located in the United States. Where personal data of individuals in the EEA, UK, or Switzerland is transferred outside those regions, we rely on the European Commission's Standard Contractual Clauses (SCCs) and equivalent safeguards, together with supplementary measures such as encryption in transit and at rest.
8. Your rights
Subject to applicable law, you have the right to access, rectify, erase, restrict, and object to the processing of your personal data, to data portability, and to withdraw consent. You can exercise most of these yourself in Settings (Account and Danger zone), or by emailing privacy@shipandshout.com. We respond within one month. You also have the right to lodge a complaint with your local data protection supervisory authority. Our GDPR & Your Data page walks through how to exercise each right.
9. Children
Ship & Shout is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact privacy@shipandshout.com and we will delete it.
10. Automated decision-making
Drafts are generated by large language models from your metric summaries. This processing produces suggestions only — it has no legal or similarly significant effect on you. Every draft is reviewed by a human (you) before anything is published. We do not use your data for automated decisions that produce legal effects. We do not train models on your data ourselves; see section 4 for how AI providers may handle prompts.
11. Changes to this policy
We may update this policy as the product evolves. We will change the “last updated” date above and, for material changes, notify you by email or in the app.
12. Contact
Privacy questions and rights requests: privacy@shipandshout.com. General support: hello@shipandshout.com.
Data controller: MONRYTE S.R.L., registered office STR. BAIA, Nr.10, SECTOR 1, COD POSTAL 013496, MUNICIPIUL BUCUREŞTI, ROMANIA. Trade Register no. J2026032634002, tax ID (CUI) 54953006.