Privacy

Who runs this site

ShipVibed is based in Brazil. Contact for anything on this page: [email protected].

Reading the site

• We don't set cookies of our own and don't run analytics or ad scripts.
• The home page loads a script from impact.com, the affiliate network some vendors use. It records that the page was viewed and can track referrals when you click a vendor link, and it may set cookies to do so. See impact.com's privacy policy. Other pages don't load it.
• The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes your IP address and basic request data to serve pages and block attacks. See Cloudflare's privacy policy.
• Some pages load fonts from Google Fonts, so Google receives your IP address when those pages load. See Google's privacy policy.

The readiness checker

• When you run the readiness checker, our server makes a few GET requests to the public URL you enter and sends you the report.
• We don't store the URL, the report or anything downloaded from your site, and we don't log them. Found keys are only ever shown masked.
• To limit abuse, we count checks per IP address in memory for 10 minutes. That count is never written anywhere.

The pre-launch audit

• When the paid pre-launch production audit is open and you send an intake after paying, we receive: your contact email, the app URL, the stack you picked, an optional repository URL or a note that you will grant read-only access, how you heard about ShipVibed if you choose to say, and any notes you write. To prove you control the app, you add a token we give you to the app (a meta tag or a /.well-known/shipvibed.txt file) or invite us to the repo; we only look for that token on the app you named.
• Why: only to do the audit you asked for and to email you the report. We use your consent as the legal basis.
• Who processes it: the intake is emailed to [email protected] through Resend, the same email service as the newsletter. We don't store the intake in a database on this site.
• Never paste production secrets (service_role keys, Stripe secret keys, database passwords or JWT secrets). The form tries to refuse them.
• Payments are processed by Stripe and are covered by Stripe's privacy policy.
• How long: we keep the intake and the report long enough to deliver the work and handle refunds, then delete them on request. Email [email protected].

The newsletter

• What we collect: your email address, the date you signed up, and whether you're subscribed.
• Why: only to send you the newsletter you asked for. We use your consent as the legal basis, and you can withdraw it at any time.
• Who processes it: we store the list with Resend, the email service that sends the newsletter. Resend is based in the United States. Resend records whether each email was delivered and may record opens and clicks.
• What we don't do: we don't sell, rent or share your address, and we don't add it to other lists.
• How long: until you unsubscribe. After that we delete your address from the list within 30 days.

Your rights

You can unsubscribe from the link at the bottom of every email. To see, correct or delete the data we hold about you, email [email protected] and we'll reply within 15 days. People in Brazil have these rights under the LGPD, and people in the EU and UK under the GDPR, but we give them to everyone.

Links to other sites

Tool pages link to vendors' websites, which have their own privacy policies. Some of these are affiliate links, marked on the page; the vendor may set its own cookies to track the referral when you click one.

Changes

If this page changes, we'll update the date below. Last updated: 2026-11-13.