Privacy Policy

When you import a project — whether through GitHub, GitLab, Bitbucket OAuth, a ZIP upload, or the shipdocs upload CLI command — we receive and store the following:

• Source files. The contents of every file in the imported repository or archive, respecting your .gitignore rules when pushed via CLI.
• Project metadata. Repository name, detected languages and frameworks, file counts, and import timestamps.
• Generated documentation. Markdown documents produced by our indexing pipeline, organized per detected component (backend, frontend, workers, CLI, migrations, etc.).
• AI chat conversations. Messages exchanged between you and the project-scoped AI assistant, stored against your account for session resumption.
• Account data. Email address, OAuth identifiers, and organization membership.

We do not collect data beyond what is necessary to provide the Service. We do not serve behavioral advertising trackers, sell data to third parties, or embed third-party analytics that transmit personally identifiable information.

All source files and generated documentation are encrypted at rest using AES-256-GCM, an authenticated encryption standard approved by NIST SP 800-38D and widely adopted across the industry.

Each project receives a unique data-encryption key (DEK). These DEKs are themselves wrapped (encrypted) by a master key stored in our KMS-backed vault, implementing an envelope-encryption model consistent with the architectures used by GitHub, Vercel, and Linear. No usable plaintext — source code, generated docs, or chat content — is written to the database.

Encryption keys are rotated periodically. When a project or account is permanently deleted, the corresponding DEK is destroyed, rendering any residual ciphertext cryptographically unrecoverable.

Your source code, generated documentation, and AI chat conversations are never used to train any AI model — ours or anyone else's. This is a binding operational commitment, not a temporary configuration.

We route all model inference through third-party providers (including OpenAI and Anthropic) on zero-retention API endpoints. Under these agreements, prompts and completions are not logged, stored, or incorporated into the providers' training datasets by the provider. We contract directly with each provider and pay premium API rates specifically to keep your data out of their training pipelines.

Should we change model providers, we will maintain the same zero-retention, zero-training contractual requirements and disclose the change in an update to this policy.

Your access. You and members of your organization can read projects and chats through the ShipDocs product at any time.

Administrative access. ShipDocs administrators can decrypt and read project data only when there is a legitimate operational need — specifically, customer support escalations, abuse or security investigations, or compliance with a formal legal request. Every administrative decryption event is recorded in an immutable internal audit log capturing the administrator identity, the affected project, the precise timestamp, and the stated reason for access.

No third-party access. Your source code never leaves ShipDocs' encrypted infrastructure. We do not share, sell, or transfer customer data to any third party for processing, mining, or analysis. The only external services that briefly handle your data are the zero-retention AI model endpoints described in Section 3.

When you delete a project, a chat conversation, or your account, the record is soft-deleted and immediately hidden from the product. A daily background process then performs a hard delete after a 90-day grace window, permanently erasing:

• Encrypted source files and generated documentation
• AI chat message history
• The per-project data-encryption key (rendering any residual ciphertext unrecoverable)
• Associated account and organization rows

During the 90-day window, you can restore a deleted project from Settings or reactivate a deleted account by signing in. After 90 days, deletion is irreversible — not even ShipDocs staff can recover the data.

Records subject to an active, formal legal preservation notice are retained until the notice expires. We do not extend retention for any other purpose.

We may flag projects for manual review if automated signals suggest malware hosting, distribution of illegal content, or other terms-of-service violations. Flag metadata — consisting of the project ID, the triggering reason, and the timestamp — is retained beyond the 90-day content window as a legitimate-interest safety measure. The underlying project content follows the standard 90-day deletion schedule unless preserved under a formal legal request.

ShipDocs responds to lawful legal process (court orders, subpoenas, or equivalent) scoped to specific accounts or projects. We do not provide bulk or indiscriminate data access to any government agency.

ShipDocs is aligned with the General Data Protection Regulation (EU 2016/679). Specifically:

• Right of access. You can export all your data from account settings at any time.
• Right to erasure. Account deletion triggers the 90-day hard-delete process described in Section 5. You may request written confirmation of deletion.
• Right to rectification. You can edit generated documentation directly in the product. Account details can be corrected in Settings.
• Right to data portability. Documentation is exportable as standard Markdown. Source files are not re-exported (you retain the originals in your repository).
• Right to object. We process data solely to provide the Service, under contractual necessity (Art. 6(1)(b)) and legitimate interest for abuse prevention (Art. 6(1)(f)). You may object to legitimate-interest processing by contacting us at the address below.

ShipDocs does not rely on consent as a legal basis for core data processing. Where consent is required for optional features, it is obtained separately and may be withdrawn at any time.

ShipDocs infrastructure is hosted in the United States. If you access the Service from the European Economic Area, the United Kingdom, or any other jurisdiction with data-transfer restrictions, your data will be transferred to our U.S.-based systems. We maintain Standard Contractual Clauses (SCCs) as approved by the European Commission to ensure adequate protection during such transfers.

We may update this policy periodically. Material changes will be communicated via email to the address on file and by updating the "Last revised" date above. Continued use of the Service after such notice constitutes acceptance of the revised policy.

For privacy inquiries, data-subject requests, audit-log copies, or deletion confirmations, contact our Data Protection team at privacy [at] shipdocs.sh. We aim to respond within 30 days, or sooner where required by applicable law.