What we store, and what we don't.

Shipleak is the team operating shipleak.com, and we are the data controller for the personal data described here. For anything on this page — a copy of your data, a correction, a deletion, or a complaint — email privacy@shipleak.com and a person will read it.

When you run a scan we store the URL you submitted, its hostname, the framework we detected, and the findings — including short excerpts of evidence from the page, such as a response header or a fragment of HTML.

Anything that looks like a secret is redacted before it is stored. If a scan spots something resembling an API key we keep only a truncated, masked form of it, enough to show you where the problem is and not enough to use. The full value never reaches our database.

Scans do not require an account. If you are signed in, the scan is linked to your account so you can find it again.

Every scan produces a permalink. That page is not private: it has no password, and anyone who has the link — or guesses it — can read the full report, including the findings and evidence excerpts.

The link contains a random identifier and we do not publish an index of reports, so they are not discoverable by browsing. Treat a report link the way you would treat any unlisted URL: share it deliberately. If you want one taken down, email us and we will delete it.

If you create an account we store your email address and authentication details through Supabase, our database and auth provider. Signing in sets a first-party cookie so the site knows it is you.

If you buy a sponsor slot we store the product name, URL, description, and any logo you upload, along with the email address Stripe collects at checkout. We use that address to tell you when your slot goes live and to remind you shortly before it ends.

Payments are handled entirely by Stripe on their own checkout page. We never see or store your card details.

There is no cookie banner because there is nothing to consent to. The only cookies Shipleak sets are first-party authentication cookies, and only once you sign in. They are strictly necessary to keep you signed in, so they do not require consent.

We run no analytics, no advertising network, no tracking pixel, and no third-party scripts. Sponsor slots are text and an image served from our own domain — a sponsor cannot place a pixel, a tag, or any code on this site, and none of them learn anything about you.

Our host records standard request logs, which include IP addresses. We also store a short-lived per-IP counter to rate-limit scanning and checkout, so that automated abuse doesn’t take the free service down for everyone. Those counters are deleted automatically within a few hours.

The lawful basis for both is our legitimate interest in keeping the service available and preventing misuse.

We do not sell personal data and we do not share it for advertising. We use these processors:

• Supabase — Database, authentication, and file storage. Scan records, findings, account emails, sponsor submissions and logos.
• Vercel — Hosting and content delivery. Request logs, including IP addresses.
• Stripe — Payments for sponsor slots. We never see or store card details. Billing name, email, and payment details, entered on Stripe's own page.
• Resend — Transactional email to sponsors. Sponsor email address and message content.

Our database and file storage are hosted in Europe. Where a processor transfers data outside the UK or EEA, they do so under the safeguards set out in their own data processing terms.

• Scans and findings — kept indefinitely, so shared permalinks keep working. Deleted on request.
• Account data — until you ask us to delete the account.
• Sponsor records — kept after a slot ends, as a record of who advertised and when, and because payment records have to be retained for tax purposes.
• Rate-limit counters — a few hours.

You can ask us for a copy of your personal data, ask us to correct or delete it, or object to our processing of it. Email privacy@shipleak.com and we will respond within a month.

If you are in the UK or EU and think we have handled your data badly, you can complain to your data protection authority — in the UK, the Information Commissioner’s Office.

If we change this policy in a way that materially affects you, we will update the date at the top of this page. See also our terms of use.