Privacy Policy

1. Who is responsible

The controller is HonestDev (Thomas Oomens), based in the Netherlands. Contact for anything privacy related: [email protected].

2. What we collect

• Account data: name, email address, password hash, and if you sign in with Google, the profile details those providers share
• Project data: project names, team members and roles, invitations you send
• Content you provide: app metadata, screenshots, images, store listings, translations, covers, reels and brand assets
• Connection credentials: keys and tokens for App Store Connect, Google Play or social networks that you choose to connect, stored encrypted
• Usage and billing data: credit balance and history, purchases and subscription status (payment details stay with Polar)
• Technical data: IP address, browser information and timestamps in server logs, needed for security and operation
• Messages you send us by email

3. Why we use it and on what basis

• To provide the service you signed up for, including sign-in, projects, generation and publishing tools (performance of a contract)
• To send emails that the service needs, such as verification, password reset and invitations (performance of a contract)
• To process payments and keep tax records (contract and legal obligation)
• To keep the service secure, prevent abuse and fix errors (legitimate interest)
• To understand how the public website is used, in a privacy-friendly way (legitimate interest, see Analytics)
• To answer your questions (legitimate interest)

We do not sell personal data and do not use it for advertising.

4. AI processing by third parties

When you use an AI feature, the content needed for that request is sent to a third-party AI provider that runs the model. This can include your text, images, screenshots and app details. We currently use AtlasCloud as gateway to image, video and text models. Those providers process the data to return a result for you. We do not permit the use of your content to train models where the provider offers that choice, but we cannot control every provider, so please do not submit content you are not allowed to share or that contains sensitive personal data.

AI features are optional. If you do not use them, your content is not sent to these providers.

5. Who else processes data

We use carefully chosen service providers as processors, under data processing agreements where required:

• Hosting provider for our servers and database
• Cloudflare R2 for storing files you upload and generate
• Brevo for sending transactional email
• AtlasCloud and the model providers behind it for AI features
• Polar for payments, when enabled
• Google if you choose to sign in with it
• Apple, Google Play or social networks only when you connect them and start a push or publish action
• Self-hosted Umami analytics

We share data with authorities only when the law requires it.

6. Payments

When payments are enabled, checkout is handled by Polar as merchant of record. Polar receives your payment details and billing information under its own privacy policy. We receive confirmation of the purchase, the plan or pack, and the status of your subscription.

7. Analytics

We use self-hosted Umami on servers in the EU to understand visits to public pages. We send reviewed page paths, campaign labels and the referring website, without form contents, account identifiers or private dashboard URLs. It uses no cookies or browser storage, does not store raw IP addresses in its database, and respects Do Not Track and Global Privacy Control. More detail is on the website analytics page.

8. Transfers outside the EU

Some providers, in particular AI providers, may process data outside the European Economic Area. Where that happens we rely on an adequacy decision or on standard contractual clauses and comparable safeguards.

9. How long we keep data

• Account and project data: while your account is active, and deleted within 30 days after you ask us to delete your account
• Uploaded and generated files: with the project, deleted together with it or with your account
• Invoices and payment records: 7 years, as required by Dutch tax law
• Server logs: a short period, no longer than needed for security and troubleshooting
• Backups: removed on a rolling schedule, so deleted data can remain there for a limited time
• Emails you send us: as long as needed to handle your question

10. Your rights

You have the right to access, correct, delete and export your data, to restrict or object to processing, and to withdraw consent where we rely on it. Write to [email protected] and we will respond within one month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.

11. Security

We use encryption in transit, hashed passwords, encrypted storage of connection credentials and access controls between projects. No system is perfectly secure. If a breach affects your rights we will notify you and the authority as the law requires.

12. Children

ShipSloth is not meant for people under 16 and we do not knowingly collect their data.

13. Changes to this policy

We may update this policy. The date at the top shows the latest version. For material changes we will inform you by email or in the app.

14. Contact

HonestDev (Thomas Oomens), the Netherlands. Email: [email protected].