Privacy — shipready

What we collect

We collect as little as the product needs to work.

Your GitHub accountYour username, avatar and GitHub user ID, so you can sign in. Shipready has no password of its own.

Your repositoriesThe names of the repositories you pick. We read their code to draw the map. The code is processed while we scan and isn’t kept afterwards.

Test recordsFor each connection we test: the connection’s key, its state (for example Tested or Failing), the pull request number, and when it changed.

BillingIf you pay, Stripe handles your card. We see your plan, your billing email and the last four digits, never the full card number.

Service logsIP address, browser and timestamps, used to keep the service running and to spot abuse.

What we never collect

Test source or failing output. You see them live while the run streams, and they’re gone when it ends. The test itself lives in your pull request on GitHub.

Your secrets. We never ask for environment variables, API keys or credentials. If a test needs one to run, we mark it Could not run and tell you why.

Your grades. They’re saved in your browser only. Another browser or computer starts empty.

Advertising trackers. There are no ad pixels or cross-site trackers on Shipready.

GitHub permissions

When you connect, we ask for read access only — your code, so we can read it, and your GitHub Actions history, so we can tell whether a test has actually run and passed. The first time you press Write it for me on a repository, we ask for two more:

actions: readSo we can see whether your own CI ran a test and it passed. Without it we can show you a test exists, never that it works.

The two we ask for later:

contents: writeSo we can add a test file on our own branch, named shipready/test-…

pull_requests: writeSo we can open a pull request for you to review.

We never push to your default branch, and nothing merges without you. You can remove access any time in GitHub’s settings. Pull requests we’ve already opened stay in your repository.

Reports you send us

If you tell us a finding is wrong, we receive the kind of finding, its state, the counts, the rule it came from and the scanner version. We don’t receive file names, paths or code, unless you choose to include them in your note.

How we use it

To sign you in, draw your map, write and run tests, open pull requests, bill you, and improve the scanner. We don’t use your code to train AI models, and we don’t sell or rent your information to anyone.

How long we keep it

Account and test records are kept until you delete your account. Service logs are kept for 30 days. When you delete your account in Settings, we remove everything we hold about you. Pull requests we opened stay in your repositories, because they’re yours.

Your rights

Wherever you live, you can ask to see, correct, export or delete the information we hold about you, and object to how we use it. If you’re in the EU, the UK or California, these rights are also protected by law (GDPR, UK GDPR and CCPA). Write to us and we’ll reply within 30 days.

Changes and contact

If we change this policy in a way that matters, we’ll say so in the app before it takes effect, and update the date at the top of this page.

[Company legal name][Registered address][privacy email]

We read your code. We don’t keep it.