Privacy and security policy

Shipcode ("we") is the controller of personal data collected through the site and platform.

Privacy contact: privacy@shipit.codes.

We may process:

• Account data: email, username, avatar, and authentication identifiers (e.g. OAuth with GitHub).
• Usage data: project progress, code submissions for validation, and technical logs (IP, browser, timestamps).
• Mentor data: your questions, AI responses, the relevant stage context, and token usage.
• Billing data: managed by our payment provider; we do not store full card numbers.
• Communications: messages you send us via support or contact forms.

We use your data to provide the Service, authenticate you, save your progress, process payments, improve the platform, and comply with legal obligations.

Legal bases include contract performance (account and subscription), legitimate interest (security and product improvement), and consent when required by law (e.g. optional marketing communications).

We apply reasonable technical and organizational measures to protect your data against unauthorized access, loss, or alteration.

Passwords are not stored in plain text. Traffic between your browser and our servers uses TLS encryption.

Infrastructure (database, authentication, storage, and execution sandboxes) relies on providers with recognized certifications. Cloud tests run without network access, credentials, or persistent storage and with resource limits.

If we detect a security breach affecting your rights, we will inform you and notify the supervisory authority when required.

We share data with providers that help us operate the Service (hosting, authentication, isolated test execution, cookieless product analytics on Vercel Web Analytics, payments, and AI inference). They are bound by contracts requiring confidentiality and adequate protection.

When you use the Pro mentor, we send your question and the relevant project context to the paid Gemini Developer API. We do not send your Shipcode user identifier, and Google states that paid prompts and responses are not used to improve its products.

If we transfer data outside the European Economic Area, we use appropriate safeguards (standard contractual clauses or other EU Commission-approved mechanisms).

We retain your data while you maintain an active account and as long as necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

A cloud test's code archive is deleted when execution finishes, and a lifecycle rule removes it within one day if cleanup fails.

You can delete your account from Settings. We ask you to type a confirmation word. Doing so immediately cancels any Stripe subscription so it will not be charged again, signs you out, and deletes your profile, progress, mentor conversations, code snapshots, CLI sessions, feedback, content reports, and associated files.

We keep an anonymized billing record with no name, email, username, or account identifier: the payment provider reference, the plan or pack, the amount, the status, and the relevant dates. We keep it for as long as Spanish tax and commercial law requires, generally six years, so we can support invoices and refunds. Stripe keeps the invoices it issued, including the billing details you provided, under its own legal obligations. We do not store your card number.

You may access, rectify, erase, restrict, or object to processing, and request data portability when GDPR or equivalent regulations apply.

You can delete your account from Settings. To exercise the other rights, write to privacy@shipit.codes. You may also file a complaint with the AEPD (www.aepd.es) or another authority in your country.

We use strictly necessary cookies for session and security. Product analytics counts visits and funnel steps (signup, project start, first passed stage, and Pro checkout) without cookies and without your email, username, or account identifier. Analytics or marketing cookies, if any, will only be activated with your consent when required by law.

You can manage preferences from your browser settings.

We may update this policy. We will publish the current version on this page with the revision date. We will notify you of relevant changes by email or platform notice when necessary.