Privacy policy
Last updated October 13, 2026
This policy explains what Stableship collects, why, who processes it, how long it is kept, and the choices you have.
What we collect
- Account details: your email address and, if you sign in with GitHub, your GitHub username and avatar.
- Free scan requests: the URL you enter, the email you give, a hashed form of your IP address for rate limiting, and the results of the scan.
- Connected services: repository code and metadata for the repositories you select, database schema and policies, deploy status, and the tokens needed to read them, stored encrypted.
- Run data: findings, verdicts, traces, videos, logs and the audit log of actions taken by people and agents in your workspace.
- Usage: pages visited and features used in the app, measured with privacy-respecting analytics, and transactional email delivery events.
Why we collect it
To provide the Service you asked for, to verify that you control the sites you scan, to prevent abuse, to bill paid plans, to send the emails the Service depends on, and to improve the product. We do not sell personal data and we do not use your code or data to train models.
Who processes it
- Supabase (database, authentication and storage), hosted in the United States.
- Vercel (the website and app) and Railway (the orchestration service).
- Fly.io (short-lived machines that run tests).
- Anthropic (model inference for review, testing and fixes), under zero-data-retention terms.
- Resend (email), Stripe (payments; we never store card numbers), GitHub (repository access through a GitHub App you install).
How long we keep it
- Scan requests and reports: until they expire or you ask us to delete them; the outbound request log for a scan is kept 30 days.
- Evidence (traces, videos, logs): 30 days by default; shorter if you set it.
- Rulebooks, findings and the audit log: for as long as your workspace exists.
- After clean exit or account deletion: everything is deleted within 7 days, except records we must keep by law.
Your choices
- Opt a domain out of scanning by emailing scan@stableship.ai.
- Export or delete your data by emailing hello@stableship.ai or using clean exit in the app.
- Unsubscribe from non-essential email with the link in each message. Emails the Service depends on, such as verification instructions and hold alerts, continue while your account is active.
Cookies and storage
The website sets no tracking cookies. The app uses browser storage to keep you signed in and to remember preferences such as the project you last looked at.
Changes and contact
We will post changes here and, for material changes, notify you by email. Contact hello@stableship.ai with any question about this policy.