Privacy Policy
Last updated: March 5, 2026
Shipchart ("we", "our", "us") operates this service. This policy explains what data we collect, why, and what we do with it. We've tried to keep it readable rather than burying the important bits in legal jargon.
The short version: we collect what we need to run the service, we don't sell your data, and you can delete your account at any time.
What We Collect
Account Information
When you create an account, we collect your name, email address, and a password (stored hashed — we never see it in plain text). We also store your preferences: default currency, timezone, and appearance settings.
Data You Enter
Everything you put into Shipchart — projects, revenue entries, expenses, check-ins, ideas, goals, roadmap items, and any notes or descriptions — is stored in our database to provide the service. This is your data. We don't read it, analyze it for advertising, or share it with anyone.
Stripe Connect Data
If you connect a Stripe account, we access your Stripe product and revenue data through Stripe's API using read-only OAuth permissions. We store synced revenue figures (amounts, dates, product names) to display in your dashboard. We do not store your Stripe credentials — authentication is handled entirely by Stripe's OAuth flow. You can disconnect Stripe at any time, and we stop syncing. Previously synced data remains unless you delete it or your account.
Payment Information
When you subscribe to a paid Shipchart plan, payment is processed by Stripe (web) or Apple (iOS App Store via RevenueCat). We do not store your credit card number, bank details, or Apple Pay information. Stripe stores your payment method on their servers. RevenueCat manages App Store subscription state. We store only: which plan you're on, subscription status, and billing period dates.
Automatically Collected Data
Web analytics (Fathom Analytics): We use Fathom Analytics for website analytics. Fathom is privacy-focused — it does not use cookies, does not track you across sites, and does not collect personal information. It tells us aggregate numbers: how many people visit which pages. That's it. Fathom is GDPR compliant and does not require a cookie banner.
App analytics (TelemetryDeck): Our iOS/Mac app uses TelemetryDeck for anonymous usage analytics. TelemetryDeck collects no personally identifiable information. It uses differential privacy techniques so we can see aggregate patterns (which screens are most used, crash-free rates) without being able to identify individual users. No advertising IDs, no device fingerprinting.
Server logs: Our servers automatically log IP addresses, request timestamps, and user agents for security and debugging. These logs are retained for 30 days and then deleted.
MCP & OAuth Connections
If you connect Shipchart to an AI assistant (like Claude, Cursor, or similar tools) via our MCP server, authentication is handled via OAuth 2.1 or API tokens that you create. We log which tools are called for debugging purposes. The AI assistant may send your data (project names, revenue figures, etc.) to its own servers as part of processing your requests — that is governed by the AI assistant's own privacy policy, not ours.
How We Use Your Data
We use your data to:
- Provide the Shipchart service (dashboards, analytics, notifications — the stuff you signed up for)
- Process your subscription payments via Stripe or Apple
- Send you transactional emails (password resets, subscription confirmations)
- Send you notification emails you've opted into (weekly digests, check-in nudges) — you control these in Settings and can turn them off at any time
- Fix bugs and improve the service (using aggregate, anonymous analytics only)
We do not:
- Sell your data to anyone
- Use your data for advertising
- Share your data with third parties for their marketing
- Train AI models on your data
- Read your check-ins, revenue figures, or any other content you enter
Third-Party Services
We use the following services to operate Shipchart. Each has its own privacy policy:
| Service | Purpose | Data Shared |
|---|---|---|
| Stripe | Web payment processing | Email, payment method (handled by Stripe) |
| Apple / App Store | iOS payment processing | Apple ID, payment method (handled by Apple) |
| RevenueCat | Subscription management for iOS | Anonymous user ID, subscription state |
| Fathom Analytics | Web analytics | None (cookieless, no personal data) |
| TelemetryDeck | App analytics | None (anonymous, differential privacy) |
| AWS | Cloud hosting | All data (encrypted at rest and in transit) |
| Resend | Transactional email | Email address, email content |
Data Storage & Security
Your data is stored on servers in the EU/UK (AWS). All data is encrypted in transit (TLS) and at rest. Database backups are encrypted. We use standard security practices: hashed passwords (bcrypt), CSRF protection, rate limiting, and regular dependency updates. We're a small team, not a bank — but we take reasonable care.
Your Rights
- Access your data: Everything is visible in your account. If you need a machine-readable export, contact us.
- Correct your data: Edit your profile, projects, and all content directly in the app.
- Delete your data: Delete your account in Settings. This permanently removes all your data — projects, revenue, check-ins, everything. This action is irreversible.
- Export your data: The app provides export functionality for analytics summaries and financial data. For a full data export, contact us.
- Withdraw consent: Unsubscribe from notification emails at any time via the link in any email, or in Settings.
If you're in the UK or EU, you have additional rights under UK GDPR / EU GDPR, including the right to lodge a complaint with the ICO (ico.org.uk) or your local data protection authority.
Cookies
The Shipchart web app uses a session cookie to keep you logged in. That's it. No tracking cookies, no advertising cookies, no third-party cookies. Fathom Analytics is cookieless.
Children
Shipchart is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children.
Data Retention
We keep your data for as long as your account is active. If you delete your account, all data is permanently deleted within 30 days (to allow for backup rotation). Server logs are retained for 30 days. Anonymous analytics data (Fathom, TelemetryDeck) is retained indefinitely but contains no personal information.
Changes to This Policy
If we make significant changes, we'll notify you by email or with a notice in the app. Minor wording tweaks won't get an email — but the "last updated" date at the top will always reflect the latest version.
Contact
Questions about privacy? Email us at privacy@shipchart.app.
Shipchart is based in the United Kingdom.