Privacy Policy

Last updated 2026-10-17

ShipCheck is operated by REEFERTECHPRO LIMITED (New Zealand). Questions or requests (access, correction, deletion): hello@vibeshipcheck.com. We follow the New Zealand Privacy Act 2020.

Your code

• We scan public GitHub repositories you paste, and private repositories only if you connect GitHub and pick them. For private repos our GitHub App has read-only access to just the repos you choose, each scan uses a one-hour token for that single repo, and you can revoke access anytime in GitHub (Settings → Applications → Installed GitHub Apps).
• The repository is downloaded into an isolated sandbox and analysed with no network access. Your code is never executed.
• The downloaded copy is deleted right after each scan. If a scan crashes, an automatic cleanup removes any leftover copy within about 10 minutes.
• We keep the scan results (repository name, score, findings such as file paths and masked secrets, and the report) so your results page and README badge keep working.

Secrets

Secret values found in your repository are masked inside the sandbox (only the first 4 characters are kept) before they are stored or sent to the AI model. We never store full secret values.

What else we collect

• Email, only if you give it to us (for example to get updates).
• IP address, stored only as a salted hash for rate limiting.
• Payments are handled by Stripe. We receive the payment status and session ID, never your card number.

Who we share it with

• xAI (report generation; masked findings only, no source code).
• Stripe (payments).
• Hostinger (servers and email hosting).
• GitHub (we fetch public repository data, and read-only data for private repositories you connect).

We don't sell personal data or use advertising trackers.

Retention and your rights

Scan results are kept while the service runs, unless you ask us to delete them. Email us at hello@vibeshipcheck.com to access, correct or delete your data, or to unsubscribe.