Back

Privacy Policy

Last updated: 18 October 2026

1. Who we are

ShipStreak is a publishing-streak tool operated from the European Union. This policy explains what personal data we collect, why we collect it, how we use it, and which third parties process it on our behalf. It applies to shipstreak.space, all subdomains (e.g. username.shipstreak.space), and any custom domain you may bind to your public profile.

We act as the data controller for the data described below. For third-party processors, the relevant provider acts as a sub-processor under our instructions.

2. What we collect

Account data

  • Email address
  • Firebase user id (uid)
  • Display name (optional, set by you)
  • Public username (your profile slug)
  • Timezone (used to anchor day boundaries on your streaks)
  • Preferred output tone (raw, clean, calm, builder, hype; Pro only for polished tones)
  • Custom domain (Pro only, if you set one)

Product data

  • Streak metadata (duration, day index, status, timestamps)
  • Daily entry bullets you submit
  • The generated post text produced from those bullets
  • Completion timestamps used to render your public calendar

Billing data

  • Stripe customer id
  • Subscription state mirror (plan, status, period end, cancel-at-period-end flag)
  • We do not see, store, or process your card number, CVC, or full card details on our servers. Stripe handles all card data directly.

Operational data

  • Essential cookies: session (auth), csrf_token / csrf_token_client (CSRF protection).
  • First-party analytics cookies from DataFast (datafast_visitor_id, datafast_session_id) used to measure traffic and attribute revenue to marketing channels.
  • Audit log of security events (sign-in, password reset, billing changes, deletion) used for abuse prevention and account recovery.

3. How we use it

  • Run the daily publishing loop and enforce streak rules.
  • Render your public profile (completion calendar + streak state). Bullets and generated post text are never published to your public profile.
  • Process subscriptions and reflect plan entitlements.
  • Understand which marketing channels bring visitors and paid customers (DataFast + Stripe metadata).
  • Reply to support requests sent to support@shipstreak.space.
  • Detect and prevent abuse (rate limiting, audit logs).

We do not sell your data and we do not run advertising or retargeting networks on the site.

4. Third-party processors

  • Firebase (Google): authentication, Firestore database, hosting of session tokens. Personal account + product data is stored here.
  • Stripe: payment processing and subscription lifecycle. Card details flow directly between you and Stripe. We may attach DataFast visitor/session IDs to Checkout session metadata so payments can be attributed to traffic sources.
  • DataFast: privacy-friendly web analytics and revenue attribution. Loads a first-party tracking script, stores visitor/session cookies, and receives pageviews plus payment metadata we pass through Stripe. See DataFast privacy.
  • OpenAI: used only when a Pro user triggers a polished post tone. The bullets you wrote are sent per-request to generate the post text and are not used to train OpenAI models(we use the API tier with training disabled). We do not retain anything on OpenAI's side beyond the request itself.
  • Vercel: application hosting and edge routing. Receives standard request metadata (IP, user agent) for delivery and abuse prevention.

5. Cookies

Essential cookies (session, csrf_token, csrf_token_client) keep you signed in and protect mutating requests. DataFast sets datafast_visitor_id and datafast_session_id for analytics and revenue attribution. We do not set advertising or retargeting cookies.

Full cookie list: Cookies policy.

6. Retention

Account, product, and billing data is retained for as long as your account exists. You can delete your account at any time from /dashboard/account; deletion removes your profile, streaks, entries, and public page. Audit log entries are retained up to 12 months for security purposes. Stripe retains billing records independently per its own retention policy and applicable financial regulations.

7. Your rights

Under the GDPR and equivalent laws, you can:

  • Access the personal data we hold about you.
  • Correct inaccurate data via the account page.
  • Delete your account and associated data.
  • Export your data. Every account can call GET /api/user/export from /dashboard/account to download a JSON snapshot.
  • Withdraw consent or object to processing.
  • Lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at support@shipstreak.space. We respond within 30 days.

8. Children

ShipStreak is not intended for users under the age of 16. We do not knowingly collect data from anyone under 16; if you believe a minor has signed up, contact us and we will delete the account.

9. International transfers

Some of our processors (Google/Firebase, Stripe, OpenAI, Vercel) are based in the United States and may process data outside the EEA. Where this happens, we rely on Standard Contractual Clauses and the providers' own data processing terms.

10. Updates to this policy

We will update this policy when our processing changes materially. The date at the top of the page reflects the most recent revision; we will notify active accounts by email when changes are material.

11. Contact

Questions about this policy or your data? support@shipstreak.space.