Privacy Policy

1. Introduction

GoShipOrSkip (“we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered app idea validation service.

By using GoShipOrSkip, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Google Account Information: When you sign in with Google, we collect your name, email address, and profile picture provided by Google OAuth.
• App Ideas: The text descriptions of app ideas you submit for analysis.
• Payment Information: When you subscribe to Pro, payment details are processed by Polar, our merchant of record, which uses Stripe for card processing. We store your Polar customer ID and order details but never see or store card numbers.

2.2 Automatically Collected Information

• Usage Data: Analysis timestamps, query text, analysis results, processing time, and AI model usage.
• Session Data: Authentication session cookies managed by better-auth, stored in our PostgreSQL database.
• Free Previews: When you run a preview without an account, we record that it happened and whether it found apps. We do not store your idea text or IP address with it, and nothing is saved in your browser. If you open the preview's full report link and sign in, that preview is linked to your account.
• Newsletter: If you subscribe to the weekly ideas email, we store your email address, the page you subscribed from and when. We use it only to send that email. Every issue has an unsubscribe link, and unsubscribing stops it at once.
• Device and Browser Information: IP address, user agent, browser type, operating system, and device identifiers.
• Log Data: Server logs including API requests, errors, and performance metrics (logged via Pino).

2.3 Third-Party Data

We collect publicly available review data from third-party platforms to power our analysis:

• Product Hunt: Posts, comments, and topics (via OAuth2 API)
• Google Play Store: App information and user reviews (via google-play-scraper)
• Apple App Store: App information and user reviews (via app-store-scraper)
• Reddit: Public posts and comments (via public JSON API)

This data is publicly available and subject to the privacy policies of those platforms.

3. How We Use Your Information

We use the collected information to:

• Provide the Service: Process your app idea submissions, generate validation reports, and deliver analysis results.
• Authentication: Verify your identity and manage your account sessions.
• Payment Processing: Handle purchases, subscriptions, billing, and invoices through Polar.
• Rate Limiting: Enforce daily analysis limits (3 for free users, unlimited for Pro).
• Improve AI Models: Train and refine our AI algorithms, prompts, and hallucination detection systems.
• Performance Optimization: Cache review data for 7 days to improve response times and reduce API costs.
• Customer Support: Respond to your inquiries and troubleshoot issues.
• Analytics: Understand usage patterns, feature popularity, and service performance.
• Legal Compliance: Comply with applicable laws, regulations, and legal processes.
• Security: Detect and prevent fraud, abuse, and security incidents.

4. Data Sharing and Disclosure

4.1 Third-Party Service Providers

We share data with trusted third-party services that help us operate:

• Google OAuth: Authentication services (subject to Google's Privacy Policy)
• Polar: Payments, subscriptions and invoices, as merchant of record (subject to Polar's Privacy Policy). Card payments are processed by Stripe on Polar's behalf.
• Sentry: Error monitoring, hosted in the EU (Germany). When something breaks, technical details of the error, the page, your browser and your IP address are sent to Sentry so we can fix it.
• OpenRouter: AI model access for generating analysis (subject to OpenRouter's privacy policy)
• Hosting Provider: Database and application hosting services

4.2 Legal Requirements

We may disclose your information if required to:

• Comply with legal obligations, court orders, or government requests
• Enforce our Terms of Service
• Protect our rights, property, or safety
• Investigate fraud or security incidents

4.3 Business Transfers

If GoShipOrSkip is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.

4.4 No Sale of Personal Data

We do NOT sell, rent, or trade your personal information to third parties for marketing purposes.

5. Cookies and Tracking Technologies

5.1 Cookies We Use

• Session Cookies: Managed by better-auth to maintain your login session. These are httpOnly and secure, and strictly necessary for signing in.

We do not use analytics, advertising or other tracking cookies, and no third-party analytics script runs on our pages. Our usage numbers come from our own database (for example, how many previews led to a sign-up), not from your browser.

5.2 Managing Cookies

You can control cookies through your browser settings. However, disabling cookies may limit your ability to use the Service. Session cookies are required for authentication.

6. Data Retention

• User Accounts: Retained until you delete your account or request deletion.
• Analysis Results: Stored indefinitely unless you delete them or close your account.
• Cached Reviews: Automatically deleted after 7 days and refreshed as needed.
• Session Data: Retained according to better-auth's session management (typically 30 days).
• Payment Records: Retained for 7 years to comply with financial regulations.
• Log Data: Retained for 90 days for debugging and security purposes.

7. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data transmitted between your browser and our servers uses TLS/SSL encryption.
• Database Security: PostgreSQL database with access controls and encrypted connections.
• Authentication: Secure session management via better-auth with database session storage.
• Payment Security: PCI-compliant payment processing handled by Polar and its card processor Stripe; card data never reaches our servers.
• Access Controls: Role-based access (USER/ADMIN) with restricted admin routes.
• Webhook Verification: Polar webhook signature verification to prevent tampering.

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

8. Your Privacy Rights

Depending on your location, you may have the following rights:

8.1 General Rights

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate information in your account settings.
• Deletion: Request deletion of your account and associated data.
• Export: Download your analysis history in JSON or PDF format.
• Opt-Out: Unsubscribe from marketing emails (if we send any in the future).

8.2 GDPR Rights (EU/EEA Users)

If you are located in the European Union or European Economic Area, you have additional rights:

• Right to Erasure: Request deletion of your personal data (“right to be forgotten”).
• Right to Restriction: Limit how we process your data.
• Right to Object: Object to processing based on legitimate interests.
• Right to Data Portability: Receive your data in a machine-readable format.
• Right to Lodge a Complaint: File a complaint with your local data protection authority.

8.3 CCPA Rights (California Users)

If you are a California resident, you have rights under the California Consumer Privacy Act:

• Right to Know: Request disclosure of personal information collected in the past 12 months.
• Right to Delete: Request deletion of your personal information.
• Right to Opt-Out: We do not sell personal information, so no opt-out is necessary.
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights.

8.4 Exercising Your Rights

To exercise any of these rights, use the contact address listed in section 15. We will respond within 30 days.

9. Children's Privacy

GoShipOrSkip is not intended for users under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately, and we will delete it.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. These countries may have different data protection laws. By using the Service, you consent to the transfer of your information to the United States and other countries where we operate.

For EU/EEA users, we ensure adequate safeguards are in place, such as Standard Contractual Clauses (SCCs), to protect your data.

11. AI and Automated Decision-Making

GoShipOrSkip uses AI and large language models (via OpenRouter) to generate analysis reports. These are automated processes, but they do not result in legal or similarly significant effects. The analysis is informational only and should not be your sole basis for business decisions.

We implement guardrails including schema validation and hallucination detection to improve accuracy, but AI-generated content may still contain errors.

12. Third-Party Links

Our Service may contain links to third-party websites or services (e.g., Product Hunt, Google Play, App Store). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

13. Do Not Track Signals

Our Service does not currently respond to Do Not Track (DNT) browser signals. We may implement DNT support in the future.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Updating the “Last Updated” date at the top of this page
• Posting a notice on our website
• Sending an email to your registered email address (for significant changes)

Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

15. Contact Us

A dedicated contact address for questions and requests about this Privacy Policy is being set up and will be listed here.

16. Data Processing Summary