Privacy Policy

Last updated October 16, 2026

This Privacy Policy explains what information ShipLatch collects, how we use it, and the choices you have. ShipLatch is operated by JTA Ventures, LLC, a North Carolina limited liability company doing business as ShipLatch ("ShipLatch", "we", "us"). Questions: hello@shiplatch.com.

The short version: we collect only what we need to run scans, send your report, and take payments. We do not use advertising cookies or trackers, and we do not sell or share your personal information for advertising.

1. Information we collect

• Scanned URLs and findings. The URL you submit and what our scan found, such as missing headers, the builder detected, and any exposed secrets. When we find a secret, we store only where it is and a redacted preview (the first and last few characters), never the full value.
• Your email address. If you unlock a report, we store your email address, the scan it relates to, and how you found us (see Analytics below), and your browser's user-agent string.
• IP address. We use your IP address to enforce our rate limit of 20 scans per hour. Rate-limit records expire after about an hour.
• Ownership verification. The verification token we give you and the site it is for, plus the result of the check.
• Deep scan results. For verified owners, the result of read-only Supabase and Firebase checks. For Supabase we request zero rows and record only the row count the server reports for each table. We never read, copy, or store the contents of your database.
• Payments. Stripe processes payments. We receive your email, the product you bought, the amount, and the subscription status. We never see or store your full card number.
• Paid access and monitoring. For paid plans we store which app (hostname) is unlocked, the plan, the buyer's email, how many re-scans remain, and the most recent scan summary, so we can run re-scans and, for Stay Locked, weekly monitoring.
• Newsletter. If you opt in, we store your email address, the consent wording you agreed to, where you signed up, the time you asked and the time you confirmed, and the IP address used for each step (as proof of consent). We only send the newsletter after you confirm by email.
• Messages. If you email us, we keep the message and your address to reply.

2. Analytics (no cookies)

• Cloudflare Web Analytics, which does not use cookies or fingerprint visitors, gives us aggregate page-view statistics.
• Our own counters. We count events such as page views, scans, report unlocks, checkout clicks, and purchases, per day and per source. The source comes from a utm_source tag in the link or the referring site (for example "x" or "google"). These are aggregate counts, not profiles. We also save the source on scan, lead, and purchase records so we know which channels work.

We do not use advertising pixels, cross-site tracking, or third-party marketing cookies.

3. How we use information

To run scans and show results; to email your report and, if you agreed, occasional product updates; to verify site ownership and run deep scans; to process payments, subscriptions, and refunds; to prevent abuse and enforce our Terms; to understand which channels bring visitors; and to meet legal obligations. We may publish aggregated, de-identified statistics that do not identify you or your site.

4. Service providers

We share information only with providers that help us run the Service, under their own privacy terms:

• Cloudflare — hosting, storage, DNS, email forwarding, and Web Analytics.
• Stripe — payment processing.
• Resend — email delivery.

We may also disclose information if required by law, to protect rights and safety, or as part of a merger or sale of the business, in which case this policy will continue to apply to your information.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as defined in California law.

5. Email and unsubscribing

Report emails, purchase access emails, Stay Locked alerts, and newsletter confirmation emails are transactional: they are sent because you asked for them or bought something. The newsletter is sent only if you opted in and confirmed, and every issue has a one-click unsubscribe link. Every marketing email will include an unsubscribe link, and you can also unsubscribe at shiplatch.com/unsubscribe or by emailing hello@shiplatch.com. You will still receive transactional emails, such as receipts, for purchases you make.

6. Retention

• Free scan details: 7 days, then deleted automatically. The grade and counts stored with your lead record are kept with it.
• Verification tokens: about 7 days.
• Leads (email address and related scan summary): until you unsubscribe and ask us to delete them, or until 24 months after your last activity, whichever comes first.
• Newsletter subscribers: until you unsubscribe. After that we keep a minimal record (email, consent and unsubscribe times) so we never email you again by mistake, unless you ask us to delete it. Unconfirmed signups are deleted after 30 days.
• Paid access records: for as long as the plan is active, and up to 24 months after for support and billing questions.
• Purchase records: as long as needed for accounting, tax, and legal purposes (usually up to 7 years). Stripe keeps its own records under its policy.
• Aggregate analytics counters: about 400 days. They contain no personal information.

7. Security

We use HTTPS everywhere, keep secrets out of client code, and limit access to stored data. No system is perfectly secure, so please email hello@shiplatch.com if you find a vulnerability in ShipLatch itself.

8. Your rights

Depending on where you live (for example under the GDPR in the EU/UK or under California and other US state privacy laws), you may have the right to access, correct, delete, or get a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To make a request, email hello@shiplatch.com from the address in question. We will respond within 30 days (45 days where California law allows) and will not treat you differently for exercising your rights. If you are in the EU or UK, you may also complain to your local data protection authority.

For EU/UK users, our legal bases are: performing our contract with you (scans, reports, purchases), our legitimate interests (security, abuse prevention, and improving the Service), your consent (product update emails), and legal obligations (tax records).

9. International transfers

We are based in the United States, and our providers may process data in the United States and other countries. By using the Service you understand your information will be processed there, with the safeguards our providers offer.

10. Children

The Service is not directed to children under 13 (or under 16 in the EU/UK), and we do not knowingly collect their personal information. If you believe a child has given us information, email hello@shiplatch.com and we will delete it.

11. Site owners

If your site was scanned by someone else and you want us to stop scanning it or delete results about it, email hello@shiplatch.com.

12. Changes

We may update this policy. We will change the "Last updated" date above and, for material changes, give notice on the site or by email.

13. Contact

JTA Ventures, LLC, doing business as ShipLatch. Email: hello@shiplatch.com