What Shiproom collects, and what it does not

Your application

Shiproom does not host your application and does not receive a copy of it. Your app runs where it already runs, usually on your own machine. When a reviewer opens the review link, Shiproom forwards that HTTP request to your running application and returns the response, injecting the review widget into HTML responses so the reviewer has something to comment with.

Shiproom does not connect to your Git host, read source code, inspect Git metadata, readpackage.json to identify a project, or require a source-code upload to start a review. It does not write into your project directory.

What a feedback report contains

When a reviewer submits feedback, the report can include:

• The route and page title of the page they were on
• A screenshot of that page as they saw it
• The geometry of each mark they made, stored relative to the page rather than in pixels
• Metadata about the elements they selected: tag, id, classes, accessible name, ARIA role, CSS path, and position and size
• Viewport size, device type, browser and operating system
• The timestamp and the reviewer's session
• The category they chose and the comment they wrote
• Failed HTTP requests and JavaScript errors recorded shortly before they submitted, as described below

What is never collected

The technical capture is deliberately narrow. When the widget records a failed request it keeps the method, a sanitised path, the status code, the duration and the timestamp. It does not keep:

• Request or response bodies
• Request or response headers
• Cookies or Authorization values
• Its own traffic, so the widget never reports on itself

Query-string values under keys such as token, key,secret, password, code, auth andsession are redacted before anything is stored. Element metadata describes an element's identity and position, never the value a user typed into it.

Who can see a review

A project is private when it is created. Only someone holding an invite link can open the reviewer URL. Invite links can be created per person, rotated, or revoked, and rotating a link ends the previous one immediately.

A project can be switched to public, in which case anyone with the URL can open it and leave feedback. The CLI asks you to confirm before making that change.

How long things last

The review link serves your application only while your session is running and the app is reachable. When you stop the session, reviewers see an offline page. Feedback already submitted stays in your project and is readable in the console and the CLI.

Accounts currently have limits on the number of projects, the number of stored feedback items and how long feedback history is retained. These limits are visible in the console and will change as the product matures.

Account data

Signing in uses an email address and a one-time code. Shiproom stores the email address to identify the account and to send those codes. Session and device credentials are stored as hashes, never in plain text, and signing out revokes them on the server rather than only clearing them locally.

This website

This marketing site is a set of static files and loads its fonts from its own origin. Analytics are compiled in at build time. At least one analytics provider is configured for this build. Without a configured provider, the related scripts and network requests are absent. Whichever providers are configured, none of them runs anywhere but the canonical shiproom.live address: not on localhost, not on a preview build, not under an automated browser, and not through a Shiproom reviewer link.

Umami

This website's own visitor measurement is Umami, running on a server Shiproom operates rather than on an advertising network. It is the site's fixed analytics provider; its public script URL and website id are kept in source code rather than deploy environment variables.

• No cookies and no browser storage. Umami is cookieless by design, so there is no consent banner because there is nothing to consent to.
• No personal data, no cross-site tracking, no advertising identifiers, and no profile of you.
• No session recording and no heatmaps. Nobody replays your visit.
• Do Not Track is honoured. The tag is configured to respect it, and the loader additionally refuses to run when your browser sends Do Not Track or Global Privacy Control.
• Only the canonical production host. The script is not requested at all anywhere else.

What it records is the aggregate shape of a visit: page path, referrer, and coarse browser, device and country information derived from the request. Alongside those, this site sends the same short, fixed event names listed below — which link or call to action was followed, whether the review prompt or the CLI command was copied, which demonstration step or export format was chosen, which FAQ answer was opened, and how far down the page a visit reached. Each carries at most a short fixed label chosen from a list in this site's own source. None of them carries feedback content, form input, email addresses, tokens, or anything you typed.

PostHog

A valid public PostHog key is configured for this build. PostHog uses the smallest footprint that still answers whether the page works:

• No cookies. Analytics state is held in memory and does not survive the tab.
• No session recording and no heatmaps. Nobody replays your visit.
• No autocapture. Only the handful of events listed below are recorded, each one declared in the code. Nothing is collected because it happened to be clicked.
• No profile. No person record is created, so there is nothing to link visits to.
• Only the canonical production host. Analytics does not run on localhost, 127.0.0.1, previews, automated tests, or a Shiproom reviewer link.
• Do Not Track and Global Privacy Control are honoured. If your browser sends either signal, no PostHog code is loaded at all.

The events are: which link or call to action was followed, whether the review prompt or the CLI command was copied, which demonstration step and export format were chosen, journey-step and section views, which FAQ entry was opened, and whether a documentation, npm or email link was followed. Each carries at most a short fixed label or section name. Event properties exclude feedback content, form input, visitor tokens, project and feedback identifiers, and URLs with sensitive identifiers. The required technical fields are PostHog's public project token and an SDK-generated anonymous distinct_id. The identifier is held in memory only, creates no profile and is discarded with the page; no persistent visitor identifier is attached.

Google Analytics

This marketing website uses Google Analytics 4 for aggregate website and product-marketing usage measurement. A Measurement ID was supplied at build time, so the Google tag loads asynchronously from Google's servers. Google Analytics may set or read cookies according to Google's own product behaviour; this overview does not claim that GA is cookieless.

Shiproom configures a small set of custom events for marketing CTAs and CLI command copies. Those events carry only short fixed identifiers: a CTA name, its location, a destination type, a command name, the type of page it happened on, and — on a comparison page — which competitor that page is about. Every one of those values is chosen from a fixed list in this site's own source. They do not send feedback content, reviewer comments, email addresses, access tokens, screenshots, source code, search terms, or anything a visitor typed.

Questions

Write to [email protected]. The security overview covers how credentials and access are handled.