What Shiproom collects, and what it does not

Your application

Shiproom does not host your application and does not receive a copy of it. Your app runs where it already runs, usually on your own machine. When a reviewer opens the review link, Shiproom forwards that HTTP request to your running application and returns the response, injecting the review widget into HTML responses so the reviewer has something to comment with.

Shiproom does not connect to your Git host, read source code, inspect Git metadata, readpackage.json to identify a project, or require a source-code upload to start a review. It does not write into your project directory.

What a feedback report contains

When a reviewer submits feedback, the report can include:

• The route and page title of the page they were on
• A screenshot of that page as they saw it
• The geometry of each mark they made, stored relative to the page rather than in pixels
• Metadata about the elements they selected: tag, id, classes, accessible name, ARIA role, CSS path, and position and size
• Viewport size, device type, browser and operating system
• The timestamp and the reviewer's session
• The category they chose and the comment they wrote
• Failed HTTP requests and JavaScript errors recorded shortly before they submitted, as described below

What is never collected

The technical capture is deliberately narrow. When the widget records a failed request it keeps the method, a sanitised path, the status code, the duration and the timestamp. It does not keep:

• Request or response bodies
• Request or response headers
• Cookies or Authorization values
• Its own traffic, so the widget never reports on itself

Query-string values under keys such as token, key,secret, password, code, auth andsession are redacted before anything is stored. Element metadata describes an element's identity and position, never the value a user typed into it.

Who can see a review

A project is private when it is created. Only someone holding an invite link can open the reviewer URL. Invite links can be created per person, rotated, or revoked, and rotating a link ends the previous one immediately.

A project can be switched to public, in which case anyone with the URL can open it and leave feedback. The CLI asks you to confirm before making that change.

How long things last

The review link serves your application only while your session is running and the app is reachable. When you stop the session, reviewers see an offline page. Feedback already submitted stays in your project and is readable in the console and the CLI.

Accounts currently have limits on the number of projects, the number of stored feedback items and how long feedback history is retained. These limits are visible in the console and will change as the product matures.

Account data

Signing in uses an email address and a one-time code. Shiproom stores the email address to identify the account and to send those codes. Session and device credentials are stored as hashes, never in plain text, and signing out revokes them on the server rather than only clearing them locally.

This website

This marketing site is a set of static files and loads its fonts from its own origin. Analytics are compiled in at build time. At least one analytics provider is configured for this build. Without a configured provider, the related scripts and network requests are absent. Whichever providers are configured, none of them runs anywhere but the canonical shiproom.live address: not on localhost, not on a preview build, not under an automated browser, and not through a Shiproom reviewer link.

Umami

This website's own visitor measurement is Umami, running on a server Shiproom operates rather than on an advertising network. It is the site's fixed analytics provider; its public script URL and website id are kept in source code rather than deploy environment variables.

• No cookies and no browser storage. Umami is cookieless by design, so there is no consent banner because there is nothing to consent to.
• No personal data, no cross-site tracking, no advertising identifiers, and no profile of you.
• No session recording and no heatmaps. Nobody replays your visit.
• Do Not Track is honoured. The tag is configured to respect it, and the loader additionally refuses to run when your browser sends Do Not Track or Global Privacy Control.
• Only the canonical production host. The script is not requested at all anywhere else.

What it records is the aggregate shape of a visit: page path, referrer, and coarse browser, device and country information derived from the request. Alongside those, this site sends the same short, fixed event names listed below: which link or call to action was followed, whether the review prompt or the CLI command was copied, which demonstration step or export format was chosen, which FAQ answer was opened, and how far down the page a visit reached. Each carries at most a short fixed label chosen from a list in this site's own source. None of them carries feedback content, form input, email addresses, tokens, or anything you typed.

PostHog is available as an optional marketing analytics integration. No valid public PostHog key is configured for this build, so the PostHog loader, SDK and network requests are absent.

Google Analytics 4 is available as an optional marketing analytics integration. No valid PUBLIC_GA_MEASUREMENT_ID is configured for this build, so no Google Analytics scripts are emitted.

Questions

Write to hello@shiproom.live. The security overview covers how credentials and access are handled.