Privacy
This template describes the Ship It Checklist site at shipitchecklist.com. It is written for UK GDPR. Adjust it if you operate somewhere else.
Who we are
The controller is [TRADING NAME], of [REGISTERED ADDRESS]. Contact: [CONTACT EMAIL]. There is no data protection officer unless you add one here after you appoint one.
What this site collects
- Email address, if you submit the newsletter form.
- The form location, such as the homepage or the newsletter page, and the time you submitted it.
- A hash of the connecting IP address, kept for up to an hour, to limit repeated form posts. The subscriber record does not store the IP address.
- Checklist ticks, stored in your browser's local storage. They are not sent to the server.
- If you request a sponsored slot: the tool name, https URL, https logo URL, description of up to 140 characters, email address, chosen category, and the time.
- If that request reaches Stripe: a Checkout session id, a subscription id, the amount in pence, and the status of the row. Card numbers stay with Stripe. They are not stored here.
- If you buy the AI-Ready Pack: the email address, the amount in pence, a Checkout session id, the time, and the signed download path with its expiry. The zip is not public. Card numbers stay with Stripe.
- If you buy checklist access: the email address, the amount in pence, a Checkout session id, the time, and an access token. A one-time restore link is stored as a hash, with an expiry. The cookie in your browser holds the access token. Card numbers stay with Stripe.
The newsletter form does not send email yet. confirmed_at stays empty until a confirmation step exists. Do not describe a confirmation email as if it is already sent.
Why
The email is stored because you asked to hear about checklist updates. The legal basis to record is consent. You can ask for deletion. Rate-limit hashes are kept so the form can refuse bursts of posts. The legal basis for that short-lived hash is legitimate interest in keeping the form available.
Where it is stored
Newsletter rows sit in Cloudflare D1. Rate-limit keys sit in Cloudflare KV. The site is hosted on Cloudflare Workers. Cloudflare processes connection data to deliver the site. Read Cloudflare's privacy policy for that processing: cloudflare.com/privacypolicy.
There is no analytics cookie in this version, and no advertising cookie. A paid checklist sets an httpOnly cookie so this browser can open the paid checks. If you add Cloudflare Web Analytics or another tracker later, update this page first.
How long
Email addresses are kept until you ask for deletion, or until you unsubscribe once sending exists. A pack order, including the email and the download path, is kept until you ask for deletion. The download link itself stops working at the expiry stored on the order. A checklist payment, including the email and the access token, is kept until you ask for deletion. The access does not expire on its own. A restore link hash expires after one hour. Rate-limit keys expire within an hour. Local checklist ticks stay until you clear them or clear site data.
Sharing
We do not sell the newsletter list. Resend receives an address when a checklist restore link is actually sent. Newsletter confirmation is still not sent, and the pack download email is still not sent. A payment is handled by Stripe. The site stores the booking details above, not the card. Read Stripe's privacy policy for the payment step: stripe.com/privacy.
Your rights
If UK GDPR applies, you can ask for a copy of the email we hold, ask us to correct it, ask us to delete it, and object to or restrict some uses. You can also complain to the Information Commissioner's Office. Requests go to [CONTACT EMAIL]. The contact address is still a placeholder, so do not launch the form to the public until a real inbox exists.
Children
The site is written for adults building apps. It is not aimed at children.