Privacy Policy

1. Introduction

This Privacy Policy explains how PE "Klimenko Iurii"(the “Controller”, “we”) collects, uses, and protects your personal data when you use Ship shot(the “Service”) — a web application for turning your screenshots into product-ready images, available at ship-shot.com.

2. Data we collect

We collect only what is necessary to operate the Service:

• Account data— your email address and a hashed password, processed by Supabase Auth. If you use “Continue with GitHub”, we additionally receive your GitHub account id and the public profile data returned by GitHub.
• Profile metadata— your plan (free or creator) and, after purchase, a Paddle customer identifier used to reconcile billing.
• Uploaded screenshots and rendered exports— when you upload a screenshot or save an export, the file is stored in a private Supabase Storage bucket under a path scoped to your account ({account id}/{generation id}/…). Access is restricted to your account via row-level security, and the download links we issue expire after five minutes.
• Generation metadata— the variant you chose, size preset, scale, settings you configured, and timestamps.
• Payment data— transaction history and plan status received from Paddle. Full card details are processed by Paddle as the Merchant of Record and never touch our servers.
• Technical logs— standard access logs produced by our hosting providers (Vercel, Supabase), used for debugging and abuse prevention.
• Product analytics— anonymous usage events (e.g. “screenshot uploaded”, “template switched”, “export downloaded”) recorded to understand where users drop off in the flow. We store these events in two places: in our own Supabase database (no email, no uploaded file content, no password), and in Yandex.Metrika (counter 108738562) with click maps and session replay (Webvisor) enabled. An anonymous identifier is written to your browser in a cookie (ss_aid, lifetime one year); when you sign in we link that identifier to your account so we can analyse the full funnel.

We do not use advertising cookies or tracking pixels.

3. Purpose of processing

We use the data above solely to:

• render and deliver the image you requested;
• manage your account, plan status, and billing;
• provide technical support;
• detect abuse and protect the Service;
• improve Ship shot’s reliability and quality.

We send only transactional messages (email confirmation, payment receipts, security notices). We do not send marketing emails and do not share your email with third parties for marketing purposes.

4. Data retention and storage

4.1. Screenshots and exports. Uploaded screenshots and rendered exports remain in your private storage folder until you delete them through the Service or until you request account deletion. We do not use your content to train models, improve variants, or share it with third parties.

4.2. Account and billing records.We retain your account data and payment history for as long as your account is active or as required by law. You may request account deletion at any time; we fulfil deletion requests within 30 days, except where retention is required by applicable law (e.g. tax records).

4.3. Technical logs.Hosting logs are retained only for the period defined by our providers’ default settings and are used for operational purposes.

5. Data sharing

We do not sell your personal data. We disclose data only to trusted providers who help us operate the Service and are bound by confidentiality and data-protection obligations:

• Supabase— authentication, database, and file storage;
• Paddle.com— payment processing (Merchant of Record);
• Vercel— hosting and content delivery;
• Yandex.Metrika— product analytics and session replay (clicks, navigation, form interactions). Uploaded screenshots and any content you type into editor fields are excluded from session replay.

We may additionally disclose data when required by law, a court order, or to protect the rights and safety of our users and the Service.

6. Your rights

Under applicable data-protection laws, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data (“right to be forgotten”);
• withdraw your consent to processing at any time.

To exercise these rights, contact us at nmamizerov@gmail.com or via Telegram @nmamizerov.

7. Applicable law

This Privacy Policy is governed by the laws of the Republic of Armenia.

8. Contact details