Who we are
This site is run by ShipWithAI.
Privacy questions and requests: hello@shipwithai.io
When you read this site
Every page loads a few third-party services:
- Vercel hosts the site. It receives every request, including your IP address.
- Google Tag Manager loads Google Analytics on every page. Google Analytics sets cookies and receives your IP address, browser details, the pages you visit and site events (for example a survey answer, never its comment). There is no cookie banner on this site today.
- Fonts load from Google Fonts, so your browser sends its IP address to Google.
- Sentry receives error reports from your browser and our server. Sending personal data by default is turned off, and session replay is off.
- Our own cookie: when you add a reaction, we set a random id cookie (swa_rid) for one year so the same reaction is not counted twice. Your browser also keeps in local storage your theme, a random session id, your reading level if you pick one, which reactions and surveys you already sent, and your toolkit favourites.
Reactions, surveys and the newsletter
- Reactions and surveys on posts are saved in our database (Neon): the post, the language, your answer, an optional comment (up to 500 characters), and a random session id kept in your browser. We keep them for 24 months, then delete them.
- The newsletter form sends your email address straight to Kit, our email tool, because you ask us to send you the newsletter (consent). Every email has an unsubscribe link. Your email stays in Kit until you ask us to delete it; unsubscribing stops the emails.
Harness Teardown: free check
Your files stay on our hosting. No AI provider sees them. We keep nothing after the result is shown.
To limit runs per day, we count runs per visitor. The count is keyed by a hash of your IP address (made with a secret key that changes the hash every day), never the IP itself. The counter is kept in Upstash and expires after 26 hours.
Harness Teardown: deep analysis
Nothing is sent until you press the deep analysis button.
We send the files you selected — the list is shown before you send — to Anthropic’s Claude API to analyse them. Anthropic processes them as our data processor under its Data Processing Addendum and does not use them to train its models. We keep nothing after the result is shown. Anthropic deletes its copy within 30 days; up to 2 years if its automated safety systems flag it; longer if the law requires.
Do not paste secrets. If you did, rotate them.
AI analysis can be wrong. Check each finding before you act.
Deep analysis is not available to visitors in the EU/EEA, the UK or Switzerland. We read the country Vercel detects for your request to check this; we do not store it.
Before a deep analysis runs, Cloudflare Turnstile checks a one-time bot-check token. Our server sends Cloudflare only that token — not your files and not your IP address. In your browser, Cloudflare Turnstile reads signals such as your IP address, a TLS fingerprint and your browser’s user agent, to detect bots. Cloudflare says it does not use them to identify, profile or target you; it also uses them to improve its bot detection. Turnstile does not read what you type on the page.
Spend and attempt counters are keyed by the same daily IP hash, kept in Upstash, and expire after 26 hours.
Harness Teardown: paid check
- Polar Software Inc. is the merchant of record. You pay on Polar’s checkout. Your card details never reach us.
- Polar sends us the order. We store only: the order id, the license id, the license status, a test-mode flag, the expiry date, the number of paid runs used, and a hash of your license key. We do not store your email, your name or your license key. We keep these records while your license is valid and for 24 months after it stops being valid, then delete them.
- Polar shares your email with us for that one order; we pass it to Kit, our email tool, with a “teardown-buyer” tag, and do not keep it. We do this to send you product updates about what you bought (our legitimate interest in keeping customers informed). Every email has an unsubscribe link. Your email stays in Kit until you ask us to delete it.
- When you enter your license key, we look it up by its hash. If we have no record of it yet, we send the key to Polar to check it. Daily use is counted by the key hash (expires after 26 hours); failed key checks are counted by the daily IP hash (expires after about an hour). Both counters are in Upstash.
- The paid check sends the files you selected — the list is shown before you send — to Anthropic in the same way as the deep analysis above, and has the same region limits.
Sub-processors
These companies process data for us. “Being confirmed” means we are still checking the data processing agreement and the transfer basis with that company.
| Company | What they do for us | Data they receive | DPA and transfers |
|---|---|---|---|
| Vercel | Hosting and server functions for the whole site | Every request, including IP address and, in transit, the files you send | Being confirmed |
| Upstash | Redis for rate-limit, spend and run counters | Daily IP hashes, license key hashes, Polar order ids (to avoid adding a buyer to Kit twice, kept 30 days) | Upstash’s DPA is part of its terms. Transfers: EU-US Data Privacy Framework, with EU Standard Contractual Clauses as fallback. |
| Neon | Postgres database | License records (no email), reactions and surveys | Neon’s platform terms include the Databricks DPA. Transfers: EU Standard Contractual Clauses and the UK Addendum. |
| Sentry | Error monitoring | Error reports and performance traces, without the files you send | Being confirmed |
| Google Tag Manager, Google Analytics, Google Fonts | IP address, cookie id, browser details, pages visited and site events | Being confirmed | |
| Anthropic | AI analysis for the deep analysis and the paid check | The files you selected — shown to you before you send — only after you press the button | Anthropic's Data Processing Addendum is incorporated by reference into its Commercial Terms of Service. Anthropic is our processor and we are the controller. EU Standard Contractual Clauses plus a UK Addendum and a Swiss addendum are incorporated. Anthropic uses its own sub-processors, listed at https://www.anthropic.com/subprocessors. |
| Cloudflare | Turnstile bot check before a deep analysis | A one-time bot-check token | Cloudflare’s DPA is part of its terms. Transfers: EU-US Data Privacy Framework, with EU Standard Contractual Clauses as fallback. |
| Polar Software Inc. | Merchant of record: checkout, payment and license keys | Order, payment and billing details, email, license key | Polar Software Inc.’s DPA (Data Processing Agreement) is part of its terms. Transfers: EU Standard Contractual Clauses. Polar also keeps payment and tax records for its own legal duties. |
| Kit | Email: newsletter and buyer updates | Email address and tags (for example “teardown-buyer”) | Being confirmed |
Your choices and requests
To ask what we hold about you, or to have it deleted, email us at hello@shipwithai.io. We answer within 30 days (one month). If you bought a license, include your Polar order id from your receipt — we do not store your email in our database, so this is how we find your record.
Why we use your data: to run the paid check you bought (contract); to run the free check and the deep analysis you ask for, to limit abuse with counters and the bot check, to fix errors and to understand how the site is used (our legitimate interest in running and protecting the service); to send the newsletter you signed up for (consent); and to send buyers product updates (legitimate interest). Some of these companies are outside your country; where a company’s own data processing agreement names a transfer basis, the table above shows it.
Children
This site is for developers and is not directed at children. Harness Teardown is not meant for anyone under 18. If you are under 18, do not use the deep analysis or the paid check.
Changes to this page
When we change this page, we update the “Last updated” date at the top. For important changes, we also add a short note on this page. Anthropic lists its own sub-processors, and changes to them, at https://www.anthropic.com/subprocessors.