Privacy

Shipped with Love is run by Oddly Serious Inc., a company registered in Ontario, Canada. We’re responsible for the personal information described here.

On a founder’s site, the founder decides what to publish and what to send their subscribers; we store it and deliver it for them, under this policy.

You, the founder

Email, name, your site and products, sign-in details (passkeys), the IP address on account actions (for security), and Stripe’s payment record — never your card number

Why: To run your account and site

Visitors to sites

Daily counts only — pages, referrers, clicks. Counting uses no cookies and keeps no IP addresses. Like any site with forms, a short-lived security session (IP address and browser) exists for up to 2 hours.

Why: So founders see what’s working

Subscribers

Email, optional name, what they chose to hear about, and their consent record (with a scrambled — hashed — IP address, so it can’t be read back)

Why: To send what they asked for, and prove it

If you sign in with GitHub or Google, they send us your name, email address and account ID. From sources you connect — GitHub, release feeds, changelog pages, the App Store — we read release information about your products. When you write to us, we keep the conversation so we can help.

• to run your account and publish the site you build;
• to send emails you asked for or approved — sign-in links, confirmations and founders’ launch emails;
• to keep accounts safe and stop abuse, like fake sign-ups and spam;
• to take payment, refund it, and keep the records tax law requires;
• to answer you when you write to us, and fix things that break.

We use subscribers’ addresses because they consented, and founders’ information because we need it to provide what they signed up for or to keep the service secure. We don’t sell or rent personal information, use it for advertising, or build profiles of anyone.

Only the services that run Shipped with Love, each for one job, and never for their own marketing:

1. Stripe payments (USA)
2. Resend account and confirmation email (USA)
3. Amazon Web Services sending email to subscribers (USA)
4. Cloudflare custom domains, security and file storage (USA)
5. Laravel Cloud servers and database (USA)
6. Sentry error reports, with personal data stripped (USA)

Some of them are in the United States, so your information may be stored or processed outside Canada, where their local laws apply; each is bound by contract to protect it. Cloudflare and our host see IP addresses as part of delivering pages and blocking attacks, and keep short-lived logs of their own. Beyond these, we share information only when the law requires it.

Shipped with Love sets only cookies it needs to work:

• a session cookie, which keeps you signed in and holds a short-lived session on pages with forms;
• a form-safety cookie (CSRF), which stops other sites submitting forms as you;
• a “remember me” cookie for founders, which keeps you signed in on that device until you sign out.

No analytics cookies, no advertising cookies, no third-party trackers. Visitor counts on founder sites use no cookies at all: a repeat visit on the same day is recognised by a scrambled code that we throw away every night, so no one can be followed from one day to the next.

• Your account — while it exists. Delete it and your site, products, pages, uploads and subscribers go straight away.
• Purchase records — kept for 7 years after payment for tax law, with your name and email removed once your account is deleted.
• Security sessions — up to 2 hours after your last visit.
• Sign-ups that are never confirmed — deleted after 7 days.
• Subscribers — until they unsubscribe from everything or the founder removes them. After unsubscribing, we keep the address and consent record so we never email it again by mistake; ask us and we’ll erase it.
• Visitor counts — daily totals with no personal information, while the founder’s account exists.

Deleted information can stay in encrypted backups for a limited time until they’re replaced.

Wherever you live, you can ask to see the personal information we hold about you, correct it, take a copy, or have it deleted, and you can withdraw consent at any time. Founders can export everything and delete their account from Settings; subscribers can change or stop what they get from the link in any email.

For anything else, write to privacy@shippedwith.love. We answer within 30 days. If you’re unhappy with our answer, you can complain to the Office of the Privacy Commissioner of Canada or to the data protection authority where you live.

When you subscribe on a founder’s site, the founder decides what to send and we deliver it. They see how many people follow and a masked version of each address — never your full email. Every email has a one-click way out, and your consent record shows exactly what you agreed to and when.

If the founder removes you or deletes their account, your address is erased.

Shipped with Love isn’t meant for anyone under 16. If you believe a child has given us personal information, email privacy@shippedwith.love and we’ll delete it.

When this policy changes, the new version appears here with a new version number and date. If a change is significant, we email account holders before it takes effect.

Write to privacy@shippedwith.love — it reaches a person, not a form. Shipped with Love is run by Oddly Serious Inc., Ontario, Canada.