Privacy Policy

This policy explains what typeship inc ("typeship", "we", "us") collects when you use typeship.dev, the console, the typeship API, CLI, and MCP server, and the endpoints we host for you (together, the "Service"), and what we do with it.

The short version: we collect what we need to run an account and generate your packages, we don't sell it, we don't use it for advertising, we don't train models on it, and we use only the cookies needed to keep you signed in.

What we collect

Account. When you sign up we get your name, email address, and profile picture, from you or from the sign-in provider you pick (GitHub or Google). Passwords are handled by our sign-in provider, Clerk, and stored hashed; we never see them. We also store your organization's name, members, roles, and plan.

Billing. Paid plans are billed by Polar, our merchant of record. Polar collects your payment details, billing address, and tax information directly. We receive the plan, the billing email, and confirmation that a subscription is active, never your full card number.

Projects and content. Project names and settings, where each Spec comes from (a URL or a GitHub repository and path), spec patches, package names, destinations, the Specs themselves, the packages we generate, and pull request contents. While the CLI's webhooks listen relay is running, the webhook deliveries it forwards pass through our servers. If your Specs or webhooks contain personal information about other people, we process it only on your behalf and your own privacy notice applies to it.

The free generator. A Spec you paste into typeship.dev or point us to is sent to our servers, turned into a package in memory, and returned to you. We don't store free-generator Specs or their output; we keep only the request log below and a per-IP rate-limit counter.

Logs and usage. Our servers log requests to the website, console, API, CLI, and hosted endpoints: the time, IP address, user agent, the key or session involved, the status, and any errors. We count generations, tool calls, and rate-limit hits per organization or project. We use Vercel Web Analytics to count page views; it sets no cookies and doesn't track you across sites.

From GitHub. When you install the typeship GitHub App, GitHub tells us the installing account and the repositories you selected. We use that access only to read Spec files and write the generated files and pull requests you've configured.

Messages. Anything you send us by email or through docs feedback.

We don't knowingly collect sensitive personal information, precise location, or information from children under 18. Please keep such things out of Specs, payloads, and messages.

How we use it

• To run the Service: accounts, generations, pull requests, hosted endpoints, the webhook relay, billing, and support.
• To keep it working: monitoring, debugging, and understanding which features are used.
• To talk to you about the Service: sign-in codes, billing notices, regeneration results, security alerts, and changes to our terms. Product announcements only if you opt in, and you can unsubscribe any time.
• To enforce limits and prevent abuse.
• To comply with the law.

We don't sell personal information, use it for targeted advertising, or use your content or generated code to train machine-learning models.

Who we share it with

Companies that process data for us, under contracts that limit what they can do with it:

Members of your organization can see your name, email, avatar, and what you did in that organization, such as which projects or keys you created. When you configure a destination, the generated files are published to the repository or registry you chose, with whatever visibility that service gives them.

We'll disclose information if the law requires it, to enforce our terms, or to protect the safety or rights of typeship, our customers, or others. If typeship is acquired or merges, your information may go with it; we'll tell you if that changes how it's handled.

Cookies

We use only essential cookies, so there's no cookie banner.

The site also uses browser storage for interface preferences such as docs search history. There are no analytics, advertising, or tracking cookies. You can clear or block cookies in your browser; blocking the Clerk cookies means you can't stay signed in. We don't sell or share data, so Do Not Track and Global Privacy Control signals don't change anything, though we honor them where the law requires.

How long we keep it

Account and organization data until you delete your account or organization. Projects, Specs, and generated packages until the project or organization is deleted. Webhook relay events are deleted 24 hours after we receive them, and relay sessions after 48 hours idle. CLI sign-in and claim tokens expire on their own. Request logs and usage counters are kept for a limited period for security, debugging, and billing. Billing records as long as tax law requires. We may keep things longer to resolve disputes or comply with the law.

Your rights and choices

You can see and edit your profile, organization, projects, and keys in the console, download your Specs and packages, and delete projects, keys, your organization (as an admin), or your account. You can revoke typeship's access in your GitHub or Google settings and uninstall the GitHub App at any time; that stops future access but doesn't delete what we already have, so delete the project or organization for that.

Depending on where you live, you may also have the right to ask for access to, correction of, deletion of, or a portable copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to appeal a decision we make about a request. We don't discriminate against anyone for exercising these rights. To make a request, contact us from the email address on your account.

United States. If you live in a state with a comprehensive privacy law (California, Colorado, Connecticut, Virginia, Texas, Oregon, and others), the rights above apply to you to the extent that law covers us. We don't sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising or profiling with significant effects, and haven't in the past 12 months. The categories we collect are identifiers, commercial information, internet activity, and professional information, for the purposes and recipients described above.

Europe (EEA, UK, Switzerland). typeship inc is the controller of the information described here, except information inside your content, for which you're the controller and we're a processor. We process your information to perform our contract with you; for our legitimate interests in keeping the Service secure, working, and improving, in ways that don't override your rights; to comply with legal obligations; and, for product announcements, with your consent. We don't make automated decisions with legal or similarly significant effects. You can complain to your local data protection authority (in the UK, the ICO). Your information is processed in the United States; where required we rely on the EU-U.S. Data Privacy Framework for providers certified under it and the European Commission's Standard Contractual Clauses otherwise. Ask us for a copy of the safeguards if you need one. We haven't appointed an Article 27 representative.

Security

Traffic is encrypted in transit, data is encrypted at rest by our hosting providers, API keys and passwords are stored hashed, access is scoped to your organization, and we keep our own access to production to a minimum. No system is perfectly secure, and we can't guarantee the security of information sent to us.

Where it's processed

typeship is in the United States and so are our providers. If you use the Service from elsewhere, your information is transferred to and processed in the United States.

Changes

We'll update this page when our practices change and update the date at the top. For material changes we'll email you or post a notice in the console first.

Contact

typeship inc.