Privacy Policy

Last updated: 15 September 2026

What ShipGate processes

Repository scans. ShipGate fetches metadata and a small number of files (workflows, manifests, security policy, README) from the GitHub repository you specify, evaluates them in memory, and returns the result to your browser. Repository contents are processed transiently to produce the gate result and are not retained after the scan completes.

Artifact scans (OSS licence gate and MPL evidence report). When you name a package or a release, ShipGate downloads that published artifact — an npm tarball from the npm registry, or a release asset from GitHub — and opens it in memory to inspect what it contains. Nothing is executed, nothing is written to disk, and the artifact bytes are discarded when the report is returned. The OSS gate may additionally fetch a component's LICENSE or NOTICE file from the unpkg CDN to check notice text. These artifacts are public packages, not your private code; the only thing you send us is the package name and version you asked about.

What ShipGate stores

• Gate receipts — a short record of a scan (repository or package name, commit or artifact hash, ruleset, counts, timestamp). Receipts are held in server memory only, capped at the 500 most recent, and are lost on redeploy. They are never written to disk or to any database.
• Answers and evidence — your onboarding answers and evidence notes are stored in your own browser (localStorage), not on our servers.
• GitHub tokens — never stored. A token you provide is kept in your browser's session storage and sent only with your scan or fix-PR requests, where it is used for the GitHub API calls of that request and then discarded.

What ShipGate does not do

• No accounts, no tracking cookies, no analytics scripts, no advertising.
• No sale or sharing of any data with third parties.
• No retention of repository source code.

Third parties

Depending on what you scan, ShipGate makes outbound requests to:

• GitHub — the API, raw file content, and release-asset downloads, for repository scans and release witnessing (subject to GitHub's privacy statement).
• npm registry (registry.npmjs.org) — package metadata and published tarballs, for the OSS licence gate and the MPL evidence report (subject to npm's privacy policy).
• unpkg (unpkg.com) — component LICENSE/NOTICE files during an OSS repository scan.

The service is hosted on Railway (subject to Railway's privacy policy), whose infrastructure logs standard request metadata (IP addresses, timestamps) for operations. ShipGate itself additionally keeps a short-lived in-memory count of recent requests per client address, solely to rate limit the endpoints that download remote artifacts; it is not persisted and not used for any other purpose.

Contact

Privacy questions: support@ermaz.app — ShipGate is operated by Ermaz LLC.