PRIVACY POLICY
1. Who we are
Shippin is operated by Friskly AB, org.nr 559500-7526, Skogsvägen 9, 141 44 Huddinge, Sweden — the data controller for the personal data described in this policy. For any privacy question or to exercise the rights described below, contact us at [email protected] — we acknowledge data-subject requests within one business day.
2. Data we collect
We collect the following categories of personal data when you use Shippin:
- Account data: email, username, display name, bio, avatar, date of birth (used only for age verification)
- Payment data: if you subscribe to Shippin+, your subscription status and a Stripe customer reference. Card details are entered with Stripe directly and never reach our servers.
- Profile data: social links (website, X, GitHub), status, preferences
- Content data: posts, comments, reactions, products you create, media you upload
- Usage data: pages visited, features used, interactions
- Technical data: IP address (hashed in the consent log), browser, device info
- Consent records: what you agreed to, when, from where (in the
consent_logtable)
3. How we use your data and the lawful basis under GDPR
Under GDPR Art. 6, we identify a specific lawful basis for every processing purpose. The table below maps each purpose to the basis we rely on:
| Purpose | Lawful basis |
|---|---|
| Operating the platform (account, profile, posts, products) | Art. 6(1)(b) — necessary for the contract with you |
| Security, abuse prevention, content moderation | Art. 6(1)(f) — legitimate interest in keeping the platform safe |
| Marketing email (product updates, announcements) | Art. 6(1)(a) — your explicit consent |
| Analytics cookies | Art. 6(1)(a) — your explicit consent |
| CSAM hash matching (Microsoft PhotoDNA) | Art. 6(1)(c) Legal Obligation + Art. 6(1)(f) Legitimate Interest |
4. Sub-processors
We do not sell your personal data. To deliver the service we rely on the following sub-processors. They process personal data on our behalf under contractual data-processing terms (GDPR Art. 28). Where data leaves the EEA, the transfer is covered by Standard Contractual Clauses (SCCs) and, where applicable, by the EU-US Data Privacy Framework (DPF):
| Processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Supabase | Database, authentication, storage, edge functions | Frankfurt (dev) / Ireland (prod) — EU | N/A (EU) |
| Resend | Transactional and digest email delivery | United States | SCCs + EU-US Data Privacy Framework |
| Sentry | Error monitoring | Frankfurt — EU | EU residency; SCCs for vendor support |
| Stripe | Payments (Shippin+ subscriptions) | Ireland (EU controller) with US sub-processors | SCCs + EU-US Data Privacy Framework |
| Railway | Application hosting | Amsterdam — EU | EU residency; SCCs for vendor support |
| Plausible | Privacy-respecting analytics (consent-gated) | Germany — EU | N/A (EU) |
| Sight Engine | Automated content moderation (NSFW, violence, weapons) | France — EU | N/A (EU) |
| Microsoft PhotoDNA | CSAM hash matching | United States (Azure) | SCCs + EU-US Data Privacy Framework |
| Google Fonts | Web font delivery (CDN) | United States | SCCs + EU-US Data Privacy Framework |
Other users see your public profile, posts, and products — that is part of the platform's purpose. We will disclose data to law-enforcement authorities only when required by a lawful order.
5. International transfers
Personal data may be processed outside the EEA by the US-based sub-processors listed above. Each transfer relies on (a) the EU Commission's Standard Contractual Clauses (2021/914), and (b) the EU-US Data Privacy Framework where the recipient is certified under it. We rely on adequacy decisions where they apply. Copies of the SCCs are available on request at [email protected].
6. Your rights under GDPR
You have the right to:
- Access: request a copy of your personal data
- Portability: download your data in a machine-readable format (JSON)
- Rectification: correct inaccurate data via your Settings page
- Erasure: delete your account and all associated data
- Restrict processing: limit how we use your data
- Object to processing: where the basis is legitimate interest
- Withdraw consent: revoke marketing or analytics consent at any time from Settings
The fastest path to access (export) or erasure (delete account) is the in-app Settings flow. You can also email [email protected] — we acknowledge within one business day and complete the request within one month, as required by Art. 12(3).
You also have the right to lodge a complaint with your local data-protection authority.
7. Cookies
We use three categories of cookies:
- Essential: authentication, session management, security. Cannot be disabled.
- Analytics: understanding usage patterns. Loaded only with your consent (Art. 6(1)(a)).
- Marketing: measuring campaign effectiveness. Loaded only with your consent.
You can manage your cookie preferences at any time via the cookie banner or Settings.
8. Retention
We retain data only as long as we need to:
| Category | Retention period |
|---|---|
| Account data (profile, posts, products, follows) | For the lifetime of the active account, plus 30 days after deletion |
| Deletion logs (data_deletion_requests) | 3 years from the request, for compliance audit |
| CSAM evidence (csam_reports + quarantine storage bucket) | 7 years, aligned to criminal-investigation evidence preservation norms |
| Consent log (consent_log) | For the lifetime of the account, plus 3 years |
Anonymised, aggregated usage statistics may be retained indefinitely because they no longer relate to an identifiable person.
9. Data security
We protect your data with:
- Encryption in transit (TLS / HTTPS)
- Encryption at rest (Supabase managed Postgres + Storage)
- Row-level security policies enforcing per-user access controls
- Service-role isolation for sensitive tables (audit log, CSAM evidence, consent log)
10. Children and minor safety
Shippin requires you to be at least 18 years old. We do not knowingly collect personal data from anyone under 18. If you believe an account belongs to a minor, please report it via the in-app Report menu on the user's profile (reason: "User appears to be under 18"). Reports route to our trust & safety queue and are reviewed within 24 hours. You can also email [email protected].
Date of birth is collected only to confirm you are 18 or over. Once set, it cannot be changed in-app — this is enforced at the database level to prevent age-gate circumvention.
11. Changes to this policy
We may update this policy. When we make a material change, we will bump the policy version and re-prompt logged-in users to accept it before they can continue using the service. Continued use after an update constitutes acceptance of the new policy.
12. Contact
Privacy questions: [email protected]
Data-subject requests (Art. 12-22): [email protected]
Trust & safety reports: [email protected]