Legal

Privacy Policy

ShipWright processes repository metadata, pull request metadata, diffs, check results, logs, and generated release recommendations for repositories where the GitHub App is installed.

ShipWright uses this data to run pull request verification and publish check runs and comments back to GitHub. Hosted workers delete temporary repository checkouts after each run. Run metadata and redacted evidence may be retained for audit, support, abuse prevention, and reliability.

Customers can request deletion from the setup page, or an operator can action the request by calling the hosted POST /installations/{installation_id}/delete-data endpoint. That endpoint is operator-only: it requires the SHIPWRIGHT_OPERATOR_TOKEN shared secret as an Authorization: Bearer header, and is disabled outright when no token is configured. Private customer data must be deleted within 30 days of account deletion, cancellation, or a validated deletion request.

If you request an invite on this website, we store the email address, name, GitHub username or organization, team size, intended use and message you give us. We use them only to review your request and contact you about early access, and we never sell them. To have your request deleted, contact us through the support page.

GET /runs/{run_id} is linked publicly from each check run, so it returns only the run's own status, verdict, conclusion, and timestamps. Repository names, commit SHAs, cost, and error text require the same operator credential.