Privacy
Last updated
This note describes this website, not your app. It is not a template for your privacy policy. If you collect other people's data, write your own. See the guide on missing privacy policies and terms.
What this version collects
The newsletter form asks for an email address. If you submit one, the server checks that it looks like an address. A hidden field is there to catch simple bots. If that field is filled, nothing is stored.
When RESEND_API_KEY is set, the address is added to a Resend audience and a welcome email is sent from newsletter@shipsecurely.dev. Replies go to team@shipsecurely.dev. Resend processes that address and that message. An address that is already in the audience is left in place, and the welcome email is sent again. The welcome email includes an unsubscribe link. Opening it, or the one-click unsubscribe action in a mail app, marks that contact unsubscribed in the same Resend audience.
If RESEND_API_KEY is not set, the address is written to the server log and no email is sent. The form still says you are signed up.
A hidden company field is ignored as a bot trap. If it is filled, the form pretends to succeed and stores nothing.
The server also keeps a short in-memory count of signup attempts per IP so a script cannot hammer the form. That count is not a database, and it disappears when the process restarts.
What this version does not do
This version does not run a third-party analytics script and does not set a marketing cookie from the form. It does not sell addresses. There is no checkout.
If you deploy it, the host can still log IP addresses as part of ordinary request logs. On Vercel, that is Vercel's logging. This draft does not name a retention period for those logs. Read the host's current terms before you promise one to somebody else.
Contact
The contact address is team@shipsecurely.dev. That mailbox is not set up yet, so it does not receive mail. Do not send personal data to it and expect a reply.