Privacy Policy | Ship Your App

1. Who this covers

Ship Your App (“we”, “us”, “our”) is an app development company working remotely with businesses across India. This policy applies to this website and every page under it, to enquiries you send us by WhatsApp or email, and to personal data we handle while delivering a project.

It does not cover the apps we build for our clients. Once a product is handed over, the client runs it and their own privacy policy governs it.

2. What this website collects on its own

Nothing. That is the whole answer, and it is worth spelling out because it is unusual:

No cookies are set by this site. There is no cookie banner because there is nothing to consent to.
No analytics, no tracking pixels, no advertising tags, no session recording, no heatmaps.
No third-party embeds — no YouTube players, no maps, no chat widgets that load in the page.
Fonts are served from this domain. They are downloaded at build time rather than requested from Google, so your browser never contacts a font server.
There is no contact form, no login and no account, so there is nothing for you to fill in and nothing for us to store.

The one exception is ordinary server logs. Our hosting provider records the usual technical details of a request — IP address, browser and device type, the page requested, and the time — to serve the site, keep it up, and defend it from abuse. We do not use those logs to build a profile of you, and we do not link them to anything else.

Every call-to-action on this site opens WhatsApp or your email client, so contact is something you start and control.

WhatsApp — we receive the phone number and profile name WhatsApp shows us, plus whatever you write or attach. WhatsApp is operated by Meta and carries the message; Meta's own terms and privacy policy apply to that transport, and we have no control over them.
Email — we receive your address, your name as your mail client sends it, and the contents and attachments of your message.
In practice this is your idea, your requirements, a rough budget and a timeline. Please send only what a quote actually needs. Never send passwords, OTPs, card details or customer databases over WhatsApp or email.

4. What we handle during a project

If an enquiry becomes a build, more information necessarily passes through us:

Contact details for you and any colleagues you bring into the project.
Billing details — name, billing address, GSTIN where you have one, and payment references. Card and bank details go to the payment provider or your bank, not to us; we never store full card numbers.
Access credentials you grant us so we can build, test and deploy — app store accounts, cloud consoles, code repositories, third-party API keys. These are held only for as long as the work needs them, kept in a password manager, and our access is removed at handover.
Content and data you supply for the app itself, which sometimes includes personal data belonging to your own users or staff.

Where we handle your users' personal data, we act only on your instructions. Under India's Digital Personal Data Protection Act, 2023, you are the Data Fiduciary for that data and we are a Data Processor acting for you. We do not use it for our own purposes, and we delete or return it when the engagement ends.

5. Why we use it

To answer your enquiry, scope the work and prepare a quote.
To deliver the project and stay in touch while we do — updates, builds to try, questions and approvals.
To invoice you and to keep the accounting and tax records the law requires us to keep.
To provide support and warranty fixes after launch.
To comply with legal obligations, and to establish or defend a legal claim if one ever arises.

We do not sell or rent personal data. We do not share it with advertisers, we do not build advertising profiles, and we do not run automated decision-making that produces legal effects for you.

Only the service providers we need to run the business, and only as much as each one needs:

Our hosting and CDN provider, which serves this site and holds the server logs described above.
Our email provider, which carries our correspondence with you.
WhatsApp (Meta), for messages you choose to send us there.
Our bank, payment provider and accountant, for invoicing and statutory filings.
Cloud and infrastructure providers used by your project — usually set up in accounts you own, in which case that data never touches ours.

Some of these providers operate outside India. The DPDP Act permits transfers of personal data outside India except to countries the Central Government restricts by notification, and we keep to that.

We will also disclose data where the law, a court or a regulator requires it. Beyond that, we share nothing — and we never publish your data as part of our own marketing. If we want to write about a project, we ask first.

7. How long we keep it

Enquiries that do not become projects — up to 24 months, then deleted.
Project correspondence and working files — for the life of the project and three years after it, so we can support what we built and deal with any dispute.
Invoices and accounting records — eight years, which is what Indian company and tax record-keeping rules expect.
Access credentials — deleted as soon as handover is complete.

Ask us to delete something sooner and we will, unless we are legally required to keep it. Backups roll over on their own schedule, so a deleted item can persist in a backup for a short period before it is overwritten.

8. Your rights

Under the Digital Personal Data Protection Act, 2023, you can ask us to:

Tell you what personal data of yours we hold and what we do with it.
Correct, complete or update anything inaccurate.
Erase data we no longer have a legal reason to keep.
Stop processing where you had given consent — withdrawing consent is as easy as giving it, and takes effect going forward.
Record a nominee who can exercise these rights on your behalf if you die or become incapacitated.

Email hello@shipyourapp.in and we will respond within 30 days. We may need to confirm who you are before acting on a request, which is a safeguard for you rather than an obstacle.

If you are not satisfied with how we handled a complaint, you can escalate it to the Data Protection Board of India. We would rather you came to us first so we can fix it.

9. How we protect it

This site is served over HTTPS, so traffic between your browser and it is encrypted.
Access to client data is limited to the people actually working on that project.
Accounts are protected with multi-factor authentication where the provider supports it, and credentials live in a password manager rather than in chat messages.
Access to your systems is revoked at handover as a standard step, not on request.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data we will tell you and notify the Data Protection Board of India as the DPDP Act requires.

10. Children

Our services are sold to businesses and this site is not directed at children. We do not knowingly collect personal data from anyone under 18. The DPDP Act requires verifiable parental consent before processing a child's data and prohibits tracking or targeted advertising directed at children — if a project you hire us for involves users under 18, we agree those obligations in the project contract before any such data is handled.

11. Sites we link to

This site links out to WhatsApp, to our social profiles, and to the app stores. Once you follow one of those links you are on someone else's service, under their privacy policy, and this one no longer applies.

12. Changes to this policy

When this policy changes we publish the new version here and update the effective date at the top. If a change materially affects how we handle data for an active project, we tell that client directly rather than relying on you to notice.

13. Contact and grievances

For any question about this policy, or to exercise any of the rights above, email hello@shipyourapp.in. For a formal grievance under the DPDP Act, put “Grievance” in the subject line — we acknowledge those within 72 hours and aim to resolve them within 30 days.