The short version: Shipyard doesn't collect anything about you. There's no Shipyard account, no server, no analytics, no ads and no tracking. The apps talk directly to GitHub from your device, and everything they keep stays on that device.
This policy covers Shipyard for iPhone and Shipyard for Mac ("Shipyard", "the apps"), made by Sukhleen Kaur ("I", "me").
What Shipyard reads, and where it goes
To show your pull requests, Shipyard asks GitHub for:
- your GitHub username, display name and avatar;
- the open pull requests you authored (and, if you turn it on, the ones assigned to you): titles, numbers, repository names, branch names and review status;
- the CI checks on each pull request's latest commit: names, status, timing and links.
These requests go straight from your device to GitHub (api.github.com). They never
pass through a server of mine, and I never see them. GitHub's handling of your data is covered by
the GitHub
Privacy Statement.
What's stored on your device
- Your GitHub access token, in the system Keychain.
- On iPhone, it's either created when you sign in with GitHub's device sign-in, or it's a token you paste in yourself. It is kept on that device only: it isn't synced to iCloud and isn't included in backups.
- On Mac, it's read from the GitHub CLI (
gh).
- A copy of your last synced pull requests, so the app opens with data before it reaches GitHub.
- Your settings: starred pull request, work hours, notification and display preferences.
On iPhone, your pull request status can appear in a Live Activity on the Lock Screen, in the Dynamic Island and on a paired Apple Watch. That's drawn by iOS on your devices from the same local data.
What Shipyard doesn't do
- No analytics, crash reporting SDKs, advertising or tracking of any kind.
- It doesn't sell or share data, because it doesn't have any.
- It never changes anything on GitHub. It only reads.
Other network requests
Shipyard for Mac checks once a day for new versions by downloading a small
update file from this website (sukhleenk.github.io), which is hosted by GitHub Pages.
Like any website, GitHub Pages may log the IP address of that request. I don't receive or use
those logs.
When you open a link (a pull request, a check's log, GitHub's sign-in page), it opens in your browser or the GitHub app and is covered by GitHub's policies.
Deleting your data
- Sign out in Settings removes the token, the cached pull requests and the Live Activity from that device.
- Deleting the app removes everything it stored.
- Revoking access on GitHub:
- if you used the iPhone app's GitHub sign-in, its access is under Settings › Applications › Authorized OAuth Apps;
- if you pasted a personal access token, delete it under Settings › Developer settings › Personal access tokens;
- the Mac app uses your GitHub CLI login, which you can sign out of with
gh auth logout.
Children
Shipyard is a tool for software developers and isn't directed at children under 13.
Changes
If this policy changes, the new version will be posted here with a new date. Any change that would collect data would be called out in the app's release notes first.
Contact
Questions about privacy: sukhleenk1113@gmail.com.