Privacy Policy
How XD Software Solutions LLC d/b/a I’d Ship That collects, uses and shares personal information, and the choices you have over it.
This policy replaces every earlier version. The previous one was inherited from an unrelated product: it named the wrong company, described features this service does not have, and stated that we do not use cookies for tracking, which was not true. Nothing below is aspirational — each processor named here receives data today.
Who we are#
XD Software Solutions LLC d/b/a I’d Ship That is the controller (and, under California law, the business) for all personal information described in this policy, across the website, the web app and the mobile apps. There is no second entity and no separate controller for any surface.
- Postal address: 3732 Fishcreek Rd. STE 940, Stow, OH 44224
- Email: support@idshipthat.app
Minimum age#
The service is for adults. You must be at least 18 to create an account or use it. We do not knowingly collect personal information from anyone under 18; if we learn that we have, we delete it. There is no child-directed content and no feature intended for minors.
What we collect#
Information you give us#
- Account: email address, display name, password (hashed by our identity provider — we never see it), and optional phone number.
- Shipment data: sender and recipient names, postal addresses, phone numbers and email addresses; package weight, dimensions, declared value and contents description. Recipient details are personal information about someone who is not our user, and we process them only to produce and track the label you asked for.
- Payment data: handled by Stripe. We store a payment-method fingerprint, brand and last four digits — never a full card number.
- Support correspondence and anything you choose to put in it.
Information collected automatically#
- Device and connection: IP address, user agent, operating system, app version, language and time zone.
- Usage: pages and screens viewed, features used, clicks, scroll depth, referring URL and campaign parameters.
- Session replay: a reconstruction of the pages you visited on the web and of the screens you used in the mobile app. Form inputs, text and images are masked before anything leaves your device, and replay never runs where you have opted out or sent a Global Privacy Control signal. See the cookie table below.
- Fraud-prevention identifiers: device identifiers, payment fingerprints, addresses and IP addresses are converted to HMAC hashes on our server the moment they arrive and only the hashes are stored. They are used to detect one person operating many accounts, and for nothing else.
Why we use it#
- To create, price, buy, void and track shipping labels, and to arrange insurance and pickups.
- To take payment, maintain your balance ledger, and pass through carrier post-shipment adjustments.
- To prevent fraud, abuse and multi-account evasion, and to meet carrier and sanctions rules.
- To provide support and send service messages about your shipments and account.
- To measure how the product and the marketing site are used, and to improve them.
- To advertise, where you have not opted out (see “Sale and sharing”).
Where the GDPR or UK GDPR applies, our legal bases are: performance of a contract (labels, payments, support), legitimate interests (fraud prevention, security, product measurement), consent (analytics, session replay and advertising cookies — asked for before anything loads), and legal obligation (tax, sanctions screening, lawful requests).
Who we share it with#
These are every category of recipient and every named processor. The list is derived from the outbound calls the code actually makes, not from a template: if a company is named here it receives data today, and if it is not named here it receives nothing. We do not sell personal information for money.
Infrastructure and core service#
| Recipient | What it receives | Role |
|---|---|---|
| Google Firebase and Google Cloud — Authentication, Firestore, Cloud Run, Remote Config, Messaging, Crashlytics, Performance and App Check (reCAPTCHA Enterprise / v3) | Account identifiers, email address, device and app-instance identifiers, IP address, crash and performance diagnostics, push tokens. reCAPTCHA additionally collects IP, user agent and behavioral signals to tell a person from a script | Service provider / processor (infrastructure) |
| Supabase | The application database: account, shipment, address, balance and ledger records | Service provider / processor (infrastructure) |
| Google Cloud Storage | The label files we generate — sender and recipient name and address, tracking number | Service provider / processor (file storage). See the note on label links below |
| Cloudflare | The custom tracking hostname a Pro merchant sets up (DNS and TLS) | Service provider / processor (networking) |
A caveat about label links, stated plainly: a generated label file is served from a URL that is hard to guess but is not access-controlled. Anyone who has the link can open the label and read the addresses on it. Treat a label link like the label itself.
Payments, subscriptions and connected stores#
| Recipient | What it receives | Role |
|---|---|---|
| Stripe | Payment method, billing details, transaction history; card and bank fingerprints used for fraud prevention | Service provider (payments), and independent controller for its own fraud and regulatory purposes |
| Apple App Store and Google Play | Your Apple ID token and email when you use Sign in with Apple; purchase receipts and tokens for in-app purchases | Independent controllers |
| Adapty | Subscription state, app user id, email address and first name | Service provider / processor (mobile subscription management) |
| Shopify, WooCommerce and eBay | Store, order, buyer and recipient data needed to fulfil the orders you import | Independent controllers. Data flows only for stores you connect yourself |
Impact (shopify.pxf.io) | Click attribution when you launch a Shopify install link from the app — that click only | Independent controller (affiliate attribution) |
Shipping, addresses and insurance#
| Recipient | What it receives | Role |
|---|---|---|
| USPS, UPS (including the UPS partner-billed program) and EasyPost (a failover path for USPS) | Sender and recipient details, package attributes — everything printed on the label, plus the phone or email a service requires | Independent controllers. Carriers use shipment data under their own terms |
| Radar.io | The address as you type it, and your IP address, which we forward with the request | Service provider / processor (address autocomplete and validation) |
| Google Maps and Places | The address as you type it | Service provider / processor (address autocomplete) |
| ipwho.is | Your raw IP address, for coarse geolocation used in shipment and fraud checks | Service provider / processor (IP geolocation) |
| OpenAI | Address text, which can include a name, street and phone number. Sent when you use address parsing, when you paste a batch list, and automatically whenever we check during a rate request whether the sender and recipient addresses are the same | Service provider / processor. Not used to train models |
| U-Pic and Cabrella | Shipment and claim details for insured parcels | Independent controllers (insurance administration) |
Communications and support#
| Recipient | What it receives | Role |
|---|---|---|
| SendGrid (Twilio) | Your email address and message content. Delivery-alert emails you switch on are addressed to the parcel recipient, so their email address goes here too | Service provider / processor (email delivery) |
| Slack (our internal operations workspace) | Support ticket email address, subject, body and attachments, tracking number and destination address; an administrator “act as” approval message carries the target account’s email address | Service provider / processor (internal ticketing and approvals) |
| Email template asset hosts (Stripo, eSputnik, cdnjs, Google Fonts, referenced inside the email HTML) | When your mail client opens one of our emails it may fetch images and fonts from these hosts, revealing your IP address, user agent and the time you opened it | Independent controllers. Blocking remote images in your mail client stops this |
Analytics and advertising#
| Recipient | What it receives | Role |
|---|---|---|
| PostHog | Usage events, page and screen views, device and connection data. When you are signed in those events carry your email address and user id as properties. Session replay runs on the web and in the mobile app with form inputs, text and images masked | Service provider / processor (analytics) |
| Google Analytics 4 | Page and screen views, events, app instance id, purchase value and currency, device data and IP-derived coarse location | Service provider / processor (analytics). Google Signals and ads personalization are switched off for every visitor, and restricted data processing is enabled for opted-out visitors |
| Google AdSense | Cookie and advertising identifiers and browsing activity, on the marketing website and the blog only — never in the app and never on a payment page | Sharing / cross-context behavioral advertising |
| Google Fonts | Your IP address and user agent when a font loads on the marketing site, the web app shell, or in the app at runtime | Independent controller |
We also disclose personal information to professional advisers, to a successor in a merger or acquisition, and to law enforcement or regulators where we are legally required to or where it is necessary to investigate fraud.
Sale and sharing#
We do not sell personal information for money. We do share it for cross-context behavioral advertising, which California, Colorado, Connecticut, Virginia and similar laws treat the same as a sale: the Google AdSense tag discloses your identifiers and browsing activity to Google for its advertising purposes.
That tag runs on the marketing website and the blog only. There is no advertising tag in the mobile apps, none in the web app, and none on any page that takes a payment.
The categories shared are identifiers (cookie and advertising IDs, IP address) and internet activity (pages viewed, interactions). We do not share sensitive personal information for advertising, and we have no actual knowledge of sharing the personal information of anyone under 16 — the service is 18+.
You can turn this off. Use Your Privacy Choices, or send a Global Privacy Control signal (see below). Neither requires an account, a verification step, a reason, or any information we do not already have.
Cookies and similar technologies#
Nothing outside the “strictly necessary” row loads until our consent script has decided it may. In the EEA and the UK, that means nothing at all loads until you accept; rejecting is one click, in the same size, colour and weight as accepting. Withdrawing consent is exactly as easy as giving it: one click from Your Privacy Choices, reachable from every page footer.
| Category | Set by | Purpose | Typical duration |
|---|---|---|---|
| Strictly necessary | I’d Ship That, Firebase, Stripe | Sign-in session, security, fraud prevention, load balancing, and remembering your cookie choice (ist_consent) | Session to 12 months |
| Functional | I’d Ship That | Remembering interface preferences such as light or dark mode (idshipthat-theme) | Persistent until cleared |
| Analytics | PostHog, Google Analytics 4 | Which pages and features are used, and session replay with all form inputs masked | 12 months (we set the Google Analytics cookie lifetime to 12 months rather than its 2-year default) |
| Advertising | Google AdSense — marketing site and blog only | Measuring and targeting advertising across sites. This is the “sharing” described above | Up to 13 months, set by Google |
Your browser can also block or delete cookies. Blocking strictly necessary cookies will stop sign-in from working.
Global Privacy Control#
We honor the Global Privacy Control (GPC). When your browser or extension sends the signal, we treat it as a valid request to opt out of the sale and sharing of your personal information for the browser it came from: the AdSense tag is never loaded, Google Analytics runs with restricted data processing and ads data redaction enabled, and session replay is switched off. We show a small “Opt-out request honored” indicator on the page so you can see that the signal was processed. The resulting opt-out is stored, so it survives the signal later disappearing.
A signal you are sending now outranks a permission you gave us earlier, everywhere. If you accepted analytics cookies in the EEA or the UK and later turn GPC on, session replay stops and advertising stays off; we do not treat the earlier acceptance as a reason to keep recording. The indicator and the behaviour always agree.
GPC is available in browsers including Firefox, Brave and DuckDuckGo, and as an extension for others. Because a signal is tied to a browser, it does not carry across devices; use Your Privacy Choices on each one, or write to us.
Your rights#
Depending on where you live, you may have the right to know what we collect and why, to get a copy of it, to correct it, to delete it, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of them. In the EEA and the UK you may also object to or restrict processing, withdraw consent at any time, and complain to your supervisory authority.
How to exercise them#
- Opt out of sale or sharing: Your Privacy Choices, or send GPC. No account or verification.
- Deletion: the “Request account deletion” control in the app files a request; it is not an instant, automatic erase. You get an acknowledgment email when the request is filed, and a person then processes it. You can also email support@idshipthat.app from the address on the account.
- Access, correction or a copy of your data: there is no self-service export yet, so email support@idshipthat.app from the address on the account and we will put it together. We will confirm receipt within 10 business days and respond within 45 days, extendable once by another 45 where the law allows. We ask for only what is needed to match the request to an account and never require a reason.
- Email you do not want: shipment and account service messages are switched
off per category in the app under Settings → Notifications. The delivery-alert emails we
send to a parcel recipient carry a one-click unsubscribe link and a
List-Unsubscribeheader, so the recipient can stop them without contacting anyone. We are not currently sending marketing email at all. - Authorized agents: may submit a request with written permission; we may contact you to confirm it.
- Appeal: if we refuse a request, reply to our decision and we will review it. Virginia, Colorado and Connecticut residents have a statutory right to that appeal.
Some data must be kept even after a deletion request — transaction records for tax and accounting, and fraud-prevention hashes — and we say so when we respond.
California disclosures#
Under the CCPA as amended by the CPRA, in the last 12 months we collected the categories of personal information listed under “What we collect” (identifiers, customer records, commercial information, internet activity, coarse geolocation from IP, and inferences drawn for fraud prevention), for the purposes listed under “Why we use it”, from you, from your devices, and from the platforms and carriers you connect. We disclosed each category to the recipients named above, and shared identifiers and internet activity for cross-context behavioral advertising.
Statement required by §1798.135(c)(2): we do not sell or share personal information, and do not use or disclose sensitive personal information beyond the purposes permitted by §7027(m) of the CCPA regulations, for consumers who have opted out through Your Privacy Choices or a Global Privacy Control signal. Opting out is a single action and requires nothing from you but that action.
Why there is no “Limit the Use of My Sensitive Personal Information” link: we collect and use sensitive personal information only for the purposes permitted by §7027(m) — providing the service you asked for, security and fraud prevention, and short-term operational uses — and never to infer characteristics about you. Under §7014(g) a business in that position is not required to post a Limit link, so we do not post one that would do nothing.
We do not offer financial incentives for personal information, and we do not knowingly sell or share the personal information of consumers under 16.
Retention#
We keep account and shipment records for as long as the account exists and afterwards for as long as we need them for tax, accounting, dispute and carrier-adjustment purposes. Analytics data is kept for up to 12 months. Fraud-prevention hashes are kept for as long as the risk they address persists. Session replays are kept for the retention window of our analytics plan and are never retained where replay was suppressed — nothing was recorded.
International transfers#
We are based in the United States and our processors are largely United States companies, so personal information from the EEA or the UK is transferred to the United States. Those transfers rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where applicable) or on a processor’s certification under the EU-US Data Privacy Framework.
Security#
Data is encrypted in transit. Passwords are handled by our identity provider and never stored by us. Card numbers never touch our servers. Device identifiers, payment fingerprints, addresses and IP addresses used for fraud prevention are HMAC-hashed on receipt and stored only as hashes. Access to production data is restricted and audited. No system is perfectly secure, and we do not claim otherwise.
Changes#
We will post any revised policy here with a new “last updated” date, and give advance notice by email or in the app where a change is material. If a change expands what we share for advertising, we will ask again rather than assume your earlier answer.
Contact#
Privacy questions, rights requests and complaints: support@idshipthat.app, or write to XD Software Solutions LLC d/b/a I’d Ship That, 3732 Fishcreek Rd. STE 940, Stow, OH 44224.