Privacy Policy

Last updated: September 30, 2026 Applies to: idshipthat.app, app.idshipthat.app and the iOS and Android apps

This policy replaces every earlier version. Nothing in it is aspirational: every processor named here receives data today, and we review the list whenever the service changes.

On This Page

Who we are#

XD Software Solutions LLC d/b/a I’d Ship That is the controller (and, under California law, the business) for all personal information described in this policy, across the website, the web app and the mobile apps. There is no second entity and no separate controller for any surface.

• Postal address: 3732 Fishcreek Rd. STE 940, Stow, OH 44224
• Email: support@idshipthat.app

Minimum age#

The service is for adults. You must be at least 18 to create an account or use it. We do not knowingly collect personal information from anyone under 18; if we learn that we have, we delete it. There is no child-directed content and no feature intended for minors.

What we collect#

Information you give us#

• Account: email address, display name, password (hashed by our identity provider, so we never see it), and optional phone number.
• Shipment data: sender and recipient names, postal addresses, phone numbers and email addresses; package weight, dimensions, declared value and contents description. Recipient details are personal information about someone who is not our user, and we process them only to produce and track the label you asked for.
• Payment data: handled by Stripe. We store a payment-method fingerprint, brand and last four digits, never a full card number.
• Support correspondence and anything you choose to put in it.

Information collected automatically#

• Device and connection: IP address, user agent, operating system, app version, language and time zone.
• Usage: pages and screens viewed, features used, clicks, scroll depth, referring URL and campaign parameters.
• Session replay: a reconstruction of the pages you visited on the web and of the screens you used in the mobile app. Form inputs, text and images are masked before anything leaves your device, and replay never runs where you have opted out or sent a Global Privacy Control signal. See the cookie table below.
• Ad click identifier (website and web app only): when you arrive on our website from one of our Google ads, Google adds a click identifier to the link (a gclid, gbraid or wbraid). If advertising is permitted for your browser, we keep it so we can tell Google Ads whether that visit led to a sign-up or a first label. See “Sale and sharing”.
• Approximate location (our home page only): so the example label on our home page can show rates from somewhere near you, our server may send your IP address to a third-party geolocation service, ipwho.is, which tells us an approximate city and state. Our home page asks for this only where analytics is permitted for your browser. Your browser keeps the answer so we do not look it up again on every visit, and we use it for up to 24 hours; after that it is ignored, and deleted the next time our home page checks it or when you clear this site’s data. We also keep it in our servers’ short-term memory for up to 24 hours under a hash of your network, not your IP address. It is never written to our database. If you type in a ZIP code instead, we look up that ZIP code, not your IP address. If a ZIP code you saved earlier is later rejected (it is not a valid ZIP or USPS does not recognize it), we delete it and fall back to looking up your IP address as described above.
• Fraud-prevention identifiers: device identifiers, payment fingerprints, addresses and IP addresses are converted to HMAC hashes on our server the moment they arrive and only the hashes are stored. They are used to detect one person operating many accounts, and for nothing else.

Why we use it#

• To create, price, buy, void and track shipping labels, and to arrange insurance and pickups.
• To take payment, maintain your balance ledger, and pass through carrier post-shipment adjustments.
• To prevent fraud, abuse and multi-account evasion, and to meet carrier and sanctions rules.
• To provide support and send service messages about your shipments and account.
• To measure how the product and the marketing site are used, and to improve them.
• To advertise, and to measure which of our Google ads lead to sign-ups and first labels, where you have not opted out (see “Sale and sharing”).

Where the GDPR or UK GDPR applies, our legal bases are: performance of a contract (labels, payments, support), legitimate interests (fraud prevention, security, product measurement), consent (analytics, session replay, advertising cookies and ad conversion measurement, asked for before anything loads or is kept), and legal obligation (tax, sanctions screening, lawful requests).

Who we share it with#

These are every category of recipient and every named processor. The list is complete and is kept in step with what the service actually does: if a company is named here it receives data today, and if it is not named here it receives nothing. We do not sell personal information for money.

Infrastructure and core service#

A caveat about label links, stated plainly: a generated label file is served from a URL that is hard to guess but is not access-controlled. Anyone who has the link can open the label and read the addresses on it. Treat a label link like the label itself.

Payments, subscriptions and connected stores#

Shipping, addresses and insurance#

Communications and support#

Analytics and advertising#

We also disclose personal information to professional advisers, to a successor in a merger or acquisition, and to law enforcement or regulators where we are legally required to or where it is necessary to investigate fraud.

Sale and sharing#

We do not sell personal information for money. We do share it for cross-context behavioral advertising, which California, Colorado, Connecticut, Virginia and similar laws treat the same as a sale. We do this in two ways:

• Google AdSense: the AdSense tag discloses your identifiers and browsing activity to Google for its advertising purposes.
• Google Ads conversion measurement: when you arrive on our website from one of our Google ads, we keep the ad click identifier from that ad in your browser. If you then sign up on the web, the web app sends it to our server, and our server tells Google Ads that the click led to a sign-up and, later, to your first label purchase on the web, with the time of each and a fixed value. We do this only for a new account created after the ad click and within 90 days of it. We never send Google your email address, name, postal address or phone number, and nothing from the iOS or Android apps. We tell Google not to use it for ad personalization, but Google receives it under its own terms.

The AdSense tag runs on the marketing website and the blog only. There is no advertising tag in the mobile apps, none in the web app, and none on any page that takes a payment. Conversion measurement does not load any Google script either: the report goes from our server to Google.

The categories shared are identifiers (cookie and advertising IDs, ad click identifiers, IP address), internet activity (pages viewed, interactions) and, for conversion measurement, the fact and time of a sign-up or first label purchase. We do not share sensitive personal information for advertising, and we have no actual knowledge of sharing the personal information of anyone under 16: the service is 18+.

You can turn this off. Any one of these stops both kinds of sharing for the browser or account it applies to:

• Your Privacy Choices (the “Opt out of sale and sharing” control);
• a Global Privacy Control signal from your browser (see below);
• the cookie banner or cookie preferences: leave Advertising unticked, or choose “Reject all”. In the EEA and the UK we do neither unless you tick Advertising or choose “Accept all”;
• in the app, Settings → Privacy → “Share analytics and ad measurement” turned off, which is saved to your account and also stops ad conversion measurement for it.

None of these requires an account (except the app setting, which is part of one), a verification step, a reason, or any information we do not already have. When you opt out in a browser, the click identifier we keep there for Google Ads conversion measurement is never used again and is deleted the next time our website or web app runs in it, and the next time you are signed in to our web app in that browser, it withdraws any report for your account that has not been sent yet. Turning off “Share analytics and ad measurement” stops every report for your account that has not been sent yet. What we have already sent to Google cannot be recalled: opting out, withdrawing consent or deleting your account stops future reports, but Google keeps what it already received under its own terms.

Cookies and similar technologies#

Nothing outside the “strictly necessary” row loads until our consent manager has decided it may. In the EEA and the UK, that means nothing at all loads until you accept; rejecting is one click, in the same size, colour and weight as accepting. Withdrawing consent is exactly as easy as giving it: one click from Your Privacy Choices, reachable from every page footer.

Your browser can also block or delete cookies. Blocking strictly necessary cookies will stop sign-in from working.

Global Privacy Control#

We honor the Global Privacy Control (GPC). When your browser or extension sends the signal, we treat it as a valid request to opt out of the sale and sharing of your personal information for the browser it came from: the AdSense tag is never loaded, no ad click identifier is kept for Google Ads conversion measurement, Google Analytics runs with restricted data processing and ads data redaction enabled, and session replay is switched off. We show a small “Opt-out request honored” indicator on the page so you can see that the signal was processed. You can hide the indicator; your current status is always shown on Your Privacy Choices. The resulting opt-out is stored, so it survives the signal later disappearing.

A signal you are sending now outranks a permission you gave us earlier, everywhere. If you accepted analytics cookies in the EEA or the UK and later turn GPC on, session replay stops and advertising stays off; we do not treat the earlier acceptance as a reason to keep recording. The indicator and the behaviour always agree.

GPC is available in browsers including Firefox, Brave and DuckDuckGo, and as an extension for others. Because a signal is tied to a browser, it does not carry across devices; use Your Privacy Choices on each one, or write to us.

Your rights#

Depending on where you live, you may have the right to know what we collect and why, to get a copy of it, to correct it, to delete it, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of them. In the EEA and the UK you may also object to or restrict processing, withdraw consent at any time, and complain to your supervisory authority.

How to exercise them#

• Opt out of sale or sharing: Your Privacy Choices, or send GPC. No account or verification.
• Deletion: the “Request account deletion” control in the app files a request; it is not an instant, automatic erase. You get an acknowledgment email when the request is filed, and a person then processes it. You can also email support@idshipthat.app from the address on the account.
• Access, correction or a copy of your data: there is no self-service export yet, so email support@idshipthat.app from the address on the account and we will put it together. We will confirm receipt within 10 business days and respond within 45 days, extendable once by another 45 where the law allows. We ask for only what is needed to match the request to an account and never require a reason.
• Email you do not want: shipment and account service messages are switched off per category in the app under Settings → Notifications. The delivery-alert emails we send to a parcel recipient carry a one-click unsubscribe link and a List-Unsubscribe header, so the recipient can stop them without contacting anyone. We are not currently sending marketing email at all.
• Authorized agents: may submit a request with written permission; we may contact you to confirm it.
• Appeal: if we refuse a request, reply to our decision and we will review it. Virginia, Colorado and Connecticut residents have a statutory right to that appeal.

Some data must be kept even after a deletion request (transaction records for tax and accounting, and fraud-prevention hashes), and we say so when we respond. Deleting your account also deletes any ad click record we hold for it, but it cannot recall a sign-up or first label report already sent to Google Ads (see “Sale and sharing”).

California disclosures#

Under the CCPA as amended by the CPRA, in the last 12 months we collected the categories of personal information listed under “What we collect” (identifiers, customer records, commercial information, internet activity, coarse geolocation from IP, and inferences drawn for fraud prevention), for the purposes listed under “Why we use it”, from you, from your devices, and from the platforms and carriers you connect. We disclosed each category to the recipients named above, and shared identifiers and internet activity (and, for Google Ads conversion measurement, the fact and time of a sign-up or first label purchase) for cross-context behavioral advertising.

Statement required by §1798.135(c)(2): we do not sell or share personal information, and do not use or disclose sensitive personal information beyond the purposes permitted by §7027(m) of the CCPA regulations, for consumers who have opted out through Your Privacy Choices or a Global Privacy Control signal. Opting out is a single action and requires nothing from you but that action.

Why there is no “Limit the Use of My Sensitive Personal Information” link: we collect and use sensitive personal information only for the purposes permitted by §7027(m) (providing the service you asked for, security and fraud prevention, and short-term operational uses), and never to infer characteristics about you. Under §7014(g) a business in that position is not required to post a Limit link, so we do not post one that would do nothing.

We do not offer financial incentives for personal information, and we do not knowingly sell or share the personal information of consumers under 16.

Retention#

We keep account and shipment records for as long as the account exists and afterwards for as long as we need them for tax, accounting, dispute and carrier-adjustment purposes. Analytics data is kept for up to 12 months. An ad click record kept for Google Ads conversion measurement is deleted from your browser after 90 days and from our systems no later than 120 days after the click. Fraud-prevention hashes are kept for as long as the risk they address persists. Session replays are kept for the retention window of our analytics plan and are never retained where replay was suppressed, because nothing was recorded.

International transfers#

We are based in the United States and our processors are largely United States companies, so personal information from the EEA or the UK is transferred to the United States. Those transfers rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where applicable) or on a processor’s certification under the EU-US Data Privacy Framework.

Security#

Data is encrypted in transit. Passwords are handled by our identity provider and never stored by us. Card numbers never touch our servers. Device identifiers, payment fingerprints, addresses and IP addresses used for fraud prevention are HMAC-hashed on receipt and stored only as hashes. Access to production data is restricted and audited. No system is perfectly secure, and we do not claim otherwise.

Changes#

We will post any revised policy here with a new “last updated” date, and give advance notice by email or in the app where a change is material. If a change expands what we share for advertising, we will ask again rather than assume your earlier answer.

Contact#

Privacy questions, rights requests and complaints: support@idshipthat.app, or write to XD Software Solutions LLC d/b/a I’d Ship That, 3732 Fishcreek Rd. STE 940, Stow, OH 44224.