Privacy Policy

This policy applies to the Shipyard website and service at genshipyard.com. It describes data processing that is present in the current application. Third-party services have their own privacy policies.

Shipyard is an open-source project. The project repository is public. Do not post personal data, private keys, seed phrases, or passwords in public issues or pull requests.

• Wallet data when you connect a wallet or use sign-in with Ethereum. The service receives your public wallet address and signature request data. It does not receive your private key or seed phrase.
• AI prompts when you use contract generation. The prompt and selected model are sent to OpenRouter through the Shipyard server.
• Contract and transaction data when you deploy, verify, or publish a contract. This can include an address, network, source, template, transaction hash, and deployment time.

Shipyard stores some data in browser storage:

• Deployment history, including contract addresses, networks, names, and cached source where the application saves it.
• A session identifier in sessionStorage for first-party analytics.
• Wallet connection state managed by the wallet and application libraries.

Clear the site data for genshipyard.com to remove browser storage. This does not remove data already published to a blockchain or stored by a third-party service.

Sign-in with Ethereum uses first-party, httpOnly cookies. A short-lived nonce cookie supports sign-in. A session cookie supports a signed-in wallet session for up to seven days. The admin area can use a separate signed admin session cookie for up to seven days.

The cookies use the secure flag in production and use the same-site policy. Shipyard does not use advertising cookies.

Shipyard sends first-party event data for page views and feature events. An event can include the event name, path, network, template, contract address, limited metadata, a session identifier, and a user agent.

When a wallet address is included, the server hashes it with a server-side salt before it stores the event. The raw wallet address is not stored in the analytics event record. If the salt is not configured, the event has no wallet attribution.

Selected API endpoints receive a client IP address for rate limiting and abuse prevention. The application uses this value in rate-limit keys. The analytics event record does not store the raw client IP address. Hosting and service providers may process IP addresses in their own logs.

• to provide wallet sign-in and transaction features;
• to generate contracts when you request the AI feature;
• to show public contract and deployment information;
• to show signed-in users their deployment history across devices;
• to measure feature use and improve the service;
• to prevent abuse and protect the service; and
• to maintain, secure, and operate the application.

Shipyard uses service providers to operate the application:

• Vercel for hosting and deployment;
• Supabase for database storage when configured;
• Upstash Redis for rate limits and short-lived relay data when configured;
• OpenRouter for optional AI contract generation;
• wallet providers and WalletConnect for wallet connection; and
• GenLayer networks and RPC providers for blockchain operations.

Each provider processes data under its own terms and privacy policy. Review those policies before you use the related feature.

Blockchain transactions, contract addresses, contract source, and related data can be public and permanent. Shipyard cannot delete data from a public blockchain. Do not put personal or confidential information in a transaction or contract.

Browser data remains until you clear it or the application removes it. Server data remains according to the configuration of Shipyard and its service providers. The current application does not publish one fixed retention period for all server records.

Contact the project through the repository for a privacy question or a request about data held by the service. We may need information that identifies the relevant record. Do not send private keys, passwords, or other sensitive information.

You can disconnect your wallet, clear browser storage, avoid the AI feature, and use content blockers. These actions can limit some features but do not require you to share private keys or seed phrases.

Privacy laws in your location may give you rights to access, correct, delete, restrict, or object to some processing. The available rights and response requirements depend on the applicable law and on the data involved.

Shipyard is a developer tool. It is not directed to children. Do not use the service if you are not allowed to use it under the law that applies to you.

We may update this policy when the service or its data practices change. The date above shows when we last updated the policy. Review this page before you use the service after a change.

Send privacy questions through the project repository:

Do not post private keys, passwords, or other sensitive information in a public issue.