Privacy Policy

1. Information We Collect

ShieldCI collects two categories of information: data you provide directly (when you create an account, subscribe to a plan, or contact support) and analysis report data sent to the platform by the shieldci/laravel package on each analysis run.

• Account information: name, email address, and password
• Billing information: processed and stored by Stripe; we retain only customer and subscription identifiers
• Analysis report data: project name, scores, severity counts, and per-issue findings (file paths, line numbers, and short code snippets). The next section breaks this down in full, including what stays on your machine and what the package redacts before sending.
• Usage data: features used, pages visited

2. Code Access and Limits

ShieldCI is designed to minimize what we receive. Analysis runs locally, on your developer machine or your CI runner, and only a structured report of the findings is sent to the platform.

What stays on your machine:

• Your full source tree
• Database contents and credentials
• Full configuration file contents
• Values of environment variables

What the platform receives as part of an analysis report:

• Analyzer findings (severity, message, recommendation)
• File paths and line numbers for each issue
• A short code snippet around each issue (a few lines of surrounding context), with the values of detected environment variables automatically redacted by the package before transmission
• A snapshot of the analysis configuration used (analyzer settings and thresholds, not secrets)
• CI context when present (commit SHA, branch, pull-request number)

What is never sent:

• Environment-variable values, API keys, database credentials
• The contents of .env files
• Files outside the code paths your project opts in to analyze
• Network traffic, runtime logs, or any data that isn't part of the analyzer report payload

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities

4. Data Retention

Analysis reports are retained according to your subscription plan (30, 90, or 365 days). Account information is retained until you delete your account. You can request deletion of your data at any time by contacting support.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including encryption in transit (TLS) and at rest, regular security audits, and access controls.

6. Third-Party Services

We use the following third-party services:

• Stripe - payment processing
• Resend - transactional emails
• Laravel Cloud - hosting infrastructure

7. Contact Us

If you have any questions about this Privacy Policy, please reach us via the contact form.