Alpha privacy

Do not add raw participant records, protected health information (PHI), direct identifiers, credentials or restricted research data. Aggregates and de-identified outputs can still reveal people through small groups or embedded metadata; review them first.

Dataship stores rendered reports and supporting artifacts, not an approved repository for sensitive source datasets. A data fingerprint records a digest and selected metadata; the source data file stays on your computer.

The local alpha stores accounts, sessions, project records, comments and provenance in its local PostgreSQL service. Report files live in its private local object storage. Development email is available in the local Mailpit inbox. These service volumes persist between app restarts.

Approved project members can see content according to their role. A password-protected link lets a guest view and comment on its selected published release, including existing feedback. Guest names are self-reported. Guest sessions use a separate HttpOnly cookie and last at most eight hours; links expire and can be revoked. Anyone you grant report access can copy what they can view. Keep downloaded reports, audit exports and demo recordings in a location you trust.

If a hosted alpha is introduced, the owner must identify its hosting region, email and monitoring providers, backup retention and access policy before you use it.

Session cookies keep you signed in. The app records attributable project activity, including publication and review changes, so the analytical history remains understandable.

Application diagnostics use request references, operation names, timings and error codes. They are designed to exclude report and comment bodies, passwords, tokens, cookies and signed artifact links. Optional server error and performance reporting is used only when the owner configures it. Browser session replay is not enabled.

A Zoom or Teams meeting follows the meeting provider’s own privacy and recording settings. Dataship does not capture the meeting’s audio or video.

Published releases and their provenance remain immutable. Archiving a project preserves its history and files; it does not erase them. Temporary invitation, verification and job records are cleaned up by the worker. GitHub webhook receipts are retained to prevent replay. Ended live review rooms, including their meeting link and participant list, are kept; no cleanup is scheduled for them yet.

An owner can schedule project removal after saving a fresh audit export that includes the files. A cancellable 30-day period keeps the project read-only before the worker removes its private files. Immutable metadata and commentary remain in inaccessible history. Account deactivation revokes credentials, pending invitations and memberships and replaces the current profile; it preserves historical contributions. Transfer any last ownership first. Downloads and backups are separate copies, so immediate erasure of every copy is not promised.

Contact the owner through your original access channel for a privacy question, removal request or accidental upload. Include a project or release identifier, time and request reference if available. Keep sensitive content, credentials and private report links out of public issues.

For a suspected vulnerability, follow the security reporting instructions.