Security & Privacy

Privacy Policy

Last Updated: October 6, 2026

1. Overview

At Liminality ("we", "us", or "our"), we build professional developer tools with an uncompromising commitment to privacy and data sovereignty. This Privacy Policy explains how data is handled when you use the ShipKit macOS application and visit our website (getshipkit.app).

Our core engineering philosophy is straightforward: ShipKit builds and packages apps locally. Monitoring does not collect your source code, private signing keys, or Apple developer credentials.

2. ShipKit macOS Desktop Application

When running ShipKit (or the shipkit CLI) on your Mac:

  • Zero Source Code or Binary Collection: ShipKit compiles, archives, and packages your applications locally using Xcode Command Line Tools. Monitoring does not collect source code, repositories, derived data, or compiled binaries. When you choose notarization or publication, ShipKit sends your release artifacts to Apple or your configured distribution services.
  • Native Keychain Security: Your Apple Developer Team ID, Developer ID signing certificates, and App-Specific Passwords for Apple Notarization are managed through the native macOS Keychain. ShipKit never stores these secrets in plain text and never transmits them to Liminality or any external telemetry endpoints.
  • Direct Apple Notarization: When you submit an app for notarization, ShipKit invokes Apple's official xcrun notarytool directly. Communication occurs strictly between your Mac and Apple's official Notary APIs (apple.com).
  • Git & Deployment: Website updates and git operations are executed locally using your configured Git remotes and SSH/HTTPS credentials.

Optional monitoring: In builds configured for reporting, you can enable usage analytics and crash reports separately under Settings → Privacy and diagnostics. Both are off by default. Usage events include launches, feature visits, setup steps and skipped guides, validation categories, help visits, paywall views, selected checkout plans, license activation outcomes, release outcomes, stage timings, and update outcomes, associated with a random installation ID and opaque project IDs. Reporting installations represent devices, not unique people.

PostHog processes these reports. Crash reports include technical stack and binary metadata; raw error messages, local paths, and breadcrumbs are removed before upload. Monitoring excludes project names, repository URLs, emails, license keys, credentials, source code, and build logs. Usage events are stored locally in a bounded queue for up to seven days while offline. Turning an option off clears its queued reports and stops uploads; resuming a previously disabled crash handler may require restarting ShipKit. Support-log sharing remains a separate action.

3. Software Updates

ShipKit uses the open-source Sparkle 2 framework to deliver secure, signed application updates.

When checking for updates, ShipKit sends a standard HTTPS request to our appcast feed (/downloads/appcast.xml). Sparkle validates release signatures locally using Ed25519 cryptography. No personally identifiable developer information is included in update checks.

4. Website & Analytics

Cloudflare serves the website and downloads. We report landing-page views, departures with visit duration, and download-button clicks to PostHog using a random identifier that lasts only for the current page visit. We do not store a persistent visitor identifier or analytics cookie. These browser events respect Do Not Track and Global Privacy Control and record only a clean homepage URL without query parameters or fragments, visit duration, and a fixed button-placement category. When monitoring is configured, download requests are reported to PostHog with response status, build where available, website or updater source, and whether the request used a byte range or appears to be a bot. We exclude HEAD requests and our availability probes. These events do not include IP addresses, raw user-agent strings, referral URLs, or query strings. Request counts do not prove completed downloads or unique downloaders. We do not use session recordings or cross-site tracking for this monitoring.

Purchases and license activation

Lemon Squeezy handles checkout and payment records. When monitoring is configured, verified purchase and refund notifications send currency, amounts, and pseudonymous customer and order identifiers to PostHog. Purchaser names, emails, billing details, license keys, and receipts are excluded from this reporting. License activation is tracked separately as an optional usage event. Anonymous app installations are not linked to payment customers.

5. Contact Inquiries

If you reach out via our contact form or email (liminalityhub@gmail.com), we use your provided name and email address exclusively to respond to your inquiry, debug issues, or discuss feature feedback.

6. Policy Updates

We may revise this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" timestamp.

7. Contact Information

If you have any questions or require security disclosures regarding ShipKit, please contact:

Liminality
Email: liminalityhub@gmail.com