Privacy policy
Effective 5 October 2026 · Weisheme B.V.
This page says what Showboat does with personal data: what it stores, why, where, and for how long. It covers the Showboat app at showboat.show (and the preview host sketch.showboat.show) and this website, showboat.dev.
It describes what the product actually does today. When the product changes how it handles data, this page changes with it.
Who we are
Showboat is run by Weisheme B.V., a company in the Netherlands (KVK 92469442). We are responsible for your account, for this website, and for how the service itself is run. For the content a company puts in its Workspace, that company decides what goes in and who sees it; we store and process it for them.
For anything about your data, email privacy@showboat.show.
What we collect, and why
Your account. To sign in you give us your email address. You sign in with a one-time link we email you, or with Google when the sign-in page offers it and you choose it. Accounts we set up with a password sign in with it; the password is stored hashed by our auth provider. Your account holds your email address and an internal ID — no name, no profile.
What your team puts in a Workspace. A Workspace belongs to the company that created it, and holds what its people and their coding agents push or write:
- Shows and Takes: screenshots or short videos of your own deployed app, the narration written for each one, and deploy details (commit, branch, pull request, environment, deployed URL).
- Sketches and Parities: the design mockups and comparison screens your agents upload.
- Comments, pins and drawings on those, votes on Sketches, links to tickets or specs, and Newsreel stories. Each comment and vote records who made it, by account ID and email address.
Who is in a Workspace. The email addresses of its Owners, Members and Guests, pending invitations, and who invited whom. We use them to decide who can see what and to send invitations.
Security records. To stop abuse of the sign-in form, we keep a record of recent sign-in attempts: a SHA-256 hash of the email address and of the IP address, never the plain values. Opening an invitation link records a hash of the IP address in the same way. These records are for rate limits of an hour; older ones are deleted when new attempts come in.
Mail you send us. Mail to our showboat.show addresses is received by Resend, which keeps the message. For mail to support@showboat.show and privacy@showboat.show, Showboat records that it arrived: when, to which of the two addresses, Resend's ID for the message, and a shortened sender such as er****@gm***.com — never the subject or the text. Notifications to our team chat contain no message content and no full email address.
The support form. The form at showboat.show/support sends your message, your email address and, if you give it, your name to support@showboat.show as an email, through Resend, so we can reply. To stop abuse of the form, we record each message sent as a SHA-256 hash of the email address and of the IP address, never the plain values. These records are for rate limits of an hour and a day; records older than a day are deleted when new messages come in. Our logs note only whether a message was sent, never the message, the name or the email address.
Server logs. Our own logs record each request's timing under a random ID. When an invitation is sent, the log records the recipient's email address.
Connections from your coding agent. When you connect an agent to Showboat's MCP server, we store the app's name and its redirect addresses, and a hashed refresh token together with your account ID and email address. Access tokens last an hour and are not stored. An agent that pushes captures uses an ingest key: we store only a hash of it, and show the key once, when it is created.
Usage analytics
In the app, analytics runs only for Owners and Members. It never runs for Guests, for people reading a public Newsreel, or for anyone signed out — for them it is never switched on. For Owners and Members we record page views and one action (creating an ingest key). You are identified by your account ID, never your email address. Before anything is sent, IDs, invitation tokens and email addresses are stripped from page addresses. Automatic click capture, session recording, heatmaps and surveys are switched off. Events go through our own server, which passes on no cookies and no sign-in credentials; PostHog receives your IP address.
On this website, we record page views and clicks, including which sign-up button was clicked. You are not identified. The website uses PostHog's standard settings: it stores a PostHog identifier in a cookie and in your browser's local storage.
What becomes public
Nothing in a Workspace is public by default. People see a Workspace's content only if they are signed in and invited to it; Guests see only the Projects they were invited to.
A Newsreel can be published by a Member. Its public page shows only the stories a Member published — the headline and text — to anyone with the link, without signing in.
Preview links to Sketches and comparison screens work for an hour.
Legal bases
- Providing the service you or your company signed up for (contract): your account, your Workspace content, the roster, invitations and agent connections.
- Our legitimate interest in keeping the service secure: the sign-in and support-form records and the bot check.
- Our legitimate interest in answering you when you write to us: mail to our addresses and messages from the support form.
- Our legitimate interest in understanding how Showboat is used: usage analytics, limited as described above.
Where your data is stored
Your account, your Workspace content and its files are stored with Supabase in the EU (Ireland). The app's server code runs in Dublin.
Who processes it for us
These providers process personal data on our behalf. Where our configuration shows where they do it, we say so. Where it doesn't, we don't guess — the provider may process data outside the EU.
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Sign-in, the database that holds your Workspace, and file storage for screenshots and uploaded bundles. | EU (eu-west-1, Ireland) |
| Vercel | Hosts showboat.show and showboat.dev and runs the app's server code. | App server code: Dublin (dub1). Vercel's edge network serves pages from locations we don't configure. |
| Resend | Sends our emails (sign-in links and invitations) and receives mail sent to our showboat.show addresses. | Delivers through Amazon SES in eu-west-1 (Ireland), per our mail DNS records. |
| PostHog | Usage analytics, as described under “Usage analytics”. | EU (eu.i.posthog.com) |
| Cloudflare | Turnstile, the bot check on the sign-in and support forms. It sees your browser's request when the check runs; for the support form, we also pass it your IP address when we confirm the check. | Not set in our configuration. |
Signing in with Google
If the sign-in page offers Google and you choose it, Google confirms who you are and tells us your email address. Google's own privacy policy covers what Google does with that.
How long we keep it
Showboat keeps a complete history: Workspace content is not deleted automatically. Removing a Show or archiving a Project hides it; the content and its files stay, so it can come back. Removing someone from a Workspace ends their access and disconnects their agents; what they wrote before stays, with their email address on it. The record that mail reached support@ or privacy@ is kept the same way.
Some things end on their own: invitations expire after 14 days, agent access tokens after an hour, preview links after an hour, sign-in records after an hour and support-form records after a day, as described above.
If you want your data erased, email privacy@showboat.show and we will handle it by hand.
Your rights
You can ask us for a copy of your personal data, to correct it, to erase it, to restrict or object to how we use it, and to receive it in a portable form. Email privacy@showboat.show. If your data is in a Workspace another company controls, we may pass your request to them.
You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Changes to this policy
When what Showboat does with personal data changes, we update this page and its effective date.