Frequently asked questions
Straight answers about what Shipslides does today — pricing, accounts, the security model, supported formats, privacy, and embedding. If something here is unclear, the security page goes deeper on the sandbox.
Is Shipslides free to use?
Yes. Publishing a self-contained HTML deck and getting a shareable link is free, and no account is required. There is no paid tier or billing today.
Do I need an account to publish a deck?
No. You can upload and share anonymously — every anonymous upload returns a one-time claim token you can use to delete the deck later. Signing in with Google is optional and simply lists all of your decks together at /me.
Is it safe to run someone else’s uploaded HTML and JavaScript?
Every deck renders inside an <iframe sandbox="allow-scripts"> under a strict Content-Security-Policy. The sandbox has no allow-same-origin, no top-level navigation, and no popups, forms, or modals, and connect-src 'none' blocks all network calls (fetch, XHR, WebSocket, EventSource, and sendBeacon). In production the deck HTML is served from a separate content origin, so it can never read the app’s login cookies.
Can an uploaded deck steal my data or attack other decks?
No. Because the sandbox has no same-origin access and no network egress, deck code cannot read cookies, reach your session, call external servers, or touch any other deck. Each deck runs fully isolated. Uploads are also scanned for secrets and for login, credential, or network patterns, which are rejected before a deck is stored.
What file formats and slide frameworks are supported?
Any self-contained HTML presentation works — including reveal.js, Slidev, Marp, and impress.js exports, or hand-written HTML. Upload a single .html file up to 25 MB, or a .zip bundle whose index.html references local CSS, JS, images, and fonts, which Shipslides inlines into one file. PowerPoint, Keynote, and PDF files are not converted.
How do I include images and fonts in my deck?
Embed them as data URIs, upload a .zip bundle so Shipslides can inline your local assets, or opt in at upload time to have the server download absolute image URLs and inline them. At view time a deck cannot fetch arbitrary external files — the Content-Security-Policy allows only a small allowlist of image hosts, Google Fonts, and YouTube embeds.
Can I keep a deck private?
Yes. Every deck defaults to unlisted: it is reachable only through its share link, which carries a secret view key, and it never appears in the catalog, search, sitemap, or any feed. Choosing public makes the deck eligible for discovery. Note that unlisted relies on an unguessable link rather than a password or login gate.
Will my deck show up on Google or in the public catalog?
Only public decks are eligible, and a deck appears in the catalog, search, sitemap, and feeds only once it has enough context — a title, summary, category, tags, a slide outline, and a thumbnail — and has been curated as searchable or featured. Unlisted decks and thin uploads stay shareable but are marked noindex.
Can I update or replace a deck after publishing?
Not in place — Shipslides does not have re-upload or version history yet. Each upload creates a new deck with its own share link. To update a published deck, upload the revised file, which gets a fresh link, and delete the old one.
Can I delete a deck?
Yes. If you uploaded anonymously, use the one-time claim token that was returned when you published. If you were signed in, delete the deck from your dashboard at /me.
Can I embed a deck on my own website or blog?
Yes. Load a published deck’s embed URL, /d/[slug]/embed, inside an iframe on your own page. The embedded player renders the same sandboxed deck and accepts optional theme, start, and zoom parameters.
Can my deck load live data, call an API, or run analytics?
No. connect-src 'none' blocks every network request from deck code, and uploads containing network or API calls are rejected before they are stored. Pre-render or inline any data your slides need before uploading.
Ready to publish a deck?
Drop in one self-contained HTML file and get a sandboxed share link in seconds.