Privacy Policy

Stored only on your device

Your projects, screenshots, screen recordings, uploaded fonts and images, and exported files are stored in your browser (IndexedDB) or saved to your computer. We don’t receive them. We also store your license key and a few preferences, such as your chosen export sizes, in your browser’s local storage so the app works as expected. We don’t use advertising or analytics cookies.

Sent to our servers

Your pass. When you buy a pass, we store your license key, the email address you used at checkout, the purchase reference and the pass’s dates, so we can check your pass, email you your key, and send it again if you lose it (for that we also keep a one-way hash of your email address next to your keys). When you activate or use the pass, your key and a random identifier for your browser are sent to our server, which also keeps a count of AI translations used.

Usage counts. To see which features are used and where people stop, the app counts a few steps, such as opening the editor, exporting, or opening the pass options. Each count holds only the step, a short detail (for example the template or export format), the day and your country. No cookies, identifiers or IP addresses are stored with it, so the counts can’t be linked to you or to each other. They’re kept by Cloudflare, our hosting provider.

AI translation. When you use Auto-translate, the text of your headlines, subtitles, badges and video captions is sent to our server and to Anthropic, whose Claude models produce the translation. Images and videos are never sent. Anthropic processes this text under its commercial terms and privacy policy. We don’t store the text.

Starting from a store listing. When you enter an App Store ID or link, your browser looks up that app’s public listing directly with Apple. For a Google Play package name or link, our server fetches the public listing page from Google and passes the name, icon, description and screenshot addresses to your browser. Either way, your browser then loads the screenshots directly from Apple’s or Google’s servers, and we don’t store any of it.

AI headlines. When you ask Claude to write headlines, either while starting from a store listing or with Write headlines in the editor, the app’s name, its store category (if any), the description you give and the language to write in are sent to our server and to Anthropic in the same way as translations. Images are never sent, and we don’t store the text, but please don’t include anything confidential in the description. Because AI headlines are free, we limit how many each visitor can request per day, by counting requests against a one-way hash of your IP address and the date. The count is deleted after two days and can’t be turned back into your IP address.

Service providers and international transfers

• Stripe processes payments, with Link as the merchant of record. It receives your name, email, billing details and payment information, under the Stripe and Link privacy policies. We can see your order and email, and use them only for support, refunds and license management.
• Cloudflare hosts the website and our server functions. Like any web host, it processes technical data such as IP addresses to deliver and protect the service, under its privacy policy.
• Anthropic provides AI translation and headline suggestions, as described above.
• Resend sends our emails, such as your license key, from its EU (Ireland) region. It receives your email address and the email’s content, under its privacy policy.
• Apple and Google receive requests from your browser (and, for Google Play, from our server) only when you start a project from your store listing.

Fonts and all other files are served from our own domain, so no other third party receives your data when you use the app otherwise.

Some of these providers are based in the United States. Where data leaves the EU/EEA, it is protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses, as offered by each provider.

Why we process data, and on what legal basis

• To provide what you bought (license checks, translation, support): necessary to perform our contract with you (GDPR Art. 6(1)(b)).
• To keep the service secure and working (hosting logs, abuse prevention): our legitimate interest in running a reliable service (Art. 6(1)(f)).
• Accounting and tax records for purchases: legal obligation (Art. 6(1)(c)).

We never sell your data or use it for advertising.

How long we keep it

Your license record (key, email, purchase reference and dates) is deleted 90 days after your pass expires, so we can still help with questions shortly after. Translation usage counts are deleted a day after the pass expires. Daily counts for headline suggestions are deleted after two days, as are counts used to limit “email me my key” requests. The hash of your email address is deleted with your license record. A link between each purchase reference and its key is kept for up to 13 months to handle refunds and disputes. Stripe keeps order records as required for tax and accounting.

Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, or to object to its processing. Email [email protected] and we’ll respond within 30 days. You can delete everything stored on your device at any time by clearing this site’s data in your browser. You can also complain to the Danish Data Protection Agency (Datatilsynet) or to the data protection authority where you live.

Children

ShotPass is not intended for anyone under 16, and we don’t knowingly collect their data.

Changes

We’ll update this page if our practices change; the date at the top shows the latest version. Questions? Contact [email protected].