Privacy Policy

Last updated

supashot is designed to be private by default. Your screenshots, recordings, audio and annotation text stay on your device (browser memory and IndexedDB) and are never uploaded to our servers, unless you choose to create a share link for a finished export. This policy explains what limited data we do handle and why.

On this page

1. Who is responsible

Data controller for the supashot website and account system: the operator of supashot.com. Contact: [email protected]. For billing data, the Merchant of Record is Creem Inc., which acts as an independent controller for payment, tax and invoicing data.

2. What we collect – and what we do not

We do NOT collect

  • Your screenshots, recordings, audio or annotation text – these never leave your browser. A share link uploads only the finished export you choose to publish.
  • Uploaded image/video blobs – stored locally in IndexedDB, not on our servers.

We DO collect (only when you use these features)

  • Account data: email address used for email or Google sign-in, user ID, Google account identifier if you connect Google, and session tokens (hashed in PostgreSQL). Login links expire after 15 minutes and are one-time.
  • Billing data: when you subscribe, Creem shares with us the customer ID, subscription ID, product/plan, status and paid-through date needed to grant Pro. Payment details (card numbers) are handled solely by Creem – we never see or store them.
  • Usage metadata (optional, anonymised): counts of shot_created / export_completed events by media kind and export format – no filenames, URLs, annotation text or media blobs.
  • Shared exports (only when you choose Share link): the finished image or video you publish, its title, format and dimensions. It is stored by our object-storage provider so anyone with the unlisted link can view it; share pages ask search engines not to index them. You can delete a link at any time in your account, which removes the stored file.
  • Technical data: standard server logs (IP address, user-agent, timestamps) for security and abuse prevention, and rate-limit counters for login/checkout/portal.

3. Cookies and local storage

  • Essential cookies: supashot_session (HttpOnly, SameSite=Lax, Secure in production, 30-day expiry) for authentication, and supashot_login for browser-binding of magic links, plus supashot_google for browser-binding of Google sign-in (10-minute expiry). No tracking or advertising cookies.
  • Local storage: draft and preset metadata stored in your browser’s LocalStorage / IndexedDB so your work survives a session. Clearing browser data removes it.

4. How we use your data

  • To authenticate you and keep you signed in.
  • To grant, verify and manage Pro entitlement and your subscription via Creem.
  • To prevent abuse (rate limiting, fraud prevention) and to operate the Service.
  • To respond to support requests you send to [email protected].

Legal bases under GDPR: performance of contract, legitimate interests (security, abuse prevention), and consent where applicable. We do not sell your data.

5. Sharing

  • Google – if you choose Google sign-in, Google authenticates you and shares your email address, verification status, and account identifier. We request only sign-in permissions; we do not access Gmail messages, Drive files, or contacts and do not store Google access or refresh tokens. See Google’s Privacy Policy.
  • Creem Inc. (Merchant of Record) – for checkout, webhooks, customer portal, tax and refunds. See Creem’s Privacy Policy.
  • Email delivery provider – to send magic-link emails (SMTP). Only the recipient address and message are shared.
  • Hosting / infrastructure – our hosting provider processes data on our behalf under a data-processing agreement.
  • Object storage – stores exports you publish as share links, on our behalf.

We do not sell or share your media. The only media we receive are exports you explicitly publish as share links; they are shown only to people who have the link.

6. Retention

  • Sessions: 30 days (automatically expired; daily cleanup removes expired rows).
  • Login links: 15 minutes.
  • Google sign-in attempts: 10 minutes; consumed once or removed by daily cleanup. Connected Google identifiers remain while the account exists.
  • Billing account rows: retained while your account exists to manage entitlement; deleted on account deletion.
  • Rate-limit counters: short-lived (minutes to hours).
  • Shared exports: Free links for 30 days, Pro links until you delete them. Deleting a link, or its expiry, removes the stored file.
  • Server logs: up to 30 days unless needed longer for security investigations.

7. Your rights (GDPR and similar)

Depending on your jurisdiction you may have the right to:

  • Access, correct or delete your personal data.
  • Object to or restrict processing, and to data portability.
  • Withdraw consent where processing is based on consent.
  • Lodge a complaint with your local supervisory authority.

To exercise these rights, email [email protected]. We respond within 30 days (usually 1–2 business days).

8. International transfers

Our servers and Creem’s infrastructure may be located outside your country. Where required, transfers are protected by Standard Contractual Clauses or equivalent safeguards.

9. Security

We hash login and session tokens (SHA-256), use HttpOnly / SameSite=Lax / Secure cookies, enforce Origin checks on mutations, and serialise billing updates transactionally. No system is perfectly secure; use a strong, unique email password and keep your device updated.

10. Children

The Service is not directed to children under 16. We do not knowingly collect data from children.

11. Changes

We may update this policy and will change the “Last updated” date above. Material changes will be highlighted on the site. Continued use after changes means you accept the updated policy.

12. Contact

Questions or requests: [email protected] or our contact page. Response target: 1–2 business days.