Privacy Policy

Who we are

ShotShoot is published by Dzianis Yatsevich, Cyprus ("we", "us"). We are the controller of the personal data described in this policy.

For any privacy question or request, write to legal@shotshoot.app.

What this policy covers

• The ShotShoot desktop application for Windows and macOS, including copies obtained from Microsoft Store or the Mac App Store.
• The ShotShoot license server that activates and verifies licenses.
• This website, https://shotshoot.app.

Data that stays on your device

The following data is created and stored only on your computer. We have no access to it, and the app does not transmit it unless you explicitly choose to send it yourself (see Feedback you send and Upload to your own storage):

• Screenshots, screen recordings, webcam video, microphone and system audio.
• Your library, annotations, text labels, layer history and step-by-step guides.
• Text recognized in your screenshots (OCR) and the search index built from it.
• Clipboard contents, window titles, file names and folder paths.
• Your settings, such as shortcuts, theme, language and save folders.

Files are saved to folders you choose (by default Pictures/ShotShoot and Videos/ShotShoot). The library and settings live in the app data folder. You can delete them at any time; see the Support page for their locations.

Text recognition (OCR) and AI upscaling run entirely on your computer. The OCR models and the standard upscaling model are included in the app. The best-quality upscaling model is downloaded separately: the first time you choose this mode, the app fetches it once from shotshoot.app, verifies its checksum and keeps it on your device. This download contains no images, license key or device identifier; like any connection, it reveals your IP address and app version. Images are never sent anywhere for this processing, and once the model is on your device both features work offline.

Data sent to the license server

This section and Usage statistics apply only to the version downloaded from this website. Copies from Microsoft Store and the Mac App Store are licensed through the store: they do not contact our license server, create no device identifier and send no usage statistics.

When you activate ShotShoot, and again at least every 48 hours while you are online, the app contacts our license server and sends:

• The license key you entered.
• A device public key and a pseudonymous device identifier generated by the app. They do not contain your name, e-mail or hardware serial numbers.
• The app version, operating system and processor architecture.
• A cryptographic proof that the request comes from the activated device.

We use this data to activate your license, to keep one key on 1 device at a time, to renew the offline permission and to prevent misuse. The legal basis is the performance of our contract with you (the license).

Like any internet service, the server receives your IP address as part of the connection. It is used for security and rate limiting, may appear in short-lived technical logs, and is not linked to your usage statistics.

Usage statistics

The version downloaded from this website sends limited usage statistics. This is part of the license and is disclosed before activation. Only events from a fixed list are sent:

• App start and active usage time.
• Capture type (region, window or screen) — not the image.
• Series start and result, recording start and duration.
• Export result, format and duration.
• A normalized error code and the subsystem where it happened.
• App version, operating system and architecture.
• Pseudonymous device, license and session identifiers.

Never sent: images, video, audio, clipboard contents, text you type, window titles, file names or paths.

If the app is offline, events wait in a local queue limited to 5 MiB and 7 days; older events are discarded. We use statistics to understand which features are used, to find errors and to improve reliability, on the basis of our legitimate interest in maintaining and improving the product. You may object by contacting us; if you do not agree with this processing, please do not activate the app.

Feedback you send

The app has an optional Send feedback form. Nothing is sent until you press Send. When you do, the app sends to our server:

• The description you typed.
• Up to 5 images you attach yourself (up to 2 MB each).
• The app version and operating system.

Feedback is not linked to your license key or device identifier. Do not attach images that contain personal or confidential data you do not want to share. We use feedback to answer you, fix errors and improve the product, on the basis of our legitimate interest and your decision to send it. You can ask us to delete a message at any time.

Upload to your own storage

You can optionally connect your own WebDAV server, S3-compatible storage or HTTP endpoint in the settings. This feature is off by default. When you turn it on, the app sends the files you choose directly to the address you entered.

We do not receive these files and have no access to that storage. Passwords, keys and headers you enter are stored on your device and encrypted with the operating system's secure storage. The processing of uploaded files is governed by the terms of the storage provider you chose.

Update checks

The version downloaded from this website checks our update server about 45 seconds after start and then every 12 hours. The request downloads a public update manifest and, if there is a new version, the installer. It contains no license key or device identifier; like any connection, it reveals your IP address and app version. You can turn off background update checks in the settings. Copies from Microsoft Store and the Mac App Store are updated by the store instead.

How long we keep data

• Raw usage events: 90 days.
• Daily aggregated statistics: 13 months.
• License and activation records: for the life of the license and afterwards for as long as needed for accounting, dispute resolution and legal obligations.
• Support e-mails: for as long as needed to resolve your request.
• Feedback messages with attached images: until your request is resolved, but no longer than 180 days, after which they are deleted automatically; earlier on request. To limit how often feedback can be sent, the server keeps a one-way hash of the sender's IP address for one day.
• Questions sent with the website form: no longer than 180 days on our server; the e-mail copy as long as needed to resolve your request.
• Website server logs: a short period required for security, normally no longer than 30 days.

Server backups are encrypted and overwritten on a rolling basis.

System permissions

• Screen recording (macOS) — required to take screenshots and record the screen.
• Microphone (macOS) — used only when you turn on the microphone in the video settings.
• System audio (macOS) — used only when you turn on system audio in the video settings.
• Camera — used only when you turn on the webcam overlay in the video settings. The picture is recorded into your video file on your device.
• Global shortcuts — used to start a capture from any app. Keystrokes are not recorded.
• Accessibility (macOS) — used only for scrolling screenshots, so that the app can scroll the page for you. Without it you scroll by hand.
• Keys shown in a recording (Windows) — only if you turn on showing keystrokes in the video settings, the app reads pressed keys while a recording is running to draw them into the video. By default only shortcuts are shown, so typed text such as passwords is not displayed. Keys are not stored separately and are never sent anywhere.

When you choose Telegram in the Share menu, the app passes the saved file to Telegram Desktop on Windows or opens the system Share menu on macOS. Sending happens in that app, under its own terms.

When you choose Translate for recognized text, the app opens that text in Google Translate or DeepL in your browser. This happens only when you click it; the translation service then processes the text under its own terms.

This website and cookies

This website has no accounts or advertising. Our web server records standard technical logs (IP address, browser, requested page and time) to keep the site secure.

Question form. If you send a question with the form on this website, we receive the e-mail address and the text you entered and the language of the page. We use them only to answer you; the legal basis is your request. The question is stored on our server and forwarded to our support mailbox. It is deleted automatically after 180 days, or earlier on request; the copy in the support mailbox is kept for as long as needed to resolve your request. To limit spam, the server keeps a one-way hash of the sender's IP address for one day.

Yandex Metrica. If you click “Accept” in the cookie banner, we load Yandex Metrica, a web analytics service provided by YANDEX LLC, 16 Lva Tolstogo St., Moscow, 119021, Russia. It collects the pages you view, the referring site, device and browser type, approximate location derived from the IP address and interactions such as clicks on store buttons. It sets cookies such as _ym_uid, _ym_d and _ym_isad. Session recording (Webvisor) is turned off. The legal basis is your consent.

If you click “Decline” or ignore the banner, Yandex Metrica is not loaded and no analytics cookies are set. You can change your choice at any time with Cookie settings in the footer. Your choice itself is stored in your browser's local storage.

More information: Yandex Metrica terms of use and Yandex privacy policy.

Sharing and international transfers

We do not sell personal data and do not use it for advertising. We share data only with service providers that host our servers and our mailboxes and, with your consent, with Yandex for website analytics. They act on our instructions or under their own published terms.

If you buy ShotShoot in Microsoft Store or the Mac App Store, the purchase is processed by Microsoft or Apple under their privacy policies. We do not receive your payment details.

Data may be processed in a country other than yours. Where the law requires it, we apply appropriate safeguards for such transfers.

Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your data protection authority.

To exercise these rights, write to legal@shotshoot.app. Because we do not know your name, please include the last six characters of your license key so that we can find the related records. We answer within one month.

Children

ShotShoot is a productivity tool and is not directed to children under 13 (or the minimum age in your country). We do not knowingly collect data from children.

Security

Connections to our servers use HTTPS. License permissions are signed with Ed25519, device keys are protected by the operating system's secure storage, and access to the license administration is protected by a password and a second factor.

Data summary for app stores

This summary matches the privacy disclosures we submit to Microsoft Store and the Mac App Store. “Website version” is the copy downloaded from this website; “Store versions” are copies from Microsoft Store and the Mac App Store.

The app contains no advertising and no third-party tracking SDKs.

Changes to this policy

We update this policy when the app or the law changes. The date at the top shows the latest revision. We will announce material changes on this website before they take effect.