Shotly: Privacy Policy
Effective date: 13 May 2026
Shotly (“the app”, “we”, “our”) is an iOS app for editing and exporting screenshots, photos, and short video clips. You import media from your photo library or camera, edit it inside the app, and save the finished result back to Photos or share it.
This policy describes what information we collect, how we use it, and what choices you have. We try to keep it short and plain. If anything here is unclear, email hemposse@hotmail.com and we'll explain.
TL;DR
- The screenshots, photos, videos, and edits you make stay on your device. We don't upload them.
- When you sign in with Apple we store your Apple-provided identifier and (if you share them) email and name, so you can sign in again later.
- Subscriptions are handled by Apple and RevenueCat.
- We do not run analytics, ads, or any kind of tracking.
- We do not sell your data.
- You can delete your account and the data tied to it any time by emailing us.
1. Who is responsible
The “data controller” (in GDPR terms) is the developer of Shotly:
- Ossian Hempel
- Contact: hemposse@hotmail.com
2. What we collect
Shotly collects the following information, and only this:
| Data | Why | Where it lives |
|---|---|---|
| Apple user identifier (the stable “sub” from Sign in with Apple) | Recognising you on subsequent sign-ins | Convex (our backend) |
| Email address from Sign in with Apple (or Apple's private relay address), if you choose to share it | So we can reach you about your account if needed | Convex |
| Name from Sign in with Apple, if you choose to share it | Shown to you inside the app | Convex |
| Subscription / purchase status (if you purchase Shotly Pro) | Unlocking Pro features and restoring purchases on a new device | RevenueCat; receipts validated by Apple StoreKit |
| Your projects (imported screenshots, photos, video clips, edits, layers) | The core function of the app | On your device only. We don't upload them. |
| Photos, camera, and microphone permissions you grant | Importing media to edit, capturing new shots, recording audio for video projects | Used in-memory on your device; never uploaded |
We do not collect: your contacts, location, advertising identifier, browsing history, the contents of your photo library beyond the items you explicitly import, or any other category of information.
3. How we use it
We use the data only to:
- Sign you in and keep you signed in
- Honour your Pro subscription and restore it on new devices
- Reply to you if you contact us for support
We do not use your data for advertising, profiling, training AI models, or any purpose unrelated to running the app.
4. Sub-processors
We rely on a small set of services to run the app. They process your data on our behalf:
| Service | What they do | Where they store data |
|---|---|---|
| Apple (Sign in with Apple, StoreKit) | Authenticates you with your Apple ID and processes your subscription purchase | United States (Apple's infrastructure) |
| Convex | Stores the small user record (Apple identifier, optional email and name) | United States |
| RevenueCat | Manages subscription state and validates App Store receipts | United States |
We do not share your data with any other third parties.
5. Where your data is stored, and international transfers
Shotly stores the small user record in the United States (Convex and RevenueCat). If you are in the EU/EEA/UK, your data may be transferred to the United States. These transfers rely on standard contractual clauses and your consent in signing in to the app.
Your projects themselves never leave your device, so they are not transferred internationally at all.
6. How long we keep it
- The user record is kept for as long as your account exists.
- If you delete your account (see below), we delete the user record within 30 days.
- Backups may take up to 90 days to fully expire from our sub-processors' systems.
- Apple and RevenueCat retain receipts and minimal billing records for up to 7 years where required for tax/legal reasons.
7. Your rights
Wherever you live, you can ask us to:
- Access the data we hold about you
- Correct anything that's wrong
- Delete your account and all associated data
- Object to or restrict how we use your data
If you are in the EU/EEA/UK (GDPR), Switzerland (FADP), California (CCPA/CPRA), or India (DPDP), you have these rights by law. You can also lodge a complaint with your local data protection authority. We'd much prefer you write to us first so we can fix things.
To exercise any right, email hemposse@hotmail.com from the address tied to your account. We respond within 30 days.
We do not sell or share personal information for cross-context behavioural advertising. There is nothing for you to “opt out” of in that sense.
8. Account deletion
You can delete your account by emailing us:
- Email hemposse@hotmail.com from the address you signed up with, asking us to delete your account.
- (When the in-app delete flow ships) Go to Settings → Delete account in Shotly.
Once you delete your account, the user record is removed from our active systems. Your projects already live only on your device. Uninstalling Shotly removes them.
9. Security
- All traffic between the app and our servers is over HTTPS/TLS.
- Authentication uses Apple's identity tokens; we mint our own short-lived session tokens after verifying Apple's signature server-side. We never see your Apple password.
- Our sub-processors (Apple, Convex, RevenueCat) maintain their own SOC 2 / ISO 27001-class security controls.
No system is perfect. If we ever discover a breach affecting your data, we will notify you and the relevant supervisory authority within 72 hours, as required by GDPR.
10. Children
Shotly is not directed at children under 13 (or under 16 in some EU countries). We do not knowingly collect personal information from children. If you believe a child has signed up, email us and we will delete the account.
11. Changes to this policy
We may update this policy as the app evolves. The “Effective date” at the top will change. For material changes (new data types, new sub-processors), we'll notify you in the app before the change takes effect.
12. Contact
Questions, requests, complaints, or just hello:
We reply to everything from a real person.