Privacy Policy

This Privacy Policy explains what personal information ShotPoet ("ShotPoet", "we", "us" or "our") collects when you use the ShotPoet website, apps and related services (the "Service"), how we use and share it, and the choices and rights you have. ShotPoet is operated by Yaohui Li, a sole proprietor, who is responsible for the personal information described here. Payments are processed by Paddle.com, which is responsible for the payment information it collects.

1. Information we collect

Information you give us

Account information. Your email address and password. Passwords are stored only as a salted one-way hash.
Google sign-in. If you sign in with Google, Google shares your email address and basic profile information with us. We keep your email address and your Google account ID.
Content. The prompts, reference images and annotations you submit, including the images you mark up; the settings you choose, such as model, aspect ratio and resolution; and the images, videos and audio generated for you.
Messages. Your email address and the contents of any message you send us.

Information collected automatically

Usage records. Your generations and their status, your credit balance and the history of credit charges, returns and adjustments, your sign-in times and active sessions.
Log and device data. Our servers record technical information about each request, such as IP address, browser and device type, the page or action requested, the time and any errors.
Cookies and browser storage. Described in section 5.

Information from Paddle

When you buy credits, Paddle shares with us the details we need to deliver your purchase, such as your email address, the product, price, currency, country and transaction ID. We do not receive your full card or bank details.

2. How we use information

To provide the Service: create and secure your account, sign you in, run generations, store and deliver your results, and maintain your Library and credit balance.
To process purchases and refunds with Paddle.
To keep the Service safe: prevent fraud and abuse, enforce our Terms of Service, investigate suspected violations and diagnose problems.
To respond to your requests and send service messages about your account, purchases, security or changes to our policies.
To understand, in aggregate, how the Service is used, so we can fix issues and plan improvements.
To comply with legal obligations and respond to lawful requests.

We do not use your content to train AI models, we do not sell your personal information, and we do not use it for targeted advertising.

Legal bases in the EEA, UK and Switzerland

We process your information to perform our contract with you, which covers providing the Service and handling purchases; for our legitimate interests in security, fraud prevention, support and improving the Service; to comply with legal obligations; and with your consent where it is required. Where we rely on consent, you can withdraw it at any time.

3. AI model providers

To generate a result, we send your prompt, reference images, annotations and settings to the provider of the model you choose, such as OpenAI, Google, xAI, ByteDance, Alibaba Cloud or Recraft, either directly or through a service that routes requests to that provider. The provider processes this data to create the result and returns it to us. Its own terms and privacy policy govern how long it keeps the data and whether it uses the data to improve its models. Avoid including sensitive personal information in prompts and images.

We share personal information only as follows:

Service providers that process it on our behalf, including our server hosting provider, Cloudflare for network delivery, security and file storage, and our email provider. They may use it only to provide their services to us.
AI model providers, as described in section 3.
Google, when you choose to sign in with your Google account.
Paddle, our reseller and Merchant of Record, which processes payments, taxes and refunds as an independent controller under the Paddle Privacy Policy.
Legal and safety. When required by law or legal process, or when disclosure is necessary to protect the rights, property or safety of our users, the public or ShotPoet, including reporting child sexual abuse material to the authorities.
Business transfers. As part of a merger, acquisition, financing or sale of all or part of the Service, with this Privacy Policy continuing to apply to your information.
With your consent or at your direction.

5. Cookies and browser storage

We use only the cookies and storage the Service needs to work:

sp_session keeps you signed in for up to 30 days.
sp_google protects the Google sign-in flow. It is deleted when sign-in completes, or after 10 minutes.
Local storage remembers your preferences on your device, such as theme, language, view settings and generation settings.

Cloudflare may set cookies that are needed for security and performance. We do not use advertising cookies or third-party analytics.

6. How long we keep information

Account information and content are kept while your account is open.
Deleted items. Deleting an item removes it from your Library. The underlying record and file stay stored with your account until the account is deleted. You can ask us to erase specific items sooner.
Account deletion. When your account is deleted, we delete your account information and content within 30 days, except for information we must keep for legal, tax, accounting or dispute purposes, such as purchase and credit records.
Logs are kept for a limited period for security and troubleshooting.

Paddle keeps payment records under its own retention policy.

7. Security

We protect your information with measures such as encrypted connections, hashed passwords and session tokens, private file storage that only your account and authorized staff can access, and restricted administrative access. No system is completely secure, so use a strong, unique password and tell us if you suspect unauthorized access to your account.

8. International transfers

We and our providers process information in several countries, including the United States, whose data protection laws may differ from those where you live. When we transfer personal information out of the EEA, the UK or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

9. Your rights

Depending on where you live, you may have the right to:

access the personal information we hold about you and get a copy of it.
correct inaccurate information.
delete your information or your account.
receive your information in a portable format.
object to or restrict certain processing.
withdraw consent where we rely on it.
complain to your local data protection authority.

If you live in California, you have the right to know what personal information we collect and how we use it, to access, correct and delete it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law.

To exercise your rights, email support@shotpoet.com from the address on your account. We may need to verify your identity, and we will respond within 30 days, or sooner if the law requires. You can also download your results from your Library at any time.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version on this page and change the date at the top. If the changes are significant, we will also notify you by email or in the Service before they take effect.

12. Contact

For privacy questions or requests, contact support@shotpoet.com.