ShotButler ("we", "us") is operated by LI ZHIQI, an individual. Contact: support@shotbutler.com. This policy explains what we collect when you use ShotButler (the "Service"), why, who we share it with, and your rights.
Availability. The Service is not offered to users located in mainland China. We do not knowingly collect data from users there.
1. What we collect
- Account data: your email address, and basic profile data (name, email, account ID) from Google if you sign in with it. Email sign-in uses one-time verification codes; we do not store passwords.
- Content you upload: app screenshots, app logos, app information and related text, plus the results we generate (translations, edited images, backgrounds, review-risk reports).
- Device fingerprint: to prevent abuse of the free allowance, we compute a browser and device fingerprint in your own browser with FingerprintJS, an open-source library, and send it with your app requests. We store only a salted, one-way hash of it, never the raw fingerprint, alongside the hashed IP and account identifiers described in this section. We use it only for anti-abuse and to decide eligibility for the one-time free allowance (on Free: 3 uploaded store-image text translations and 1 free AI image in total, counted once per device or account). We do not use it for advertising or for cross-site tracking.
- Hashed IP address: a salted, one-way hash of your IP address, used only to check eligibility for the free plan (one free allowance per device or network) and to prevent abuse. We do not keep your IP address in readable form for this purpose.
- Payment data: payments are processed by our payment provider, which acts as merchant of record. We receive the transaction status, plan, country and billing email, but never your full card details.
- Waitlist data: if you join the waitlist for paid plans or credit packs, your email address and the plan or pack you request, used only to tell you when they become available. You can unsubscribe at any time.
- Usage and technical data: logs such as IP address, browser type, pages used, errors and timestamps.
2. How we use it
To provide the Service (processing your screenshots), manage your account, plan and usage limits, prevent fraud and abuse (including deciding eligibility for the one-time free allowance), provide support, comply with law, and improve reliability. We do not sell your data and we do not use your uploaded content to train AI models.
Legal bases (EEA/UK): performance of a contract (providing the Service), legitimate interests (security, abuse prevention, improvement), legal obligation, and consent where required.
3. AI models and providers
To process your screenshots, we use AI models developed by:
- Google (Gemini): text recognition, translation, image analysis and review checks
- DeepSeek: text recognition, translation, image analysis, copy planning and review checks
- OpenAI (GPT Image): screenshot design generation and image editing
- Ideogram: translating text within finished designs
- Alibaba (Qwen): image editing and background repair
We access these models through third-party AI infrastructure providers: kie.ai, Runware and apimart. We send the images, app information and prompts needed for your requested operation to the provider processing that operation. Runware also provides image upscaling and object removal. We do not use your content to train AI models. Please do not upload screenshots that contain sensitive personal information or other people's private data.
4. Other recipients
- Our payment provider and merchant of record (once paid plans launch)
- Sign-in provider: Google (only if you choose to sign in with it)
- Vercel (hosting, US East)
- Supabase (database, file storage and authentication, us-east-1)
- Resend (sign-in code emails)
- Cloudflare (DNS and Turnstile bot protection, which processes browser information of visitors)
- PostHog (product analytics, cookieless mode)
- Authorities, when required by law, and a successor in a merger or acquisition.
5. Retention
- Uploaded screenshots, app logos, app information and generated results are kept while your account is active, including in archived projects. Archiving a project does not delete its stored content. When you confirm account deletion, we remove your stored project content within 30 days.
- Exported ZIP files: download access expires after 24 hours, and the files are then removed by scheduled cleanup.
- Hashed device fingerprint and hashed IP address: deleted after 90 days.
- Account data: kept while your account is active, and deleted within 30 days after you delete your account.
- Payment and tax records: kept as long as the law requires.
6. International transfers
Your data may be processed in the United States and other countries. Where required, we rely on safeguards such as the EU Standard Contractual Clauses.
7. Your rights
Depending on where you live (for example the EEA, UK or California), you may have the right to access, correct, delete, or export your data, and to object to or restrict processing. You can also lodge a complaint with your local data protection authority. Email support@shotbutler.com. We do not "sell" or "share" personal data for cross-context behavioral advertising as defined under California law.
8. Cookies
We use only the cookies needed for sign-in and security. Our product analytics (PostHog) runs in cookieless mode and does not place analytics cookies on your device.
9. Children
The Service is not intended for anyone under 18. We delete data we learn was collected from a child.
10. Security
We use encryption in transit, access controls, and hashing of identifiers. No system is perfectly secure.
11. Changes
We will post updates here and notify you of material changes by email or in the app.