Privacy Policy

Capturing, annotating, recording and saving all happen locally. The app does not phone home, does not send your screenshots anywhere, and has no telemetry - no usage counters, no crash reporting, no feature analytics. You can use it without an account and without an internet connection.

Two things do reach the network, both without any data about you:

• Update checks. The app asks update.justshot.net whether a newer version exists. This is a request for a file; it carries no account, no identifier, and nothing about your usage.
• Sign-in and upload, only if you choose to use JustShot Cloud.

macOS grants these to the app on your machine. They let it function; they do not send anything to us.

Signing in is Google only - we never see or hold a password. From Google we receive your email address and a user identifier, and nothing else: not your contacts, not your Drive, not your profile beyond the address.

• No analytics. There is no Google Analytics, no Plausible, no Mixpanel, no session recording, and no tracking pixel on the website or in the app. The one number we do keep is a daily count of how many times the download button is pressed - one integer per day, with nothing recorded about who pressed it: no address, no browser, no referrer.
• No advertising and no ad networks. Nothing about you is sold, rented, or shared for marketing.
• No marketing email. We send exactly two messages, both about your own account: a welcome when you first sign in, and a warning before files are deleted after a subscription lapses. There is no newsletter to unsubscribe from because there is no newsletter.
• No content scanning. We do not read, index, or analyse your screenshots, and we do not use them to train anything.

Your IP address is used at the moment of a request to enforce rate limits - for example, to stop someone guessing the password on a protected link. It is not written to our database and we do not build any record from it. Cloudflare, which serves our traffic, processes IP addresses as part of delivering and protecting the service, as any hosting provider must.

Anyone holding a JustShot link can open it. Links are unguessable rather than secret: there is no directory and no search, but a link forwarded to someone else will work for them too. Treat a link as you would treat the file itself.

For anything sensitive, use the controls built for it - set a password, set an expiry date, or turn on burn-after-read so the link dies after one view. You can delete any upload at any time from your dashboard, which removes both the file and the link.

Uploaded files are stored encrypted at rest by our storage provider and sent over HTTPS, but they are not end-to-end encrypted. We could technically access a file if compelled by law or while investigating a report of abuse. We do not do so otherwise, and we would rather say this plainly than imply a guarantee we cannot make.

Retention depends on your plan, and files are removed automatically when a limit is reached - oldest first. This is how the product is meant to work, not a failure.

If a paid subscription ends, we keep everything for a further 30 days so nothing is lost while you decide, and we email you before that window closes. After it closes, files above the free limit are deleted permanently.

Deleting your account removes your files, your metadata and your sign-in record straight away. Backups made by our providers may retain data for a short period afterwards before rotating out.

Running the service means using a small number of providers. Each one only receives what its job requires.

We have no other recipients. If that list changes, this page changes with it.

Lemon Squeezy is the merchant of record for every purchase, which means they take the payment, handle tax, and issue invoices. Your card number, expiry and security code go to them and never pass through JustShot. We receive only the fact that a payment succeeded, which plan it was for, and when it renews.

You can do most of this yourself, immediately, from Settings in the dashboard:

• See what we hold - your uploads are listed in the dashboard, and Settings exports the full list as a CSV.
• Delete - remove any single upload, or delete your entire account and everything in it.
• Correct - rename files and edit tags at any time.

For anything else - a copy of your data in another format, a restriction on processing, or an objection to it - email contact@justshot.net and we will respond within 30 days. If you are in the UK, EU, or another region with equivalent law, these rights are yours by statute and we honour them regardless of where we are based.

Account records and file details are stored in Tokyo. Uploaded files are stored by Cloudflare and served from locations near whoever opens the link, so they may be transmitted internationally. By signing in you accept that your data is processed outside your own country where necessary to run the service.

JustShot is not intended for children under 13, and we do not knowingly create accounts for them. If you believe a child has an account, email contact@justshot.net and we will remove it.

Traffic is HTTPS throughout. Files are encrypted at rest by our storage provider. Link passwords are stored only as one-way hashes with a per-link salt, so a stolen database still would not reveal them. Access to production data is limited to the developer named above.

No service is perfectly secure. If you find a vulnerability, please report it to contact@justshot.net before disclosing it publicly - see the contact page for details.

If we change how data is handled in a way that affects you, we will update the date at the top of this page and, for anything significant, email you about it. Continuing to use JustShot after a change means you accept the updated policy.