Shotivo

Privacy

Last updated: September 2026. Effective 24 September 2026. Controller: Valens.dev (Shotivo, shotivo.app). Contact: privacy@shotivo.app.

Shotivo is built to be privacy-first. This page explains what we do with your data, and just as importantly, what we never do.

This policy covers the Shotivo macOS app, the website at shotivo.app, and the sharing API that powers shotivo.app/s/… links. If you do not agree with this policy, do not use the Service.

Free screenshots stay on your Mac

Every screenshot you capture, annotate, copy or save locally never leaves your device. We have no servers that receive it, no analytics that inspect it, and no accounts tied to it.

App permissions: the app requests Screen Recording only to capture the pixels you select. Screenshot pixels stay on your Mac until you press Share. If you opt in to analytics, the app may also send pseudonymous diagnostics (event counts, crash reports) at launch, never screenshot contents.

Shared screenshots

When you choose Share, the screenshot is uploaded so we can give you a link. Shared screenshots are:

  • Stored using a random, unguessable ID.
  • Automatically deleted after 7 days on Free; Pro links can remain live for up to 90 days (90 days by default).
  • Not analyzed for advertising, classified, or used for training.

Anyone with the link can view the image. Do not share sensitive or confidential material. You can delete a share early from the app's My Shares window (which calls the authenticated delete API).

What we collect

When sharing is used, we store only what is needed to serve the link:

  • An anonymous installation identifier (random, not tied to you).
  • The image bytes, its size and dimensions.
  • Creation and expiration timestamps.

We do not store your name, email, device details, or any account information. As with nearly all web services, our servers keep short-lived operational request logs (which include IP addresses) for security and abuse prevention. Those logs are never linked to your screenshots.

App Privacy summary (Apple labels)

For App Store transparency, this is how data maps to Apple's nutrition labels:

  • Data Not Collected for local capture, annotation, copy and save. No network transmission happens.
  • Device ID: random installation ID (UUID stored locally). Sent with shares for rate limits, and with opted-in analytics/crash reports. Pseudonymous and linked to the device across features; not linked to your real-world identity by us.
  • Usage Data: optional pseudonymous event counts (e.g. “capture completed”, “share started”) with installation ID if you opt in to analytics. These cover things that leave no trace on our servers, such as captures, paywall views and purchases. No screenshot contents.
  • Share service data: because we have to store a share to deliver its link, we also keep aggregate counters of how many uploads succeeded or were rejected and why (for example “rate limited”, “needs Pro”, “storage full”). These are totals only — they carry no installation ID and cannot be traced back to you — and they exist regardless of the analytics setting, since they are derived from serving the share itself. We also count how many distinct installation IDs have uploaded, as a single aggregate number; we never look at any individual installation's sharing history.
  • Diagnostics: optional crash reports (app version, macOS version, architecture, truncated stack) with installation ID if opted in.
  • Photos or Videos: screenshot bytes you choose to share, stored with size/dimensions and expiry.
  • Purchases: handled by Apple. We receive a signed transaction token to verify Pro entitlement and retain a transaction/installation association up to 365 days to enforce limits; we never see your Apple ID, email or payment details.
  • No tracking across third-party apps or websites.

What we never do

  • Analyze screenshot contents for advertising or training.
  • Sell or share your data.
  • Add tracking pixels or trackers to the app.
  • Collect clipboard contents or URLs from other apps.

Legal bases (EEA/UK)

Where GDPR applies: we process shared image data to perform our contract with you (delivering share links at your request); logs, rate-limiting, and the aggregate share upload counters described above under legitimate interest (security, abuse prevention, service reliability); and opt-in analytics / crash reports only with your consent (toggle analytics off in the app to withdraw). If guide-page advertising is enabled, the AdSense library is requested only after the configured Google-certified CMP returns a valid IAB TCF signal. Depending on your region and choices, ads may be personalised, non-personalised, or limited. You may object to legitimate-interest processing or change advertising choices through the CMP and Google Ads Settings.

Third-party processors

  • Apple App Store / StoreKit: processes Pro purchases and subscriptions. Apple Privacy Policy.
  • Hosting & object storage: our API and share images are hosted on our infrastructure provider (EU/US region). They act only on our instructions.
  • Google AdSense and the configured CMP (guide articles): may serve ads on /guides/… only after the CMP provides the required consent signal. Never on share pages ( /s/…) and never inside the Mac app.
  • Cloudflare: provides edge delivery, security, and (when enabled for this site) privacy-friendly Web Analytics. See the Cloudflare privacy policy.

Advertising on public web pages

Advertising is disabled by default. If enabled on guide articles, this site uses Google AdSense. The AdSense library is not requested until the configured consent management platform (CMP) returns the required IAB TCF signal. The CMP must present the applicable Google purposes, partners, regions, and choices. Advertising is not a Pro benefit and is not part of the Mac app or share-link service.

If advertising is enabled, Google and its partners may process information under the choices shown by the CMP. Depending on your region and choices, ads may be personalised, non-personalised, or limited. You can manage Google ad settings via Google Ads Settings or aboutads.info. Shared screenshot contents are never supplied to or used for ad targeting.

Guide articles may show ads when advertising is enabled. The required CMP controls the consent signal and available choices; Google may process information under those choices, including for personalised, non-personalised, or limited ads. Share pages show no ads. Screenshot contents are never supplied to or used for ad targeting. See also Google ad technology and Google Privacy Policy.

Cookies

The Mac app does not use cookies. The website uses a language-preference cookie (shotivo_locale). When advertising is enabled, the configured CMP and Google may set additional cookies or similar storage for consent management, frequency capping, and fraud prevention. You can clear cookies in your browser settings and change advertising choices through the CMP.

Analytics & crash reports

The app can send a small number of pseudonymous events (such as “capture completed” or “screenshot saved”) so we know what to improve. These events contain counters and coarse labels plus the random installation ID. They cover only things that leave no trace on our servers, such as captures, paywall views and purchases. They never include screenshot contents, clipboard contents, typed text, or URLs you copy from other apps. If a crash occurs, the app may also send a technical report (app version, macOS version, CPU architecture, and a truncated crash stack).

You can turn both off at any time in Settings → “Share anonymous usage statistics and crash reports.” It is off by default. Enabling sends only pseudonymous diagnostics; disabling stops new events and discards queued events and unsent crash reports.

In the current version app analytics is off by default and only sends events after you opt in. Events are pseudonymous (installation ID attached); server request logs may include IP addresses. Cloudflare Web Analytics, if enabled, is used for aggregate website measurement and does not receive screenshot contents. No screenshot content is attached to app events. Disabling app analytics discards queued events and unsent crash reports.

The app does not report how your uploads turned out. Whether a share succeeded or failed, and why, is counted on our server instead, because we already store each share to deliver its link. Those counters are aggregate totals with no installation ID attached, so they cannot be traced back to you, and they exist whether or not analytics are enabled. That also keeps the numbers accurate: results are not lost when your Mac is offline or quits mid-upload. Turning analytics off therefore does not reduce what our server can count about shares — but the opt-in events above describe activity that would otherwise be invisible to us. We never inspect an individual installation's sharing history.

Server & website logs

As with nearly all services, our servers keep short-lived request logs (IP, user agent, path, timestamp, status) for security, abuse prevention and debugging. Logs are kept at most 30 days and are never linked to your screenshots or installation ID unless needed for abuse investigation.

Data retention

  • Shared images & metadata: deleted automatically after expiry: 7 days for Free, or up to 90 days for Pro according to the selected expiration; earlier if you delete the share. CDN/cached copies may persist briefly after deletion.
  • Request logs: ≤ 30 days.
  • Pseudonymous analytics events: raw events retained ≤ 90 days, then aggregated.
  • Aggregate share upload counters (succeeded/failed and reason): held as running totals only, reset when the API restarts, and not linked to installation IDs.
  • Crash reports: ≤ 90 days.
  • Purchase/installation associations used to enforce Pro limits: up to 365 days.

Security

Shares use high-entropy IDs (base58) and are not enumerable. Images are served directly from object storage with immutable cache headers and are deleted on expiry. We apply TLS, least-privilege infrastructure, and rate limiting.

Your rights

Depending on your region (GDPR / CCPA / similar), you may have rights to access, correct, delete, port, restrict or object to processing, and to withdraw consent. Because we have no accounts, shares are managed via the app's local history and installation ID; if you lose them, contact us. Pseudonymous analytics, crash, and purchase-association records linked to your installation ID can also be addressed on request. To delete a share, use My Shares → Delete in the app. For other requests or to exercise data-subject rights, email privacy@shotivo.app with the share URLs and installation ID concerned and we will respond within 30 days. Californians: we do not sell or share personal information as defined by CCPA.

Children's privacy

The Service is not directed to children under 13 (and for EEA users under 16). We do not knowingly collect data from children. If you believe a share contains a child's data uploaded in error, contact us for prompt deletion.

International transfers

If you access the Service from outside the hosting region, your share image may be transferred and stored there. Where GDPR requires it, we rely on Standard Contractual Clauses / adequacy decisions via our processors.

Changes to this policy

We may update this policy to reflect product or legal changes. The Last updated date above will change and the current version will always be at this URL. For material changes we will note them in app release notes.

Contact

Questions? Email privacy@shotivo.app, or support@shotivo.app for general help. For App Store matters you may also contact Apple Support.