Privacy Policy
ShotVault ("we", "our", "us") respects your privacy. This policy explains what we collect, how we use it, and the rights you have under the General Data Protection Regulation (GDPR), the Digital Personal Data Protection Act, 2023 (DPDP, India), and similar laws.
1. Who we are
ShotVault is a mobile app that helps you organize and search your screenshots using artificial intelligence. The app is published by the ShotVault team.
To contact us, please use the in-app support option in Settings → Help & Support.
2. What we collect
2.1 Information you give us
| Data | Why we need it |
|---|---|
| Email address | To create your account and let you sign in |
| Display name (optional) | To personalize your experience |
| Password (hashed) | To secure your account — never stored in plain text |
| Subscription / purchase tokens | To verify and grant access to paid plans |
2.2 Screenshot content you upload
When you import a screenshot from your photo gallery:
- The image is uploaded to our servers and stored alongside your account.
- The text inside the image is extracted using Optical Character Recognition (OCR) so that you can search it.
- The image is analysed by an AI model (Gemini / GPT vision) to categorize it into one of 14 categories and to extract entities (phone numbers, URLs, amounts) for in-app Quick Actions.
We do not share, sell, or analyse your screenshots for advertising. We do not use your screenshots to train any AI models.
2.3 Information collected automatically
| Data | Why we need it |
|---|---|
| Login timestamps | To secure your account and analyse usage trends |
| Last-active timestamp | To compute active-user counts |
| Device platform (iOS / Android) | For diagnostics |
| Crash logs (anonymized) | To fix bugs |
2.4 Permissions we request
| Permission | Purpose |
|---|---|
| Photo library / gallery access | So you can pick screenshots to import into ShotVault |
We do not access your photos in the background. We only see the specific screenshots you choose to import.
3. Why we process your data (legal basis)
Under GDPR and DPDP, our lawful bases are:
- Performance of contract — to provide the ShotVault service you signed up for.
- Legitimate interests — to keep the service secure, fix bugs, and improve quality.
- Consent — for optional features (notifications, marketing) that you can opt in or out of at any time.
- Legal obligation — to comply with tax, accounting and law-enforcement requirements.
4. Who we share data with
We use the following processors. They only receive the minimum data needed to do their job.
| Processor | What they receive | Purpose |
|---|---|---|
| Google LLC (Gemini API) | Screenshot image bytes | OCR + categorization (no training retention) |
| OpenAI, L.L.C. (GPT vision API) | Screenshot image bytes | OCR + categorization (alternative engine) |
| Google Play | Purchase token, product ID | Subscription validation |
| Apple App Store | Purchase token, product ID | Subscription validation |
| MongoDB Atlas | All app data | Encrypted-at-rest storage |
| Hosting provider | Application traffic | Running the backend service |
We do not sell your personal data to any third party.
5. Where data is stored
- Primary servers are hosted in India / Asia-Pacific regions for low latency. Some processors (Google, OpenAI) may process data in the United States.
- All data in transit is protected with TLS 1.2 or higher.
- Passwords are stored as salted bcrypt hashes.
6. How long we keep it
| Data type | Retention |
|---|---|
| Account info | Until you delete your account |
| Screenshots | Until you delete them or delete your account |
| Login logs | 12 months, then deleted |
| Purchase records | 8 years (regulatory requirement) |
| Backups | Rolling 30-day backups |
You can delete your account at any time from Settings → Account → Delete Account inside the ShotVault app. Deletion is permanent and processed within 30 days.
7. Your rights
Under GDPR and DPDP you have the right to:
- Access — request a copy of your data.
- Rectify — correct inaccurate data.
- Erase — ask us to delete your data.
- Restrict / object — limit processing in some cases.
- Portability — receive your data in a machine-readable format.
- Withdraw consent at any time.
- Complain to your local data protection authority.
To exercise any of these rights, use the in-app support option in Settings → Help & Support. We respond within 30 days.
8. Children
ShotVault is not intended for children under 13 (or under 16 in the EEA where local law requires). We do not knowingly collect data from children. If you believe we have collected data from a child, use the in-app support option to contact us and we will delete it.
9. Security
We protect your data with:
- Encryption in transit (HTTPS / TLS) and at rest.
- Bcrypt password hashing with a per-user salt.
- JWT access tokens with rotating secrets.
- Principle-of-least-privilege access to production systems.
- Regular security reviews.
No system is 100% secure. If you suspect a breach, please report it via in-app support immediately.
10. Changes to this policy
We may update this policy as the app evolves. We will notify you in-app if changes are material. The "Last updated" date at the top will always reflect the current version.