Privacy Policy

This Privacy Policy explains what personal information ShotPoet ("ShotPoet", "we", "us" or "our") collects when you use the ShotPoet website, apps and related services (the "Service"), how we use and share it, and the choices and rights you have. ShotPoet is operated by Yaohui Li, a sole proprietor, who is responsible for the personal information described here. Payments are processed by our payment provider, which is responsible for the payment information it collects.

1. Information we collect

Information you give us

Account information. Your email address, your password if you set one, and the user name and profile picture you add. Passwords are stored only as a salted one-way hash.
Verification codes. When you sign in with your email address or reset your password, we send a one-time code to that address and store only a one-way hash of it until it is used or expires.
Google sign-in. If you sign in with Google, Google shares your email address and basic profile information with us. We keep your email address and your Google account ID.
Content. The prompts, reference images and annotations you submit, including the images you mark up; the settings you choose, such as model, aspect ratio and resolution; and the images, videos and audio generated for you.
Messages. Your email address and the contents of any message you send us.
Email preferences. Whether you subscribe to product update emails, and when and how you subscribed or unsubscribed, such as in Manage Account or through an unsubscribe link.

Information collected automatically

Usage records. Your generations and their status, your credit balance and the history of credit charges, returns, bonuses and adjustments, your sign-in times and active sessions, including the device type, browser, operating system and IP address of each session, which you can see in Manage Account.
Product events. For signed-in accounts, we record Explore views, Explore clicks and checkout openings with the account, event source and time.
Visitor statistics. Our self-hosted analytics service counts page views and actions such as sign-ups, sign-in steps, generations started and whether they succeeded, downloads, favorites, uploads, checkout openings, completed payments and refunds, shares, Explore clicks, settings you change and requests that fail. It records the type of page rather than its full address, the referring site and campaign parameters, your browser, operating system, device type, screen size and language, and an approximate location derived from your IP address. It does not use cookies and does not record your IP address, prompts or email address. Visits are grouped by a one-way hash of your IP address and browser that changes every month. When you are signed in, your visits are also tagged with a pseudonymous identifier derived from your account, together with whether you have made a purchase, whether you joined through an invitation, the date you joined, a range for how many generations you have made and your interface language, so that visits from your different devices can be viewed together. The identifier does not contain your email address. Only we can match it to your account, and we do so only internally.
Referrals. If you create an account through an invitation link, we record which account invited you. The inviter sees a masked version of your email address, when you joined and whether a referral reward has been granted.
Email delivery. For each product update email, we record whether it was sent or failed and whether you unsubscribed through it. Our email delivery provider tells us when an email bounces or is reported as spam.
Log and device data. Our servers record technical information about each request, such as IP address, browser and device type, the page or action requested, the time and any errors.
Cookies and browser storage. Described in section 5.

Information from Dodo Payments

When you buy credits, Dodo Payments, our payment provider, shares with us the details we need to deliver your purchase, such as your email address, the product, price, currency, country and transaction ID. We do not receive your full card or bank details.

2. How we use information

To provide the Service: create and secure your account, sign you in, run generations, store and deliver your results, and maintain your Library and credit balance.
To process purchases and refunds with Dodo Payments.
To keep the Service safe: check prompts and reference images against our Acceptable Use Policy before each generation, prevent fraud and abuse, enforce our Terms of Service, investigate suspected violations and diagnose problems.
To respond to your requests and send service messages about your account, purchases, security or changes to our policies.
To send product update emails about new models, features and offers, only if you subscribe in Manage Account. Each email has an unsubscribe link, and you can also unsubscribe in Manage Account. Unsubscribing does not stop service messages. If an email to your address permanently bounces or is reported as spam, we add the address to a suppression list and unsubscribe it.
To understand, in aggregate, how the Service is used, so we can fix issues and plan improvements.
To comply with legal obligations and respond to lawful requests.

We do not use your content to train AI models, we do not sell your personal information, and we do not use it for targeted advertising.

Legal bases in the EEA, UK and Switzerland

We process your information to perform our contract with you, which covers providing the Service and handling purchases; for our legitimate interests in security, fraud prevention, support and improving the Service; to comply with legal obligations; and with your consent where it is required, such as for product update emails. Where we rely on consent, you can withdraw it at any time.

3. AI model providers

To generate a result, we send your prompt, reference images, annotations and settings to the provider of the model you choose, such as OpenAI, Google, xAI, ByteDance, Alibaba Cloud or Recraft, either directly or through a service that routes requests to that provider. The provider processes this data to create the result and returns it to us. Before a generation starts, we also send its prompt and reference images, in the same way, to an AI model from OpenAI that checks them against our Acceptable Use Policy; if the image model's safety system blocks a result, we send its prompt to the same AI model to revise it before retrying. If you use prompt enhancement, we also send your prompt and reference images to the same AI model, which rewrites the prompt before generation. Each provider's own terms and privacy policy govern how long it keeps the data and whether it uses the data to improve its models. Avoid including sensitive personal information in prompts and images.

We share personal information only as follows:

Service providers that process it on our behalf, including our server hosting provider, Cloudflare for network delivery, security and file storage, and our email delivery provider, which sends verification codes, account notices and the product update emails you subscribe to. They may use it only to provide their services to us.
AI model providers, as described in section 3.
Google, when you choose to sign in with your Google account.
Dodo Payments, which acts as Merchant of Record and processes payments, taxes, refunds and disputes as an independent controller under its own privacy policy. For a disputed purchase, we may provide the transaction, purchase device and IP information, credit delivery and usage records, and purchase policy documents as evidence.
Legal and safety. When required by law or legal process, or when disclosure is necessary to protect the rights, property or safety of our users, the public or ShotPoet, including reporting child sexual abuse material to the authorities.
Business transfers. As part of a merger, acquisition, financing or sale of all or part of the Service, with this Privacy Policy continuing to apply to your information.
Public links. When you create a public link for an item in your library, anyone with the link can view that image, video or file, its title and the model used to make it, without signing in. Prompts and reference images are not shown. A link stops working when you revoke it or delete the item.
With your consent or at your direction.

5. Cookies and browser storage

We use only the cookies and storage the Service needs to work:

sp_session keeps you signed in for up to 30 days.
sp_google protects the Google sign-in flow. It is deleted when sign-in completes, or after 10 minutes.
sp_invite remembers the invitation link you arrived from for up to 30 days, so the invitation can be credited when you create an account. It is deleted when you sign in.
Local storage remembers your preferences on your device, such as theme, language, view settings and generation settings.

Cloudflare may set cookies that are needed for security and performance. Our visitor statistics do not set cookies or store anything in your browser. We do not use advertising cookies or third-party analytics.

6. How long we keep information

Account information and content are kept while your account is open.
Deleted items. Deleting an item removes it from your Library. Files are scheduled for automatic cleanup after the configured deletion retention period, which defaults to 30 days. Generation and financial records may remain for billing, security and dispute handling. You can ask us to erase specific items sooner.
Account deletion. When your account is deleted, we delete your account information and content within 30 days, except for information we must keep for legal, tax, accounting or dispute purposes, such as purchase and credit records.
Email records. Records of the product update emails sent to you are deleted when your account is deleted. Addresses on the suppression list are kept so that we do not email them again.
Database backups are encrypted and kept for 30 days. Stored content files are managed separately.
Logs are kept for a limited period for security and troubleshooting.

Dodo Payments keeps payment records under its own retention policy.

7. Security

We protect your information with measures such as encrypted connections, hashed passwords and session tokens, private file storage that only your account and authorized staff can access, and restricted administrative access. No system is completely secure, so use a strong, unique password and tell us if you suspect unauthorized access to your account.

8. International transfers

We and our providers process information in several countries, including the United States, whose data protection laws may differ from those where you live. When we transfer personal information out of the EEA, the UK or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

9. Your rights

Depending on where you live, you may have the right to:

access the personal information we hold about you and get a copy of it.
correct inaccurate information.
delete your information or your account.
receive your information in a portable format.
object to or restrict certain processing.
withdraw consent where we rely on it.
complain to your local data protection authority.

If you live in California, you have the right to know what personal information we collect and how we use it, to access, correct and delete it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law.

To exercise your rights, email support@shotpoet.ai from the address on your account. We may need to verify your identity, and we will respond within 30 days, or sooner if the law requires. You can also download your results from your Library at any time.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version on this page and change the date at the top. If the changes are significant, we will also notify you by email or in the Service before they take effect.

12. Contact

For privacy questions or requests, contact support@shotpoet.ai.