Privacy Policy

Data we handle

Guest projects. When you work as a guest, project JSON and image blobs are stored in your browser's IndexedDB. UltraShot.io sets no expiry for this local data. It remains until you or your browser removes it. Exports are created locally in your browser.

Accounts and saved projects. If you create an account or save a project online, we handle your email address and user ID. We also store project JSON, project names, text, layout settings, and image metadata in our database. Uploaded images are stored in Cloudflare R2.

Authentication and security. Our systems process your source IP address to secure sign-in and enforce rate limits. We create HMAC-derived identifiers from email and IP values for rate limiting. Those identifiers are kept for no more than 24 hours plus one minute. Safe authentication logs do not contain raw email addresses, raw IP addresses, or sign-in codes. We keep those logs only for as long as operationally needed.

Email delivery. Resend receives your email address and the login message and code so it can deliver your sign-in email.

Google Analytics and cookies

Google Analytics loads automatically on every UltraShot.io route. It collects page and session activity, browser and device information, approximate location, and cookie or client identifiers.

Google Analytics cookies include _ga and _ga_<measurement-id>. They can last for up to two years unless you block or delete them through your browser. Depending on where you live, consent may be required before these cookies are used.

Google Fonts

When you select a Google Font, your browser requests the chosen font from Google. That request can disclose your IP address, browser information, and the requested font to Google.

Why we use personal data

• To authenticate you, save projects, deliver exports, and provide requested support. We process this data to perform our contract with you or to take steps you request before entering one.
• To secure, diagnose, maintain, and improve the service. We rely on our legitimate interests where they are not overridden by your rights.
• To understand and improve use of the service. We rely on our legitimate interests in measuring how the service performs. Separate cookie-consent rules may also apply where you live.
• To comply with legal duties and establish, exercise, or defend legal claims.

Who receives personal data

We disclose personal data only as needed to:

• providers that host our application and database;
• Cloudflare, which provides object storage through Cloudflare R2;
• Resend, which delivers authentication email;
• Google, which provides Analytics and selected Google Fonts;
• professional advisers, insurers, and service providers that support operations; and
• courts, regulators, law enforcement, or other parties when required by law or needed to protect rights and safety.

International transfers

Some recipients may process personal data outside your country. When applicable law requires safeguards, we use an adequacy decision, approved contractual protections, or another lawful transfer mechanism. Contact [email protected] for information about the safeguard relevant to your data.

How long we keep data

Guest project data has no app-defined expiry because it remains in your browser's IndexedDB. Account and saved-project data is kept while needed to provide your account and for reasonable legal, security, backup, and dispute-resolution needs. You can delete projects and can contact [email protected] to close your account.

HMAC-derived rate-limit identifiers are kept for no more than 24 hours plus one minute. Safe authentication logs are retained according to operational need. Google Analytics cookies can remain for up to two years unless blocked or deleted. Our providers may retain data under their own documented schedules and legal duties.

Security

We use technical and organisational measures designed to protect personal data, including restricted access, authentication controls, rate limiting, and separation of raw sign-in values from rate-limit identifiers and safe logs. No system can guarantee complete security.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data, and to object to certain processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Contact [email protected] to close an account or exercise a right. We may need to verify your identity first.

You may object to processing based on our legitimate interests.

You may also complain to your local data protection regulator. In the United Kingdom, you can make a complaint to the Information Commissioner's Office.

Children

Younger users may use UltraShot.io with permission from a parent or guardian where the law requires it. If you believe that a child has provided personal data without appropriate permission, contact [email protected].

Changes to this policy

We may update this policy when the service, our providers, or the law changes. We will post the revised policy here and change the effective date. If a change materially affects your privacy rights, we will take reasonable steps to provide additional notice.

Contact