Privacy Policy
This Privacy Policy explains what information Shotwright collects when you use the Service, how we use it, and the rights you have over it.
1. Information we collect
- Account information. Email address, display name, and authentication identifiers from sign-in providers (Google, Apple) when you choose them.
- Your Content. Canvases, nodes, comments, generated documents, uploaded images, references, and any other content you create or upload.
- Usage data. Limited operational telemetry such as AI request counts (used to enforce rate limits) and error logs.
- Billing data. Handled by our payment processor (Stripe). Shotwright stores only the customer and subscription identifiers, never your card number.
2. How we use your information
- To provide, secure, and improve the Service.
- To generate documents you request from your canvas content using the Anthropic Claude API.
- To communicate transactional messages (account verification, billing, security notices).
- To enforce our Terms and prevent abuse.
We do not sell your personal information. We do not use Your Content to train AI models, and we do not share Your Content with advertisers.
3. Sub-processors
We rely on the following service providers to operate Shotwright:
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database, authentication, storage, realtime | Account info, Your Content, integration tokens (encrypted) |
| Anthropic | AI document generation (Claude API) | Canvas content sent at the moment of generation |
| Stripe | Subscription billing | Email, customer/subscription IDs, payment data (held by Stripe) |
| Vercel | Application hosting and CDN | Request logs (IP, user agent), short-term |
| Google (Analytics 4) | Product & marketing analytics (consent-based) | Usage events, IP-derived approximate location, device info |
| PostHog | Product analytics (consent-based) | Usage events, device info |
4. Cookies & analytics
We keep cookies to a minimum and group them in two kinds:
- Essential. A first-party Supabase cookie keeps you signed in. It is required for the Service to work and is not optional.
- Analytics (consent-based). With your consent, we use Google Analytics 4 and PostHog to understand how the Service is used (which features help and which don't), so we can improve it. These set analytics cookies / local storage and record usage events, approximate location derived from IP, device and browser, and the marketing source you arrived from (e.g. a campaign tag). No analytics scripts load until you accept, you can decline, and either way we never send your canvas content to them.
You can change your choice at any time by clearing this site's data in your browser. We do not use these tools to build advertising profiles, and we do not sell this data.
5. Your rights
Depending on your jurisdiction (e.g. EU/UK GDPR, California CCPA), you may have rights to access, correct, port, or delete your personal data, and to object to or restrict certain processing. You can:
- Export your data from your account settings (machine-readable JSON archive).
- Delete your account from your account settings; this permanently removes your account, projects, uploads, and integration tokens.
- Request rectification by editing your profile or contacting us.
- Object or withdraw consent by emailing the address below; you may also stop using the Service at any time.
6. Data retention
We retain your account data while your account is active. When you delete your account we delete your projects, canvases, comments, uploads, and integration tokens. Cached AI-derived metadata is automatically purged within 90 days. Operational logs are retained for up to 30 days for security and debugging purposes. We may retain a minimal record longer where required by law (e.g. tax records).
7. Security
Data is encrypted in transit (TLS) and at rest. Access to production data is restricted and logged. No system is perfectly secure; if we discover a breach affecting your data, we will notify you and applicable authorities as required by law.
8. International transfers
Shotwright currently hosts data in the United States. If you access the Service from outside the US, your data will be transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses or equivalent mechanisms.
9. Children
Shotwright is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
10. Changes
We may update this Policy from time to time. Material changes will be announced in-product or by email at least 30 days in advance.
11. Contact
Questions about this Policy or your data? Contact us at privacy@shotwright.com.