Privacy Policy

Who is responsible

Neel Gajjar, an independent developer based in India who makes and sells VizShot (“we”), is responsible for the personal information described here, as its controller where that term applies. This policy covers the VizShot app, website, accounts, Founding Testers program and support. Questions or privacy requests can go to [email protected].

The app

The app does not send us your screenshots or recordings. You can save them to your computer or copy screenshots to your clipboard. If you set up uploads, they go straight from your computer to storage you control (such as Cloudflare R2, Amazon S3 or Backblaze B2), never through us, and that provider’s privacy policy covers them. Your storage access key stays in your computer’s secure credential store (the macOS Keychain or the Windows Credential Manager).

We do not monitor what you capture, claim ownership of it, or use your captures to train AI models. We do not operate a screenshot or recording storage service. If you choose to send a capture or a log to support, we receive that material only because you sent it; see “When you contact us” below. Public storage permissions or shared links can expose a capture to other people, so check your provider’s settings before sharing.

The app shows no advertising. What it sends to us is described below:

• Your license key. When you activate a key, and about once a day after that, the app sends the key, a random ID it made for your computer when it first ran, a fingerprint of the computer, whether it is a Mac or a PC, the app version, and a computer model label when supplied by the app. The fingerprint is a hash derived from a hardware ID, not the raw hardware ID. These identifiers are pseudonymous, not anonymous: we can associate them with your license and account. We use these to count your key’s computers (at most two) and to stop one computer’s activation being copied to another. If you choose Deactivate in the app, it also sends the signed activation record to prove which computer is giving its place back. Our server necessarily receives the connection’s IP address too, as described below.
• Updates, on the Mac. If automatic checks are on (Settings, Updates), the Mac app asks about once a day whether there is a newer version, sending its version, whether the processor is Apple silicon or Intel, and the same random ID, which lets a new version reach a steady share of computers first. The Windows app is updated by the Microsoft Store and does not use our update check.
• A problem report, only when you press Send. “Report a problem” in the app sends what you wrote, an email address if you give one, the app’s version, your system’s version and processor type, the sizes of your screens, and whether the app is on its trial or has a key (never the key itself). While “Include VizShot’s log” stays ticked it also sends the end of the app’s log and, on a Mac, the start of the system’s latest crash report for VizShot. Before any of it leaves your computer the app takes out the names of your folders, every link that is not ours, the bucket, account and link domain from your storage settings, and the identifiers the crash report carries for your computer and your user account. It can still hold the names of capture files. No screenshot, recording or file is sent, and “Show what will be sent” opens exactly the text that would go, so you can read it first.
• Usage counts and crash reports, only if you turn on “Help improve VizShot”. The switch is off until you say yes: the app asks once, and it is in Settings, Capture. While it is on, the app sends once a day how many times each thing was used that day (captures of an area, a window and the whole screen, recordings, uploads that worked or failed, and errors by kind), with the app’s version, your system’s version, whether it is a Mac or a PC and which copy it is. After a crash it sends where the app crashed: the place in our code, the error’s words and the names of the functions it was in. Both carry a random ID the app makes for this alone. It is not the ID your key is activated with, we cannot connect it to your key, your account or your email, and it is thrown away when you turn the switch off. Never sent: your screenshots and recordings, file names, folders, links, storage settings, or the app’s log.

We do not save your IP address with a problem report, a usage count or a crash report. Our server holds it in memory for up to a day, only to limit how many one network can send, and its ordinary request logs are described under “This website”.

Settings and the app’s log stay on your computer. The signed activation record can include your account email and license information displayed in the app. It is kept locally and sent back when needed to prove an activation, including when you deactivate. The log is never sent by itself: it leaves only inside a problem report you chose to send, or if you send it to us yourself when asking for help.

This website

• Your account: your email address, your name if you gave it at checkout, and when you last signed in. You sign in with an emailed link, which works once and for 15 minutes.
• Your keys and computers: each key (stored encrypted), and for each computer its random ID, the fingerprint, Mac or Windows, a model label when supplied, the app version, and when it was activated and last checked in.
• Your orders: from Dodo Payments, the amount, currency, tax, country, status, refunds and the email address used.
• Founding Testers: if you apply, we keep your email, platform preference, optional note, email-verification and review status, the IP address and country you applied from, and the key we grant if approved. We use this to review applications, to notice one person applying many times, and to prevent duplicate grants. If you send feedback, we keep its category, platform, app version if provided, description, reproduction steps and review status. Please do not include screenshots, recordings, passwords or other people’s personal information in feedback.
• An activity log of what happens to keys and accounts (bought, activated, removed, refunded, and so on), kept 13 months, with your country. When you ask for a sign-in link and when you sign in, the log keeps the IP address you did it from, so we can tell when an account is used by someone else or when many accounts are made from one place. For everything else in the log, your IP address is stored only as a value scrambled with a key that changes daily. Deleting your account removes the addresses.
• A count of Download clicks: when a Download button is pressed we add one to that day’s number for Mac or for Windows. It is a number and nothing else: it says nothing about who pressed, and needs no cookie. So that one visitor counts three times a day at most, the server holds the address that pressed in memory for a day; it is not saved.
• Functional cookies: one keeps you signed in (30 days from your last visit, at most 90), a short-lived cookie ties a sign-in link to the browser that requested it, a short-lived checkout cookie lets that browser claim its purchase, and a time-zone cookie (up to one year) shows dates in your local time on account pages. These need no consent. We use no advertising cookies.
• Google Analytics: on the public pages (not your account, sign-in, checkout or admin pages), Google Analytics counts visits. It loads from Google, sets its cookies (_ga and _ga_ plus our measurement ID, up to two years) and sends Google the page address without anything after it, the page title, your approximate location, your browser and system type, and how you arrived. We use it to see which pages are read, and we turn off Google’s advertising features. It does not run in a browser that sends a Global Privacy Control or Do Not Track signal. Google processes this data under its own privacy policy. You can turn it off for your browser at any time, which also removes its cookies: Change my cookie choice
• Emails we send you: sign-in links, your key, and notices about your key, account or tester application. They carry no tracking pixels or tracked links. We don’t send marketing email.
• Our server and network provider keep ordinary request logs, including IP addresses, for a short time, for security and to fix problems.

When you contact us

If you email support, send feedback or send a problem report from the app, we receive your address if you gave one, the message and anything you choose to include. We use it to respond, troubleshoot and improve the product. Please remove passwords, storage credentials, payment details and other people’s private information before sending a log or capture. We do not need access to your storage account to check your license, and we will not publish your support material as a testimonial or marketing example without your permission.

Payments

Dodo Payments sells VizShot on our behalf as the merchant of record. It collects your card and billing details under its own privacy policy; we do not collect or store your full card number or security code. Dodo sends us buyer, billing, payment and license information needed to deliver the purchase, handle refunds and reconcile orders. This includes your email, name if given, country and order details. Its payment notices may contain additional billing or payment-method metadata, which we retain encrypted for the periods described below. Dodo is separately responsible for the information it processes as merchant of record.

Who helps us run VizShot

We use these providers to operate VizShot; each receives information needed for its role. Dodo handles buyer information under its own privacy policy:

• Dodo Payments: payment, tax, invoices, refunds and license keys.
• Amazon Web Services: sending our emails, and serving the Mac download.
• Cloudflare: our domain’s DNS and protecting the website from attacks; it sees requests to the site. On the sign-in, Founding Testers and contact pages its Turnstile check tells people from bots: it runs in your browser there, looks at your network address and browser, and is not used for advertising.
• MailCull, an email-checking service we also run: when you give an address on the sign-in, Founding Testers or contact form, we ask it whether that address can receive mail. It gets the address and nothing else, and sends no mail to it.
• Our server host: running the website and its database, with encrypted backups.
• Microsoft: distributing the Windows app through the Microsoft Store, under Microsoft’s privacy statement.

We don’t sell or rent your information, and we don’t share it for advertising. Authorised people and service providers may access information where needed to run the service or help you; encryption does not mean a key can never be accessed by the service that needs to display or validate it.

We may also disclose information when legally required, or where necessary and lawful to investigate fraud, protect people or establish or defend legal claims. We limit such disclosures to what is needed. If ownership of VizShot changes, relevant account and license records may transfer so the service can continue, with notice of any change to who is responsible and the protections required by law.

Why we use it

Where data protection law requires a legal basis, we use information to provide what you bought, your account and related support (our contract with you); to run the optional Founding Testers program, review applications, grant keys and act on feedback (our legitimate interest); to prevent fraud and abuse of keys and keep the service secure (our legitimate interest); to read a problem report you chose to send, answer it and fix what it shows (your request, and our legitimate interest in a working app); and to keep records the law requires (a legal obligation). One thing happens only with your consent, and stops when you take it back: usage counts and crash reports from the app, which the “Help improve VizShot” switch turns on and off. Google Analytics on this website counts visits to the public pages so that we know which pages are read (our legitimate interest); you can turn it off under “This website” above, and it never runs in a browser that asks not to be tracked. The app and the website work the same whichever you choose. We consider your privacy when relying on legitimate interests, and you may object as explained below. Where a use requires consent, we will ask separately and you can withdraw it. Without the information needed to issue or validate a key, sign you in, or respond to a request, we may not be able to provide that part of the service.

How long we keep it

• Your account, until you delete it.
• License and activation records, while needed to keep your key working, manage its computer limit and prevent abuse, including after account deletion.
• Unverified tester applications, up to 30 days; verified applications not selected yet, up to 180 days; rejected applications, up to 90 days after review.
• Approved applications while the account exists, so we can manage the granted key. Feedback, up to 13 months.
• Problem reports sent from the app, with their log, up to 180 days. We hold a limited number at once (5,000, and a limited amount of log), so a report that arrives when that room is full may be kept without its log, or not kept.
• Usage counts and crash reports from copies with “Help improve VizShot” on, and the daily count of download-button presses, up to 180 days.
• The activity log, 13 months.
• Payment notices from Dodo: processed notices, up to 13 months; notices that fail processing stay encrypted until we investigate and resolve them.
• Order records, as long as tax and accounting law requires. Dodo Payments keeps its own records too.
• Support correspondence and attachments, while needed to resolve and follow up your request or handle a related dispute, then deleted unless a legal obligation requires longer retention.
• Backups, 35 days.

Your choices and rights

You can see your keys and computers on your account page, remove computers, and delete your account there. Deleting it removes your email address and name, signs you out everywhere, and takes your email off your orders, and removes your tester application and feedback; your keys keep working. If a tester key is still being granted, deletion waits until we confirm the result so the key is not left unmanaged. Deletion does not immediately erase every record: license records, payment notices, security logs, records we must keep by law and backups follow the retention rules above. Information held separately by Dodo is covered by its policy. Ask us if you want help understanding or requesting the removal of remaining information.

You can turn “Help improve VizShot” off at any time in the app’s Settings, under Capture. The app then throws away the random ID and the counts it was holding. The counts and crash reports we already have carry only that random ID, so we cannot tell which are yours: we cannot look them up, send them to you or delete them one by one, and they are deleted when they reach 180 days. To have a problem report deleted sooner than its 180 days, email us its number (it starts with R-) from the address you gave with it, or tell us enough to find it.

Depending on the law that applies, you can request access, correction, deletion, a portable copy, restriction of processing or object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing. Email [email protected]. We may need proportionate verification to protect you from someone else requesting your information. We normally respond within one month and follow any shorter legal deadline; if a permitted extension is needed, we will explain why and when to expect a response. You can also complain to your local data protection authority where that right applies.

License limits and security checks can automatically refuse an activation or temporarily limit requests. If you believe a restriction is wrong, contact us for a human review under our suspension policy.

Keeping it safe

Connections to our website and license service use HTTPS. License keys and the payment notices Dodo sends us are stored encrypted; admin access needs a second factor; and the app verifies signed activation records before trusting them. No system is completely secure. If a personal data breach occurs, we will follow any legal duties to investigate, respond and notify affected people or authorities. The Security page has more.

Where it is processed

Our providers may process information outside your country. Where the law requires it, they do so under applicable transfer safeguards, such as standard contractual clauses or an adequacy decision. You can contact us for information about the safeguards applicable to your information.

Children

VizShot is not directed at children under 13. Other local laws may set a higher age or require a parent’s permission; those protections still apply. If you believe a child has given us personal information without any required permission, contact us so we can investigate and take appropriate action, including deletion.

Changes

If this policy changes we’ll update the date above, and email account holders about any change that matters before it applies, unless an urgent legal or security change needs to take effect sooner. A new policy does not itself give us consent for a new use that requires your permission.