Legal
Last updated: October 2026
We keep this simple: SHOTT collects what it needs to run the app, never sells your data, and gives you control to delete everything.
SHOTT ("we", "us", "our") is a photography challenge platform. When you use the SHOTT app or website, you trust us with your information. This policy explains what we collect, why, and how we protect it.
Account information — When you register, we collect your name, email address, and the password you create (stored as a secure hash, never in plain text).
Profile information — Username, profile photo, and any bio you choose to add. All optional except username.
Photos you submit — Challenge submissions are uploaded to our secure storage and, if marked public, shown on the in-app feed.
Usage data — Pages visited, challenges attempted, streaks, points, and interactions (likes, comments, follows) inside the app.
Crash and diagnostic data — When the app crashes, freezes or hits an error, iOS gives the app a technical report (app and iOS version, device model, and where in the code it happened). We send it to our servers, linked to your account, only to find and fix bugs. It contains no photos, messages or contacts.
Device information — Device model, iOS version, timezone, and a device identifier used solely to send push notifications.
Contacts (optional) — Only if you tap “Find friends from contacts” and grant access. Your contacts' e-mail addresses are converted on your device into one-way SHA-256 hashes, and only those hashes are sent to check which belong to existing SHOTT accounts. We do not upload or store your contacts, names, or the hashes. If your account is new, people we match may get a one-time notification that you joined SHOTT; we keep only a record that this notification was sent, so it isn't repeated. You can stop others finding you this way, and stop receiving these notifications, with the “Let contacts find me” setting in your profile.
Location — We do not collect or store precise GPS location. If you tap “Use my location” during setup, your device takes one approximate reading and converts it on the device into your city name; only that city is saved to your profile (shown on the SHOTT map and city leaderboard), and you can change or remove it at any time. If you choose to geotag a photo, that metadata is embedded by your device and you can remove it before uploading.
We do not use your data for advertising. We do not build advertising profiles. We do not sell your data to third parties.
We share data only in the following limited circumstances:
We keep your data as long as your account is active. When you delete your account, your profile, submissions, and personal data are permanently removed within 30 days. Aggregate analytics that cannot be traced back to you may be retained.
Depending on where you live, you may have rights to access, correct, export, or delete your personal data. You can:
EU and UK users have additional rights under GDPR. California residents have rights under CCPA. Contact us and we will respond within 30 days.
All data is encrypted in transit (TLS 1.3) and at rest. Passwords are hashed using bcrypt. We perform regular security reviews and do not store payment information — all purchases go through Apple's App Store.
SHOTT is not directed to anyone under 13. If we become aware that a child under 13 has created an account, we will delete it promptly. Users between 13 and 17 require parental consent where applicable by local law.
If we make material changes, we will notify you in the app and update the "Last updated" date above. Continued use after changes are posted means you accept the revised policy.
Questions or requests: getshott@gmail.com