ShotGramPrivacy Policy
ShotGram is a social app for sharing photos, reels, stories, messages and community clans. This policy explains what we collect, why we use it, and how you can remove it. It applies to shotgram.app and the ShotGram apps for Android and iOS.
What we collect
- Account information — email address, username, display name and date of birth (to enforce the minimum age). If you choose to add them, we may also store a phone number, bio, website and social links.
- Content and communications — posts, reels, stories, captions, comments, likes, follows, profile/cover images, direct messages, voice messages, clan membership, clan channels and clan text messages.
- Safety and technical information — sign-in/session records, moderation reports, blocks, account-security events, device/browser type and an approximate country derived from the device context or a phone country code you choose to save.
- Push-notification identifiers — when you allow notifications, ShotGram stores the push token issued for your device and whether it is an Android or iOS device so we can deliver messages, mentions and account activity. The token is removed when it is invalidated and may be removed when you sign out or clear notification registration.
- Optional contact matching — only contacts you deliberately choose are processed. Phone numbers and email addresses are normalised and SHA-256 hashed on your device before matching data is sent to ShotGram. We store the hashes used for matching; the address-book names of people who are not on ShotGram are kept only on your device for the invite list and are not uploaded by this feature.
- Precise location — only when you share it — ShotGram requests location only at the moment you tap to share it in a direct message. If you start a live location share, we store your latest coordinates and accuracy so the person you chose can see them, together with a record of who you shared with and when the share expires. Every share has an expiry of 1, 8 or 24 hours. When you stop sharing, or when the last share expires, your stored coordinates are deleted from our servers rather than hidden. Location is never collected while you are simply using the app, and never collected in the background.
- Optional device permissions — camera, microphone, photo library and contacts are requested only when a feature that needs them is used. ShotGram does not intentionally record camera or microphone content in the background.
What we do not collect for advertising
We do not sell personal data, we do not show third-party behavioural advertising, and we do not build advertising profiles from your content. ShotGram does not intentionally collect precise GPS location for the features described in this version.
Sponsored posts from verified businesses
Verified businesses (green badge) can pay ShotGram, under a contract made outside the app, to show some of their public posts as Sponsored in Home and in the stories row. Sponsored posts are always labelled. They are not chosen using data from other apps or websites, and we do not track you across other companies' apps or websites. To limit how often you see them and to give the business simple totals, we count how many times an ad was shown and opened (per day). A business only ever sees totals — never who saw or tapped its ad. You can hide any business's ads from the ⋯ menu on the ad.
How your data is used
- To run ShotGram: authenticate you, display content, deliver messages and calls, power Explore, manage clans and keep your session working.
- To notify you about messages, mentions, tags, follows and other account activity when you opt in to notifications.
- To help you find people you know when you explicitly use contact matching.
- To protect the community: detect spam/abuse, handle reports and blocks, enforce suspensions and investigate security incidents.
- To comply with valid legal obligations.
Service providers and storage
Account data and uploaded media are stored with Supabase (database, authentication, realtime services, object storage and server functions). The website and serverless endpoints run on Netlify. Transactional/security email may be delivered by Resend. Native push notifications are delivered through Firebase Cloud Messaging on Android and Apple Push Notification service on iOS. These providers process only the information needed to perform their service and operate under their own security and privacy terms. Traffic is encrypted in transit.
- Supabase — database, authentication and media storage.
- Cloudflare Stream — live video ingest and playback. When you broadcast or watch a live stream, your video and audio pass through Cloudflare, and Cloudflare receives the connection data needed to deliver it.
- Netlify — website and API hosting.
- Resend — transactional email such as sign-up verification and security alerts.
- Apple and Google — delivery of push notifications to your device, when you have allowed them.
ShotGram also stores a small amount of data in your browser or app: your sign-in session, your interface preferences, and an offline cache of the app shell. This stays on your device. Clearing site data or deleting the app removes it.
Who can see your content
Public posts and public profile information can be visible to other ShotGram users. If you use a private account, follower-gated content is limited to people you approve. Clan names, tags and discovery information may be public, while member-only clan channels are restricted according to the clan's configured roles and permissions. Direct messages are visible to participants; authorised ShotGram staff may access content where needed to investigate a report, enforce the rules, secure the service or comply with law. View-once media is designed to be removed after it is opened or expires.
Contact matching controls
Contact matching is optional. You choose which contacts to share with the picker. You can stop contact matching from ShotGram settings; this removes the stored contact hashes and clears ShotGram's local invite list on that device.
Children
ShotGram is not for children under 13, or under the minimum age required in a user's country if that minimum is higher. The signup flow requires a date of birth and rejects accounts below the configured minimum age. Accounts determined to belong to under-age users may be removed.
Deleting your data
You can delete your account and associated account data from Settings → Delete account inside the app. Deletion is permanent and is intended to remove your profile and user-linked content such as posts, stories, comments, likes, follows and messages in accordance with the service's deletion process.
Instructions, including how to request deletion without signing in: shotgram.app/delete-my-data.html
You can also deactivate your account, which hides it until you return. Operational backups, where used, are rotated according to the hosting provider's retention process and are not used to restore a deliberately deleted live account except where legally required.
Your choices and rights
You can correct profile information from the app, revoke device permissions in your operating-system settings, disable push notifications in your operating-system settings, clear contact matching in ShotGram, or request access/correction/deletion by writing to support@shotgram.app. Applicable privacy rights depend on where you live.
Reporting, blocking and moderation
Every post, comment, live stream, direct message and clan channel can be reported from the app. You can block any account, which stops them contacting you and hides your content from them. Reports reach our moderation team, and content that breaks our rules — together with the accounts responsible — is removed or suspended. We aim to act on reports of abusive or illegal content within 24 hours. Moderation records, including who reported what and the action taken, are retained so decisions can be reviewed and repeat offenders identified.
How long we keep things
Account information and content are kept while your account exists. Live location coordinates are deleted as soon as sharing stops or expires. Push tokens are removed when they become invalid. Session records and security events are kept for a limited period for account-security purposes. Moderation records are kept as long as needed to keep the community safe. When you delete your account, your content and personal data are deleted, except where we must keep a limited record to comply with law or to prevent a suspended user returning.
International transfers
ShotGram is used across the Gulf, the wider Arab region and beyond. Our service providers operate infrastructure in several countries, so your information may be stored or processed outside the country you live in. We choose providers that offer appropriate safeguards for that transfer.
Security
Connections use HTTPS. Access to your data is restricted by row-level security rules in our database, so accounts can only reach the data they are entitled to. No system is perfectly secure, and we do not claim otherwise; if a breach affects you, we will tell you.
Changes
If this policy changes materially, ShotGram may show an in-app notice or otherwise provide notice as required.