Privacy

What we store

Everything below is something you typed or chose. Shotwell does not buy data about you, does not track you across other websites, and has no advertising on it.

Your account

Email address, an optional display name, and the date you signed up. Your password is stored only as a bcrypt hash — it cannot be read back, by us or by anyone else.

Your profile

Where you are in your photography, what you shoot, what you are good at, what gear you own, hours a week, monthly income goal, and an optional free-text location such as a city.

Your gear

The items you add, their category, what you paid if you chose to say, and any notes you wrote.

Your plan and tasks

The path you chose, the four-week plan generated from it, and which tasks you have marked done.

Your offers and proof

Offer names, prices, deliverables and positioning; proof titles, descriptions and what you delivered. Proof can include a link to where your work lives — Shotwell stores the link, never a copy of the photographs.

Your prospects and outreach

The businesses you add, how you contacted them, what you noticed about them, the messages you drafted, and the status you set. This is information about other people that you chose to record, and it is covered by the terms below.

Your revenue

Amounts, descriptions and dates for work you log. Used for your own progress figures and nothing else.

Product events

A short list of named actions — signing up, choosing a path, adding gear, sending outreach — with small non-personal properties such as a path slug or a count. These tell us which parts of the product work. They never contain your messages, your clients' details, or free text you wrote.

Where you came from

If you arrived through a campaign link, the campaign parameters on that link are recorded once at sign-up. No click identifiers, no referrer chain, no fingerprinting.

Payment records

If you pay, we store your Stripe customer and subscription identifiers, the plan, its status and its renewal date — and, for a one-time purchase, the amount and date. Card numbers never reach Shotwell's servers.

What we do not store

Your photographs. Your card details. Your IP address — it is used in memory to rate-limit sign-in attempts and then discarded, never written to the database. Anything about you from a third party, because we do not buy or receive any.

Cookies

Four, all first-party, all set by Shotwell itself. None of them are advertising cookies, and none of them are shared with anyone.

Signed-in session

Keeps you signed in for 30 days. Marked HttpOnly and, in production, Secure — so it cannot be read by scripts. Removing it signs you out.

Onboarding draft

Holds your answers while you work through the questions before you have an account, so a refresh does not lose them.

Gear kit

The same thing for the gear step, which is long enough to be worth not losing.

Campaign reference

Records the campaign parameters from the first page you landed on, so we can tell which channels bring people who actually use the product. First touch only — it is never overwritten.

Who else is involved

Four services, each doing one job. We send them the minimum each needs.

Vercel

Hosts the site and provides page analytics. Before a page view is sent, Shotwell strips query strings, replaces record identifiers in the URL with a placeholder, and drops the password-reset page entirely so a live token can never leave in an analytics event.

Supabase

Hosts the PostgreSQL database everything above is stored in.

Stripe

Takes payments. You enter card details on Stripe's own checkout page; Shotwell never sees them. Stripe tells us your subscription status and nothing more.

Resend

Delivers transactional email — currently password resets only. It receives your email address and the message.

Getting your data, and deleting it

Both are self-serve, in Settings, and neither requires you to ask us.

Export downloads a single JSON file containing everything listed above, excluding your password hash and any live reset token — those are credentials, not data about you.

Deleting your account removes it and everything attached to it: profile, gear, plans, tasks, offers, proof, prospects, outreach, revenue, recommendations, product events and payment records. It is immediate and cannot be undone. Records Stripe keeps for its own accounting are governed by Stripe's policies, not ours.

People who are not you

The prospects you add are real businesses and, sometimes, real people. You chose to record them. Keep what you store about them accurate and reasonable, delete it when it stops being useful, and do not record anything you would not be comfortable showing them. Deleting your account deletes those records too.

Security

Passwords are hashed with bcrypt. Session cookies are HttpOnly and Secure. Sign-in, sign-up and password reset are rate-limited. Database tables are closed to the public API and have row-level security enabled. Payment webhooks are signature-verified before anything is read.

No service can promise it will never be breached, and we are not going to. If an incident affects your data, we will tell you what happened and when.

Children

Shotwell is a tool for running a photography business and is not intended for anyone under 16.

Contact

Questions about any of this, or a request we have not built a button for, go to the support address on the site.