Shot2Net Privacy Policy
Last updated: 12.10.2026
This policy explains what data Shot2Net — a screenshot app for Windows and its optional cloud at https://shot2net.com — processes, why, how long we keep it, and what your rights are. It is written to meet the Law of Ukraine "On Personal Data Protection" and the EU General Data Protection Regulation (GDPR).
1. Who we are
Data controller: ФОП ВІРАЧОВ В.В, 3218418370 Email for data requests: support@shot2net.com
2. In short
- The app works fully offline. Screenshots stay on your computer unless you choose an upload action.
- An account is optional.
- We use no analytics or advertising trackers, and we do not sell data.
- We never see or store card numbers.
3. What data we process
The desktop app. On installation the app generates a random install token and stores it locally. This token, the app version and the interface language are sent with the update check the app makes after it starts, and with cloud requests, so that we can deliver updates, know how many copies of the app are in use, and count the anonymous upload quota. If you do not use the cloud, the update check is all the app sends; screenshots, files and anything else on your computer are never sent.
Account (optional). Name, email and password. We store the password only as a hash. If you sign in with Google, Facebook or Telegram, we receive your account ID with that provider, your name and your email (if the provider shares it).
Uploaded screenshots. The image, an optional title, a view counter, the upload date, and a link to your account or install token.
Payments. Payment ID, amount, currency, status and the payment provider's response. Card details are entered on the provider's page and never reach us.
Emails. We send only service emails: email verification, password reset, and a reminder 14 days before your paid year ends.
Server logs. IP address, user agent (browser or app type), time and address of the request.
Cookies and browser storage.
| Name | Purpose | Duration |
|---|---|---|
| Session cookie | keeps you signed in | until sign-out / session end |
| CSRF cookie | protects forms against forged requests | session |
shot2net_lang |
remembers the site language — set only when you pick a language yourself | 1 year |
| localStorage | remembers the pricing currency you chose | until you clear browser data |
There are no other cookies, analytics or ads.
4. Why, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Running the cloud: uploading, storing, showing screenshots by link | screenshots, title, counter, token, account | performance of our contract with you (GDPR Art. 6(1)(b); Art. 11 of the Ukrainian Law) |
| Counting the anonymous quota and preventing abuse | install token, version, language, IP | legitimate interest — keeping the free cloud available to everyone (Art. 6(1)(f)) |
| App updates and counting installations | install token, version, language | legitimate interest — delivering fixes and knowing how many copies of the app are in use (Art. 6(1)(f)) |
| Account and sign-in | name, email, password hash, Google / Facebook / Telegram sign-in data | performance of contract |
| Paying for a plan | payment data | performance of contract; tax and accounting obligations (Art. 6(1)(c)) |
| Service emails | performance of contract | |
| Security and troubleshooting | server logs | legitimate interest |
| Site language and pricing currency | shot2net_lang cookie, localStorage |
your choice; needed to show the site the way you asked |
We do not use automated decision-making or profiling that has legal effects on you.
You are not required to provide account or payment data. Without it the app still works, but the cloud is available only anonymously and paid plans are unavailable.
5. Who else receives data
We share data only with those the service cannot run without:
- Server hosting (VPS): Clodo Cloud Service Co. L.L.C., a server in a data centre in the Netherlands (Amsterdam).
- Screenshot storage: a private S3-compatible bucket at Cloudflare, Inc., США. Screenshots are served through cdn.shot2net.com (our own server; the images themselves are served from storage through short-lived signed links).
- Payments: LiqPay (JSC CB "PrivatBank") and monobank (JSC "Universal Bank") for hryvnias. Each provider handles card data under its own privacy policy.
- Third-party sign-in: Google, Meta (Facebook), Telegram — only if you choose that sign-in method.
- Email delivery: our own mail server on our VPS — no third-party email service is used.
- Public authorities — only on a lawful request.
Shared links. Anyone who has the link to an uploaded screenshot can view it. Links cannot be guessed, but once you share one we cannot control where it goes next. Do not upload anything you are not ready to show, and delete screenshots you no longer need.
6. Transfers outside Ukraine and the EEA
Some providers (including Google, Meta, Telegram and the screenshot storage) process data outside Ukraine and the European Economic Area. For these transfers we rely on a European Commission adequacy decision where there is one, and otherwise the standard contractual clauses approved by the Commission (GDPR Art. 45 and 46). You can get a copy of the relevant safeguards by writing to support@shot2net.com.
7. How long we keep data
| Data | Retention |
|---|---|
| Anonymous uploads | 7 days |
| Uploads on the free Basic plan | 30 days |
| Uploads on Lite and Pro | no automatic deletion |
| Any upload | you can delete it from the app at any time |
| Account | until you ask us to delete it |
| Payment records | at least 3 years — as long as tax and accounting law requires |
| Server logs | 30 days |
| Database backups | 7 days on the server, 30 days in the bucket |
Expired uploads are deleted nightly. Deleted data disappears from backups as those backups are replaced — that is, within 30 days at most.
If you cancel a paid plan or get a refund for it, screenshots uploaded earlier stay; the free plan's rules apply to new uploads.
8. Security
Passwords are stored only as hashes. The screenshot bucket is private, and an individual screenshot can be reached only through its unguessable link. Only people who need server access to run the service have it. No system is perfectly secure; if a breach puts you at risk, we will notify you and the relevant authority within the time limits set by law.
9. Your rights
You have the right to:
- know what data of yours we process, why and with whom we share it, and get a copy;
- correct inaccurate data;
- erase your data or your account;
- restrict or object to processing (including processing based on legitimate interest);
- receive your data in a common machine-readable format;
- withdraw consent where processing is based on consent;
- complain to a supervisory authority.
To exercise a right, write to support@shot2net.com from the email linked to your account. We reply within 30 days. You can delete uploads yourself in the app.
Where to complain. In Ukraine: the Ukrainian Parliament Commissioner for Human Rights (https://ombudsman.gov.ua). In the EU: the data protection authority of your country. We would appreciate it if you wrote to us first — we will try to fix the issue quickly.
10. Children
The service is not intended for children under 16. If you believe a child has given us data without parental consent, write to us and we will delete it.
11. Changes
We will announce material changes on the site and email account holders. The date at the top shows the latest version.
12. Contact
ФОП ВІРАЧОВ В.В, 3218418370, support@shot2net.com.