Privacy Policy

Last updated: October 26, 2026

ShotFact ("we", "the app") is made by BeeCrow, LLC. It fact-checks screenshots with AI. This policy explains exactly what happens to your screenshots and what else we collect, why, who processes it, and how long it is kept. We do not sell your data, show ads, or use third-party tracking or analytics.

Your screenshots, in short

• On your device. Each screenshot you send is downscaled to a JPEG and kept in ShotFact's history on that device, next to its verdict. Depending on your settings it can be included in device backups (iCloud, Time Machine). The app has no button to delete a single check yet; see "Deleting your data" below.
• Only when you ask. A screenshot leaves your device only when you send it for a fact-check (up to 3 at a time on iPhone and iPad, one selected region on Mac) or tap Share on a result. If you are offline or have reached your daily limit, the check waits on your device and is sent when the app can, for example the next time you open it. Since version 1.2 the app first asks for your permission to send screenshots to our AI provider, and sends nothing until you allow it. You can withdraw it at any time with Send screenshots to OpenAI in Settings (on Mac, in the Settings tab).
• On our servers: not stored. The screenshot travels over HTTPS to our server (hosted by Cloudflare), is held in memory only while the check runs (at most a few minutes) and is never written to our databases or file storage. The one exception is sharing, below.
• At our AI provider. To produce the verdict, the screenshot is sent to OpenAI (GPT API). OpenAI does not use API data to train its models. We ask OpenAI not to store our requests; it still keeps abuse-monitoring logs of API inputs and outputs for up to 30 days, longer only where the law requires it or to protect its services. Like every image sent to OpenAI, screenshots are scanned for child sexual abuse material, and a flagged image is kept for review. Checks made before October 2026 were processed by Anthropic (Claude API), which does not train on API data and normally deletes it within 30 days.
• Web search. While checking, the AI may search the web. The search queries are written by the AI from what it reads in your screenshot and are run by OpenAI's web search, which can pass them to third-party search services under their own retention policies. No location or account details are sent with them. Our server then opens the cited links to confirm they work; nothing about you is added to those requests.
• What we keep: the verdict. We store the verdict: the summary, the claims as the AI restated them from your screenshot, the assessments and the sources. It is kept for the period shown under "Retention" and synced to your other devices when you sign in.
• Sharing publishes it. When you tap Share on a result, the screenshots of that check that are on your device (up to 3, after you confirm; app versions before 1.2 publish only the first), its full verdict and a preview card are published on a public web page at cdn.shotfact.com, even if you then close the share sheet without sending the link. Anyone with the link can open it, and search engines may index it if the link is posted publicly. Since version 1.2 you can revoke a shared page in the app: open the result and choose Revoke public link, and the page stops working right away. Otherwise it is removed together with its check (see "Retention"), when you delete your account, or earlier on request. Copies already cached by browsers, link previews or search engines may remain for a while.

Everything we collect

• Screenshots and verdicts, as described above. With each check we also store when it ran, how many images it had, the AI model and its token, search and cost counts. We use these figures, together with purchase records, for aggregate usage and revenue statistics that help us run ShotFact.
• Device and guest account. When the app first starts it registers the device: a random device ID and access token (we store only a hash of the token), the platform, and a guest account that holds your plan. To limit abuse we also keep a hash of your IP address for one day, then delete it.
• Email address (optional). Only if you start signing in: the address you enter is stored and sent to our email provider (Resend) with a 6-digit code as soon as you request one. It links your plan and history across devices. The app works without an email.
• Notifications. On iPhone and iPad we store a push token to tell you when a check is ready, failed, or hit your daily limit. These notifications go through Apple's push service, and a verdict notification contains the verdict summary. On Mac, notifications are created on your Mac.
• Purchases. Subscriptions and extra checks are bought through Apple. We receive the signed App Store transaction and Apple's subscription updates (renewals, expirations, refunds) and keep the transaction IDs, products, expiry dates and an estimate of the revenue. We never see your payment details.
• Language. The language you choose is sent with each check and sign-in request so the verdict and email come back in it. It is stored only as the language of a page you share.
• Diagnostics. The apps and our server send crash, error and performance reports to Sentry: device model, OS and app version, language and time zone, a random installation ID, when app sessions start and end, error details and the addresses of requests the app made. They are set up to exclude your screenshots, the contents of your requests and the text the AI writes about them.
• Server logs. Cloudflare logs each request to our server: its address and time, your IP address and approximate location, your user agent and other request headers (without access tokens). Our own log lines add check and device IDs, verdict labels, timings and counts. Logs never contain screenshots or their text.

Screen recording (macOS)

On macOS, ShotFact uses the system screen-capture permission (Screen Recording) solely to take a single still screenshot of the screen region you select when you explicitly start a fact-check. ShotFact never records your screen continuously, never captures anything automatically or in the background, and never captures audio. The captured region is handled exactly like any other screenshot in this policy.

Who processes your data

We share data only to run ShotFact. These providers process it for us under their data-processing terms, which require them to protect it at least as well as this policy describes:

• Cloudflare: hosting, database, file storage, logs.
• OpenAI: AI analysis of your screenshots and web search.
• Resend: sign-in emails.
• Sentry: crash, error and performance diagnostics.

Apple delivers push notifications and handles purchases as an independent company under its own Privacy Policy. Our website loads its font from Google Fonts, which receives your IP address when the page loads. Our providers process data in the United States and other countries.

Retention

• Verdicts are removed by a daily cleanup once they are older than 7 days on the Free plan, including guests, or when a paid plan has lapsed, and older than 90 days on Basic. On Pro they are kept until you delete your account. Shared pages are removed together with their check, or when you revoke them.
• Screenshots are not kept on our servers. OpenAI keeps them in its abuse-monitoring logs for up to 30 days (see above). Copies on your devices, including verdicts synced to your other devices, stay until you delete them there; they are not removed when the server copy expires.
• Device and account records are kept until you delete your account. If you remove the app without deleting your account, ask us to delete them. Purchase records are kept after account deletion for accounting.
• Logs and diagnostics are kept for a limited time: server logs for up to 7 days, diagnostics reports for up to 90 days. Our database provider keeps point-in-time backups for up to 30 days.

Deleting your data and your choices

• Sending a screenshot is your choice each time. No screenshot is sent automatically, except checks you already started that are waiting. In the background the app does register the device, send your push token, sync your history, confirm purchases and send diagnostics, as described above.
• Delete your account in the app: Settings → Account → Delete account on iPhone and iPad; on Mac, Account → Delete account from the menu bar icon or the Settings tab. This immediately removes from our servers your account, its checks, its devices and its shared pages. It does not remove the history on your devices, purchase records we keep for accounting, copies OpenAI still holds (up to 30 days), or database backups (up to 30 days). The app then registers a new anonymous device so it keeps working; checks still waiting on your device are sent under it unless you delete the app first. To cancel a subscription, use your Apple ID settings.
• On your devices: deleting the app on iPhone or iPad removes its history. On a Mac, the history stays in ~/Library/Group Containers/group.llc.beecrow.verifai after the app is deleted; remove that folder to erase it. Existing backups keep their copies.
• A shared page: open the result and choose Revoke public link (version 1.2 and later). A single check: the app cannot delete it yet. Email us the link or the time of the check and we will remove it.
• Your rights. We process your data to provide the service you ask for, and diagnostics and abuse limits to keep it working and secure. You can ask us for a copy of your data, to correct or delete it, or object to its processing. If you are in the EU or UK, you can also complain to your data protection authority.

Contact

Questions or requests about privacy? Email support@beecrow.llc.