Privacy Policy
Version 1 · Effective 29 October 2026
The short version. We keep the minimum needed to run an account with credits: your e-mail and name from the sign-in provider you choose, what you download and edit, your favourites and projects, and a record of credits bought and spent. Payments are handled by Paddle; we never see your card number. Clips you upload for conversion are private and deleted within 30 days. We do not sell your data and we do not run advertising. You can ask us at any time to see, correct or delete what we hold.
- Who we are and what this covers
- What we collect
- Why we use it
- Cookies and browser storage
- Who we share it with
- Where it is stored
- How long we keep it
- Your rights
- Security
- Children
- Changes
- Contact
1. Who we are and what this covers
Shotmoo is operated by Lê Tuấn Minh, Hanoi, Vietnam ("Shotmoo", "we"). We are the controller of the personal data described here. This policy covers the website at shotmoo.com (and its temporary address shotmoo.pages.dev) and the related service (the "Service"). It does not cover the websites of other companies that we link to or that handle parts of the Service for us (see section 5); their own policies apply there.
2. What we collect
| Data | Where it comes from |
|---|---|
| Account: e-mail address, display name, profile picture, the identifier of the sign-in provider (Google, Apple or Microsoft) you used | From the provider when you sign in, or from the e-mail address you type |
| Your activity in the Service: references downloaded, edits made and their settings, favourites, projects, conversion requests, language setting | Created as you use the Service |
| Credits and purchases: credit balance, every credit added or spent and why, plan status, Paddle customer and transaction identifiers, the amount and currency of each purchase | Created by the Service and sent to us by Paddle after a payment. We do not receive your card number or bank details; Paddle keeps those. |
| Clips you upload for conversion and their file name, length and aspect ratio | From you |
| Technical data: IP address, browser and device type, pages and API calls requested, timestamps, error logs | Collected automatically by our hosting provider when you use the site |
| Correspondence: e-mails you send us and our replies | From you |
We do not ask for and do not want sensitive data (health, religion, politics, biometrics and the like). Please do not put it in a clip or an e-mail to us.
3. Why we use it
| Purpose | Legal basis (for people in the EEA/UK) |
|---|---|
| Creating and running your account, letting you sign in, keeping your downloads, edits, favourites and projects | Performance of our contract with you |
| Charging and crediting credits, processing plans and payments, issuing refunds, keeping accounting records | Contract; legal obligation (tax and accounting law) |
| Converting a clip you upload into a blockout reference | Contract |
| Sending service e-mails: sign-in links, receipts, important changes to the Service or these policies | Contract; legitimate interest in keeping you informed |
| Keeping the Service secure, preventing fraud, abuse and credit theft, enforcing the Terms of Use | Legitimate interest in running a safe service |
| Understanding how the library is used (which references and edits are popular) to improve it, using aggregated figures | Legitimate interest in improving the Service |
| Answering your e-mails | Legitimate interest; contract |
| Product news by e-mail, only if you opt in | Consent (withdraw any time with the link in the e-mail) |
We do not use your data for advertising, we do not sell it, and we do not use your clips or your edits to train machine-learning models.
4. Cookies and browser storage
The Service uses browser storage only for things the site needs to work: your sign-in session, your language, your preferred aspect ratio, the sign-in method you used last, and (on the version that runs on your own computer) a demo credit balance. These are first-party and are not used to track you across other websites. Our hosting provider, Cloudflare, may set a cookie needed for security and load balancing. We do not use advertising or third-party analytics cookies. You can clear this storage in your browser at any time; you will then need to sign in again.
5. Who we share it with
We share personal data only with providers that process it for us under contract, and only what each needs:
| Provider | What they do | Where |
|---|---|---|
| Supabase, Inc. | Account sign-in and the database that holds your profile, credits, favourites, projects, edits and conversion requests | United States (us-east-1) |
| Cloudflare, Inc. | Hosting of the website and the API, file storage for references and for clips you upload, security logs | Global network; storage in Cloudflare's data centres |
| Paddle.com Market Ltd | Merchant of record: checkout, payment, invoices, taxes, refunds. Paddle receives your e-mail, country and the items bought. | United Kingdom / United States |
| Google, Apple, Microsoft | If you choose them for sign-in, they confirm your identity to us and give us your e-mail, name and picture | Per their policies |
| Our e-mail provider | Delivers sign-in links and service e-mails | United States / EU |
We may also disclose data if the law requires it, to protect our rights or the safety of users, or to a successor that takes over the Service (we would tell you first). Nothing you upload or create in the Service is shown publicly under your name; a blockout reference built from your clip may be added to the library without any mention of you (see the Terms of Use, section 6).
6. Where it is stored
Shotmoo is based in Vietnam. Your data is stored by the providers above, mostly in the United States, and is therefore transferred outside your country. For people in the EEA, the UK and Switzerland, these transfers rely on the providers' Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. You can ask us for details of the safeguards in place.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, favourites, projects, edits | While your account exists, then deleted within 30 days of your deletion request |
| Credit ledger, purchase and plan records | As long as accounting and tax law requires, normally 10 years, then deleted; pseudonymised after the account is deleted |
| Clips uploaded for conversion | Deleted within 30 days after the conversion is finished or refused |
| Technical logs | Up to 30 days |
| E-mail correspondence | Up to 2 years after the last exchange |
8. Your rights
Wherever you live, you can ask us to tell you what personal data we hold about you, to correct it, to delete it, to give you a copy in a usable format, or to stop using it for a particular purpose. Write to the address in section 12; we answer within 30 days and may ask you to confirm that you own the account. Deleting your account is possible from the account menu or by e-mail.
EEA, UK and Switzerland. You have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR and UK GDPR, and the right to withdraw consent at any time without affecting earlier processing. You may complain to your local data-protection authority; we would appreciate the chance to answer first.
Vietnam. We process personal data in line with Decree 13/2023/ND-CP on personal data protection. You have the rights to know, to consent, to access, to withdraw consent, to delete, to restrict, to object and to complain, exercised as described above.
United States. Residents of California and other states with privacy laws have the rights to know, delete, correct and port their data and to opt out of its sale or sharing. We do not sell or share personal data for targeted advertising. We do not treat you differently for exercising a right.
9. Security
Data travels over HTTPS. Sign-in uses the providers' own security or a one-time e-mail link; we store no passwords. Only the server can read the database; the browser never receives the keys that give access to it. Clean (unwatermarked) files are only delivered to a signed-in account that has paid for them. No system is perfectly secure, so we cannot guarantee that data will never be accessed without permission; if a breach affects you we will tell you and the relevant authority as the law requires.
10. Children
The Service is for adults. We do not knowingly collect data from anyone under 18 (or under the age of majority where they live). If you believe a minor has created an account, tell us and we will delete it.
11. Changes
We may update this policy. If a change matters to you, we will tell you by e-mail or by a notice in the Service before it takes effect. The version and date are shown at the top of this page.
12. Contact
Shotmoo · operated by Lê Tuấn Minh · Hanoi, Vietnam
E-mail: [email protected]
See also the Terms of Use.