PRIVACY

Privacy Notice — Shot Brief

Last updated: 2026-11-06.

This notice explains who looks after your personal data, what we do with it, who else sees it, and the rights you have. It's one of two companion documents — read it alongside our Terms of Service. Before your first analysis, you'll also see a short version of this inside the app.

1. Who is responsible for your data (the controller)

The controller of your personal data — the company that decides how it's used and is responsible for it — is Get Better Software, established in Finland.

Because Get Better Software is established in the European Union, EU data protection law — the GDPR — applies to what we do with your data (Article 3(1)). Our lead supervisory authority is the Finnish supervisory authority (Tietosuojavaltuutetun toimisto / Office of the Data Protection Ombudsman) — the regulator you can turn to about how we handle your data.

2. What the app does, and what data we process

Shot Brief analyzes a photo you send and gives you feedback to help you take a better shot. Here's what we process to do that:

  • The photo you send. Your photos may be cached in the app's memory for the duration of a session, and sent again with later shots.
  • Your account and sign-in, so your credits and history stay with you across devices and reinstalls. This uses Sign in with Apple and Apple's App Attest.
  • Your credits and purchases, so paid analyses are granted and refunds reconcile correctly.
  • Your development record — but only if you turn development tracking on. It stores the scores and machine markers from analyses you were shown, so you can see your progress. This record never contains a photo, a preview, or any image data.
  • Request logs. Our hosting provider logs each request, including your IP address, for 30 days, to investigate security problems and abuse (our legitimate interest). These logs may be stored outside Europe, under the protections in section 6.

3. Why we're allowed to process it (lawful bases, Article 6)

What we process Why we're allowed to (lawful basis)
Analyzing your photo and returning feedback Article 6(1)(b) — we need to do this to provide the service you asked for. The analysis is the service: there is no camera-only mode, so if you decline, the app has nothing to analyse and simply does not run.
Your account and sign-in identity Article 6(1)(f) — our legitimate interest in giving you a stable account that stays with you, protecting the service against abuse, and keeping your credits with you. You have the right to object to this under Article 21; because your account is what carries this data, the practical way to act on that is to delete your account, which you can do at any time.
Your credits, purchases and transaction records Article 6(1)(b) — we need them to provide the paid service you bought.
Your development record (progress tracking) Article 6(1)(a) — your consent. This is optional: you turn it on. Turning it off pauses tracking. Deleting your development record in Manage withdraws your consent and deletes your entries; you can do this at any time.

We never use your photos to identify anyone, or to guess appearance, body, age, identity, or emotion. Our feedback stays on photographic craft — framing, exposure, blur, distracting background. Because we hold that line, we do not process special-category data under Article 9.

4. Who else receives your data (recipients, Article 13(1)(e))

We work with the organisations below. Each one is listed in the role it actually plays.

Your photos are analysed either by Google, or by TypeSafe and Anthropic together. The disclosure the app shows before analysis names which.

Organisation Role What it handles
Google (Gemini API) Processor, analyzing your photo on our instructions Your photo and the analysis prompt. See Google's own terms: https://ai.google.dev/gemini-api/terms
TypeSafe (Jev) Processor, scoring your photo on our instructions Your photos and the analysis prompt. Keeps them as TypeSafe's data page says: https://help.typesafe.ai/articles/5974925716. See TypeSafe's own terms: https://typesafe.ai/legal/mca
Anthropic (Claude API) Processor, writing your coaching from your photo on our instructions Your photos, your phone model and zoom, and the analysis prompt. Keeps them as Anthropic's retention page says: https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data. See Anthropic's own terms: https://www.anthropic.com/legal/commercial-terms
Neon Processor (our database provider) Stores your account, identity, credits and (if enabled) development record, at rest in the EU (Frankfurt).
Google Cloud (Cloud Run) Processor (hosts the backend that does the processing) Runs our analysis service.
Apple Independent controller Sign in with Apple, App Attest device attestation, and App Store / StoreKit purchases run under Apple's own privacy terms.

We do not sell your personal data, and we do not use it for advertising.

5. We never keep your photos; your photos never train the provider's models

6. When your data leaves Europe, and how it's protected (Article 13(1)(f), Chapter V)

Your photo may be processed outside the European Economic Area. When that happens, the transfer is protected by:

  • an adequacy decision of the European Commission — the EU–US Data Privacy Framework — where the data reaches a Data Privacy Framework-certified provider entity (Article 45); and/or
  • contractual protection — the vendor's terms, which we have accepted and which form the contract of record for the transfer, together with the vendor's data-processing addendum (Article 46).

For Google, the contract of record is the Gemini API terms (https://ai.google.dev/gemini-api/terms) and Google's data-processing addendum. For TypeSafe and Anthropic, it is each one's data-processing addendum, with the EU standard contractual clauses.

7. How long we keep things (retention, Article 13(2)(a))

  • Photos: not kept.
  • Your account (if you signed in with Apple): we delete your account and everything tied to it 24 months after the last time you used the app while signed in. Any use of the app that reaches our service while you're signed in — for example, analysing a photo — counts, not only signing in. You can also delete your account at any time (see section 8), and we then delete this data.
  • Credits and transaction records: kept while your account exists, and deleted when your account is deleted — whether you delete it or we delete it after 24 months without use. This includes any credits you bought before you signed in.
  • Development record: we keep entries from the current calendar month and the 12 complete calendar months before it (in UTC); older entries are deleted. You can delete your development record at any time, and deleting your account deletes it too. Turning tracking off stops new entries being recorded; entries already stored are deleted on the same schedule, or sooner if you delete them.
  • When deletion runs: automatic deletion runs once a month, so data is deleted at the first monthly run after its period ends.

8. Your rights

Under the GDPR you can: see the data we hold about you (Article 15), have it erased (Article 17), take it with you (Article 20, data portability), and — where we rely on legitimate interests — object to the processing (Article 21). You can have inaccurate data corrected (Article 16) and, in some cases, have our use of it restricted (Article 18). You can also lodge a complaint with the Finnish supervisory authority.

Get a copy of your data in the app. At the top of the app's start screen, tap the i button (VoiceOver reads it as "How photos are handled"). On the screen that opens, How your photos are handled, go to About your account and tap Get a copy of your data. The app makes one file of the data we store linked to you, in a common machine-readable format (JSON), and opens your phone's share sheet so you can save it or send it wherever you choose. We don't email it. Your photos aren't in it, because we never keep them. You can get a fresh copy at any time.

Access and deletion happen only in the app. You can get a copy of your data and delete your account only in the app. We don't do either by email, even if you send us codes from your data copy. We don't store your email address or your name, so nothing we hold shows us that an email comes from you, and acting on one could let someone else get your data or delete your account.

If you no longer have an iPhone. Your account stays with us, tied to your Apple Account through a code we make from it. Sign in with the same Apple Account on any iPhone, and you can get your copy or delete your account there. If you don't, we delete your account 24 months after you last used the app while signed in, as section 7 describes.

Correcting, restricting or objecting. Most of what we hold is made by the app itself: codes, credits, purchase records and your development record. In the app you can turn development tracking off, delete your development record, or delete your account. We have no way to change or restrict single entries for you, and we can't act on these requests by email. We'll still reply, and tell you what you can do.

You can object to request logs. Email us, and we'll reply.

Questions and complaints. You can email us any question about your data, using the details in section 1. You can also complain to the Finnish supervisory authority at any time.

Deleting your account. If you've signed in with Apple, you can delete your account in the app. On the start screen, tap the ⓘ button, then tap Delete account and follow the steps. This removes your account, sign-in identity, credits and transaction records, and development record from our records, including any records from before you signed in. It can't be undone.

The app tells you whether Apple ended Shot Brief's access to your Apple Account. If it didn't, you can end it yourself. Open Settings on your iPhone, tap your name, then tap Sign in with Apple. Choose Shot Brief and tap Delete (Apple's instructions).

Apple keeps its own records of your App Store purchases under Apple's privacy terms. Deleting your account here doesn't delete those.

9. Where your data is processed does not change our duty to you

Get Better Software is established in Finland, so the GDPR follows us wherever the app is released. Releasing the app in another country, or changing where your data is processed, does not reduce or remove any of the obligations in this notice.

10. Changes to this notice

If we change how we process your personal data, we will update this notice. Where the change is material, we will make it visible in the app before it takes effect.