Privacy Policy

Last updated: March 15, 2026 Version: 1.0

This Privacy Policy explains how ShotMock ("we," "us," or "our") collects, uses, and protects your personal data when you use our platform at shotmock.com. ShotMock is operated by Muhammed Enes Sahin, an individual developer acting as the data controller.

We are committed to complying with the General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law (KVKK, Law No. 6698), and other applicable data protection legislation.

Data Controller

Name: Muhammed Enes Sahin Email: [email protected] Website: shotmock.com

Data We Collect

Account Information

When you create an account, we collect the following data through OAuth authentication providers (Google, Apple, or GitHub):

• Email address
• Display name
• Profile picture URL
• OAuth provider identifier

User Content

When you use our service, we store the following content you create or upload:

• App Store screenshots and design assets
• Canvas data (design layouts, text, positioning)
• App metadata (titles, descriptions, keywords)
• App Store Connect credentials (encrypted at rest with AES-256-GCM)

Usage Data

We collect anonymous usage analytics through Vercel Analytics to understand how our service is used. This data does not contain personally identifiable information and includes:

• Page views and navigation patterns
• Feature usage frequency
• Performance metrics
• Browser type and device category

Purposes and Legal Basis for Processing

We process your personal data for the following purposes under the legal bases specified in GDPR Article 6:

| Purpose | Legal Basis | |---|---| | Account creation and authentication | Performance of a contract (Art. 6(1)(b)) | | Providing the screenshot design service | Performance of a contract (Art. 6(1)(b)) | | Storing and syncing your App Store Connect data | Performance of a contract (Art. 6(1)(b)) | | Processing payments via LemonSqueezy | Performance of a contract (Art. 6(1)(b)) | | Sending transactional emails (account, billing) | Performance of a contract (Art. 6(1)(b)) | | AI-powered translation of app metadata | Performance of a contract (Art. 6(1)(b)) | | Anonymous usage analytics | Legitimate interest (Art. 6(1)(f)) | | Responding to support requests | Legitimate interest (Art. 6(1)(f)) | | Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |

Third-Party Services

We share data with the following third-party service providers, each acting as a data processor:

LemonSqueezy (Merchant of Record)

LemonSqueezy processes all payments and acts as the Merchant of Record for subscription transactions. They collect and process payment information (credit card details, billing address) directly. We do not store your payment card information. See LemonSqueezy's Privacy Policy.

Vercel (Hosting and Analytics)

Our application is hosted on Vercel's infrastructure. Vercel Analytics collects anonymous, aggregated usage data without using cookies or collecting personally identifiable information. See Vercel's Privacy Policy.

Resend (Transactional Email)

We use Resend to deliver transactional emails such as account notifications and billing confirmations. Resend processes your email address and name for delivery purposes only. See Resend's Privacy Policy.

OpenAI (AI Translation)

When you use our AI translation feature, your app metadata text is sent to OpenAI's API for translation. No personal data is included in these requests — only the text content you choose to translate. See OpenAI's Privacy Policy.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. Specific retention periods are:

• Account data: Retained until you delete your account.
• User content (screenshots, canvas data, metadata): Retained until you delete the content or your account.
• App Store Connect credentials: Retained in encrypted form until you disconnect the integration or delete your account.
• Usage analytics: Aggregated anonymously and retained indefinitely.
• Exported files: Automatically deleted after 24 hours.

When you delete your account, we will erase all your personal data within 30 days, except where retention is required by law.

Data Deletion

You can delete your account and all associated data at any time through your account settings. Upon account deletion:

1. Your profile information is permanently removed.
2. All screenshots, canvas data, and design assets are deleted.
3. App Store Connect credentials are securely erased.
4. Transactional email logs are purged within 30 days.

International Data Transfers

Your data may be transferred to and processed in countries outside of Turkey and the European Economic Area (EEA), including the United States, where our third-party service providers operate. These transfers are safeguarded by:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The service providers' compliance with applicable data protection frameworks
• Encryption of data in transit and at rest

Cookie Policy

We use a minimal set of cookies necessary for the operation of our service. For detailed information about the cookies we use, please refer to our Cookie Policy.

Your Rights

Under GDPR (Articles 15-22)

If you are located in the European Economic Area, you have the following rights:

• Right of access — Request a copy of your personal data.
• Right to rectification — Request correction of inaccurate data.
• Right to erasure — Request deletion of your personal data.
• Right to restriction of processing — Request that we limit how we use your data.
• Right to data portability — Receive your data in a structured, machine-readable format.
• Right to object — Object to processing based on legitimate interests.
• Right to withdraw consent — Where processing is based on consent, withdraw it at any time.
• Right to lodge a complaint — File a complaint with your local supervisory authority.

Under KVKK (Article 11)

If you are located in Turkey, you have the following rights under the Turkish Personal Data Protection Law:

• Learn whether your personal data is being processed.
• Request information about processing activities.
• Learn the purpose of processing and whether data is used in accordance with its purpose.
• Know the third parties to whom your data is transferred.
• Request rectification of incomplete or inaccurate data.
• Request erasure or destruction of your data under the conditions set forth in Article 7.
• Request notification of rectification or erasure to third parties.
• Object to any result that is to your detriment arising from the analysis of your data exclusively through automated systems.
• Claim compensation for damages arising from unlawful processing.

Exercising Your Rights

To exercise any of your rights, please contact us at [email protected]. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice on our platform. We encourage you to review this policy periodically.

Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: [email protected]