Privacy Policy

1. Who is responsible for your data

AppShotSet is operated by an individual established in Poland, who is the controller of the data described below. For the controller’s name and postal address, or for any privacy matter including the requests in section 9, write to hello@veremeen.com.

2. What we collect

Account. AppShotSet has no password of its own — you sign in with Google, and we receive your email address, name, profile picture and Google account identifier. We never see your Google password.

Project content. Screenshots and images you upload, headlines and other text you type, device choices, backgrounds, layouts and export settings.

Payments. If you buy Pro, your card is entered on Stripe’s own payment page and never reaches our servers. We store only what identifies the purchase: a Stripe customer and subscription identifier, the plan, its status and the date it renews or expires. Stripe collects your billing address and, where applicable, your VAT number, in order to calculate tax.

Technical. IP address, browser and device information, and error diagnostics, as generated by any web request.

Usage. Aggregated product events such as a completed export or an opened tool.

3. Why we are allowed to process it

To perform our contract with you (Art. 6(1)(b) GDPR): your account, your projects, your uploads and your subscription. Without these the editor cannot save, render or export anything.

Our legitimate interests (Art. 6(1)(f)): keeping the service secure, diagnosing errors, preventing abuse of usage limits, and understanding in aggregate which features are used.

Legal obligation (Art. 6(1)(c)): retaining invoices and payment records for the period Polish tax law requires.

4. Who else processes it

We use a small number of providers, each acting on our instructions under a data processing agreement:

Supabase — database, file storage and authentication. Your projects and uploaded files live here.
Google — sign-in (Google OAuth). Google receives the fact that you signed in to AppShotSet.
Stripe — payment processing, invoicing and tax calculation. Stripe is an independent controller for the payment data it collects.
Cloudflare — hosting, DNS and content delivery for the site itself.
Google Analytics — aggregated usage measurement.
OpenAI — measurement of our ChatGPT ads: whether someone who clicked one of our ads went on to upload screenshots, export a set or buy Pro. For a purchase we send OpenAI a hashed (SHA-256) form of the account email so the sale can be matched to the ad.

We do not sell your personal data, and we do not share it for anyone else’s advertising.

5. Where it is processed

Some of these providers operate outside the European Economic Area, including in the United States. Where data leaves the EEA, the transfer relies on the European Commission’s Standard Contractual Clauses or an adequacy decision.

6. Cookies and browser storage

AppShotSet stores your sign-in session and the identifier of the project you last opened in your browser’s local storage. These are strictly necessary — without them you would be signed out on every page load — and are not used for advertising.

Analytics uses cookies set by Google Analytics. They measure aggregate usage — which pages are opened, whether an export completed — and never the content of your projects. You can block them in your browser without losing access to the editor.

If you arrive from one of our ads in ChatGPT, OpenAI’s measurement pixel stores two first-party cookies: __oppref, the reference of the ad click (kept up to 30 days), and __obref, a random browser reference (kept up to a year). They are used only to tell us which of our ads led to sign-ups and purchases.

7. How long we keep it

Projects and uploads: until you delete them, or until you ask us to delete your account.

Account: for as long as the account exists.

Payment and invoice records: five years from the end of the tax year, as required by Polish law. This retention survives deletion of your account, because we are not free to delete it.

Technical logs: a short period for security and diagnostics.

8. Security

Every project is isolated at the database level: row-level security means one account’s query cannot reach another account’s rows, rather than the separation being enforced only by the application. Uploaded files are private and served through short-lived signed links. Payment card data never touches our infrastructure.

No online service can promise absolute security, and we do not.

9. Your rights

Under the GDPR you may request access to your data, correction of it, deletion of it, restriction of processing, a portable copy, and you may object to processing based on our legitimate interests. Write to hello@veremeen.com and we will respond within one month.

You can delete individual projects and uploaded files yourself from inside the editor at any time.

If you believe we have handled your data unlawfully, you can complain to the Polish supervisory authority, the Urząd Ochrony Danych Osobowych (uodo.gov.pl), or to the authority where you live.

10. Children

AppShotSet is a tool for people publishing software and is not directed at children. We do not knowingly collect data from anyone below the age of digital consent in their country.

11. Changes

We will update this policy as the product changes, and the date above shows when the current version took effect. If a change materially affects how we use your data, we will tell you before it takes effect.