NitroShot

1. The short version

The desktop app, CLI and MCP server work on files on your computer. They send nothing to us. There is no analytics, telemetry, crash reporting or usage tracking in any NitroShot software.

The web app at /app needs an account so a Pro purchase can follow you between browsers. It stores the minimum needed for sign-in and entitlement, and nothing about the screenshots you make.

2. Desktop app, CLI and MCP server

Projects (nss.config.json, screenshots, renders, listing text, compliance.yaml, the audit log) live in the folder you choose. We never see them.

Store credentials you add in Publish (App Store Connect API keys, Google Play service accounts, Huawei, Amazon and Microsoft client secrets) are saved in the app's data folder, or ~/.nss/credentials.json for the CLI, with owner-only file permissions. They are sent only to the store you chose, directly from your machine, when you verify, pull, upload, push or submit.

Captions and translations run on your machine by default (Apple Intelligence or Ollama). If you choose Claude, the text you submit is sent to Anthropic under your own API key and Anthropic's terms. Marketing art backgrounds run locally (Draw Things, mflux, Image Playground).

The device pack (store sizes, bezels, finishes) is downloaded from this site when you ask for an update. That request carries no identifier beyond what any HTTPS request carries.

License keys are verified offline inside the app with a public key. Activating a key does not contact us. Mac App Store purchases are verified through RevenueCat, which receives Apple's receipt and an anonymous app user id.

3. Web app and website

Sign-in uses passkeys or a one-time link sent to your email through Resend. We store your email address, passkey public keys, session records and the time you signed in, in a Cloudflare D1 database.

If you activate Pro on the web, we store the hash of your license key or the RevenueCat link, and the entitlement it grants. If you add store keys in the web app so uploads can run through our Worker, they are encrypted with AES-GCM before they reach the database and are decrypted only inside the request that uses them. You can delete them from the Publish tab at any time.

Your project folder, screenshots and renders stay in your browser (File System Access API or the browser's private storage). Uploads go from our Worker straight to the store you chose and are not retained.

The hosted MCP endpoint at /mcp is stateless and keeps request counts per IP for a short time to prevent abuse.

The website sets a cookie and a localStorage entry for theme and language. No advertising or analytics cookies are used.

4. Payments

Direct purchases are processed by Dodo Payments, which acts as merchant of record and handles card data, taxes and invoices under its own privacy policy. We receive your email, the plan and a payment reference so we can issue the license key, which is emailed to you through Resend.

Mac App Store purchases are processed by Apple. We receive no payment details; RevenueCat relays the subscription state to the app.

5. Who else sees data

Cloudflare (hosting, Workers, D1, R2 downloads), Resend (email), Dodo Payments (direct billing), RevenueCat (App Store entitlements), and the app stores you publish to. Anthropic only if you choose Claude as a provider. We do not sell or share personal data for advertising.

6. Retention

Web accounts and their records are kept while the account exists. Sessions expire. Magic-link tokens expire in 15 minutes. Encrypted store keys are kept until you remove them. Purchase records are kept as long as tax law requires.

7. Your rights

You can ask for a copy of the data we hold about you, correct it, or have it deleted, by emailing kinggautham495@gmail.com. Deletion removes your account, sessions, passkeys and stored store keys; purchase records stay with the payment processor as the law requires. Under the GDPR (EU/UK) you also have the right to object, to restrict processing, to portability and to complain to your supervisory authority. Under the CCPA (California) you have the right to know, delete and opt out of sale; we do not sell personal information.

The legal basis for processing account data is the contract with you; for security logging it is our legitimate interest. Data is processed on Cloudflare's network, which may be outside your country, under Cloudflare's standard contractual clauses.

8. Children

NitroShot is a developer tool and is not directed at children under 16. We do not knowingly collect their data.

9. Changes and contact

We will post changes on this page with a new effective date. Questions and requests: kinggautham495@gmail.com. Governing law: India.