Your work should stay with your review team.

This Privacy Policy applies when you visit ShotMarks, sign in, create or join a review room, or otherwise use the ShotMarks service. It does not govern Google, YouTube, or other third-party services, which handle data under their own policies.

ShotMarks is designed for collaborative review of public or unlisted YouTube videos. An unlisted video is not private: anyone who obtains its link may be able to watch it.

• Account and sign-in data. When you continue with Google, we receive your name, email address, profile image, Google account identifier, and authentication information needed to maintain your account. We do not receive your Google password. Sessions may include an IP address, user agent, token, and expiry time.
• Review-room content. We store project titles and descriptions, YouTube URLs and video IDs, timestamped notes and ranges, replies, tags, collaborator email addresses, access requests, roles, statuses, and related timestamps.
• Usage and diagnostic data. In production, PostHog helps us understand visits, pages, actions, browser and device details, approximate network information, errors, and performance. PostHog may also record session replays containing page content and interactions. Password fields are masked, but other content visible or entered in the app may appear in a replay and is treated as confidential diagnostic data.
• Local browser data. If you prepare a project before signing in, its title, description, and YouTube URL are temporarily stored in your browser so the draft can be resumed after sign-in.

• Provide, secure, maintain, and improve ShotMarks.
• Authenticate you and keep your account and sessions working.
• Create review rooms, show content to authorized collaborators, and produce requested exports.
• Respond to access requests, support questions, security incidents, and abuse.
• Measure product use, diagnose problems, and make the service easier to use.
• Comply with law and enforce our Terms.

We do not sell personal information and do not use review-room content for third-party targeted advertising. Where law requires a legal basis, we rely on performing our agreement with you, our legitimate interests in operating and securing the service, consent where requested, and compliance with legal obligations.

• Review-room participants. People with accepted access can see project details and the notes, replies, tags, names, and profile information associated with that room. Owners control room access and can change or revoke collaborator roles.
• Service providers. Cloudflare hosts the application and database and processes network and operational data. PostHog provides product analytics and session replay from its EU service. Google provides sign-in, and YouTube provides video playback.
• Legal and safety reasons. We may disclose information when reasonably necessary to comply with law, respond to valid legal process, protect people or the service, investigate abuse, or enforce our agreements.
• Business changes. Information may be transferred as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.

Google sign-in is used only to authenticate you and obtain the basic profile information described above. ShotMarks does not request access to manage your YouTube channel or Google Drive.

When a review room loads the YouTube IFrame Player, your browser connects directly to YouTube. Google may receive the video ID, the ShotMarks origin or referrer, IP address, device and browser information, playback interactions, and cookies or similar identifiers. ShotMarks stores the YouTube link and review metadata, not a copy of the video.

Your use of embedded playback is also subject to the YouTube Terms of Service. Learn more in the Google Privacy Policy.

ShotMarks uses secure cookies or similar storage required for authentication, session continuity, fraud prevention, and security. PostHog may use cookies or local storage to distinguish sessions and measure product use. The pre-sign-in project draft described above is also kept in local storage on your device.

Blocking required cookies can prevent sign-in or other parts of the service from working. You can clear local storage and cookies through your browser settings, although doing so may sign you out or remove an unfinished draft.

We keep account data while your account is active and keep review-room content until the project owner deletes the project or deletion is otherwise requested. Deleting a project removes its access records, reviews, replies, tags, and associations from the active database. Expired sessions, security logs, analytics, diagnostic records, and backups may remain for a limited period according to operational, legal, and provider retention schedules.

We may retain limited information where necessary to meet legal obligations, resolve disputes, prevent abuse, or enforce agreements. Local drafts remain on the device until the project is created, the draft is cleared, or browser storage is removed.

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to the use of your personal information, or to withdraw consent. You may also complain to your local data-protection authority. These rights can be subject to legal limits and identity verification.

Project owners can delete projects from the project settings. For an account-level request, analytics opt-out, or another privacy question, email privacy@shotmarks.com. You can also manage information held by Google through your Google account controls.

We use access controls, scoped authorization, encrypted transport, protected authentication cookies, and infrastructure safeguards intended to protect information. No internet service is completely secure, so we cannot guarantee absolute security.

ShotMarks and its providers may process information outside your country. Where required, we use contractual or other recognized safeguards for international transfers. Cloudflare operates a global network, and the location of processing can vary depending on the service and your location.

ShotMarks is not directed to children under 13, and you must meet the minimum age required to use online services in your country. If you believe a child provided personal information improperly, contact us so we can investigate and delete it where appropriate.

We may update this policy as the service or law changes. Material changes will be communicated through the service or another reasonable channel, and the effective date at the top will be updated.

Questions or requests can be sent to privacy@shotmarks.com. For provider-specific practices, see the Cloudflare Privacy Policy and PostHog Privacy Policy.