Privacy Policy

Last updated: August 28, 2026

ShowShot is a product of Workado LLC. It records your screen and camera, edits what you recorded, and hosts a watch page for the people you send it to. This policy explains exactly what we hold, where it sits, and what leaves your machine. In this policy, "we" and "us" mean Workado LLC. Questions go to [email protected].

1. What we collect

Information you give us

• Account details. Name and email address. If you sign up with a password we store a salted hash of it, never the password.
• Google sign-in. If you sign in with Google, Google sends us your name, email address, profile picture, and Google account identifier. We ask for nothing else: no Gmail, Drive, Calendar, or Contacts access.
• Recordings and uploads. Video, audio, images, and files you import into a project.
• Text you write. Project names, scripts, transcript edits, comments, and the messages you send to the AI editor.
• Payment records. Our payment provider handles the transaction. We receive confirmation that a payment happened and the plan or credits it bought, not your card number.

Information we collect automatically

• Technical data. IP address, browser, operating system, and timestamps, used for sign-in, security, abuse prevention, and rate limiting.
• Watch page analytics. When someone watches a video you published we record the view, how far through they watched, and any reaction, comment, or emoji they leave. This is reported to the person who published the video.
• Cookies. A session cookie keeps you signed in and a small hint cookie routes you to the right workspace. No advertising or cross site tracking cookies.

2. What never leaves your device

ShowShot is built so the heavy work happens locally:

• Takes and projects live in your browser's local database while you work on them. We cannot see a project you have not published.
• Transcription. When you are signed in, the audio of a take is sent through our server to Google's Gemini speech models for transcription and speaker labels, kept only for the duration of the request. When that path is unavailable, your browser downloads a speech model once and transcribes locally instead. Separately, an optional live draft uses your browser's own speech recognition while you record so rough words reach your share within seconds; some browsers run that recognition in their own cloud, and you can switch it off under Settings, General.
• Your own API keys, if you use them, are held in your operating system's keychain in the desktop app, or stored encrypted on your account for the hosted app. Stored keys are listed by their last four characters and revealed only to you, signed in as the account owner.

A recording leaves your device only when you publish a share, upload a file, or use a feature that needs a cloud model.

3. Where published videos are stored

Publishing writes your video, its poster image, and a small manifest into object storage on Cloudflare under a slug that belongs to that share. Comments, reactions, view events, and notification email addresses are stored separately in our database, not in the public storage bucket.

• A share link is the key. Anyone holding the link can watch. Treat it accordingly.
• Private means link only: not listed, not indexed by search engines, and not available for remixing. It is not encryption, and it does not stop a viewer from passing the link on. Some plans expire a private link after a set time, and the product tells you when that applies.
• Public shares stay up until you delete them or your account closes.
• What we meter is storage, meaning what you publish rather than what your audience watches. The allowance that applies to your plan is shown in the product.

4. What we send to AI providers

Each AI feature calls one provider, and only the input that feature needs. Nothing is sent in the background and no feature runs unless you start it.

Content is sent for the duration of the request and for that request only. We do not use your recordings, transcripts, or uploads to train models, ours or anyone else's. Providers process the request under their own terms, so review theirs if a feature matters to your compliance position.

Your own key versus our managed key

Two modes are possible, and they route your data differently:

• Managed. We hold the provider account, the request is billed to your credits, and the provider sees ShowShot as its customer.
• Your own key. Your browser calls the provider directly with your key. The request is billed to your provider account, is governed by your agreement with them, and does not pass through our servers.

5. Voice cloning, avatars, and consent

Both features are gated on a consent step, and the person whose voice or face is being used has to be the one who gives it.

• Voice cloning. When the transcript separates several speakers, cloning one of those voices requires you to confirm in the app that you have that person's permission. The confirmation is recorded against the speaker before any audio is sent, and cloning is refused without it. A clone is built only from that speaker's own words.
• Avatars. HeyGen runs its own consent step: it issues a recording link where the depicted person says a consent statement out loud, and it will not train an avatar without it.
• Responsibility. Recording a call, cloning a voice, and using someone's likeness are your calls to make, and the permission has to be yours to give. We provide the consent mechanism, we cannot verify the consent itself.

6. Viewers, comments, and lead data

When you send someone a watch page, we handle their data on your behalf. In data protection terms you are the controller of that viewer data and we are your processor. We use it to run the watch page and to report engagement back to you, never for our own marketing.

• Viewers can leave a text, audio, or video comment. Audio and video comments are recorded in their browser and uploaded into that share's folder.
• Viewers who give a name or an email so you can reply have that stored with the comment.
• You see aggregate and per-view engagement for your own videos, including watch depth.
• If you later collect viewer details through a form, a call to action, or a webinar registration, the same split applies: the data is yours, the obligation to have a lawful basis and to honor opt-outs is yours, and we process it to deliver the feature.

7. Data we ask you not to send

ShowShot is a general product and is not built for regulated categories. Please do not record or upload protected health information, payment card data, government identifiers, children's records, or anything else covered by HIPAA, PCI DSS, GLBA, FERPA, or COPPA. The privacy check tool can help you blur what slipped into frame, but it is an assistant and not a guarantee: review every video before you publish it.

8. How we use your information

• To run the product: sign-in, saving projects, hosting published videos, and delivering watch pages.
• To send transactional email: address confirmation, password resets, comment notifications, and account notices. Marketing email requires you to opt in.
• To run the AI features you trigger.
• To keep the service safe: debugging, abuse prevention, and usage limits.
• To handle billing, credits, and support. We look inside your content only when you ask us to help with something specific, or where the law requires it.

9. Keeping and deleting data

• Unpublished projects live in your browser. Clearing browser storage deletes them and we cannot recover them.
• Deleting a share removes the stored video, its poster, its manifest, and its analytics.
• Where your plan expires a private link, it lapses automatically on the schedule shown in the product.
• Closing your account deletes your account record and your hosted files, apart from what we must keep for tax or legal reasons.
• Server logs are kept briefly for security and troubleshooting. Backups roll off on their normal schedule.

10. Your rights

You can change your account details in Settings, delete any share at any time, and ask for a copy of your data or its deletion at [email protected]. Depending on where you live you may also have the right to object to processing, to restrict it, or to complain to your local regulator. We answer requests within 30 days.

11. Google user data

The way ShowShot uses information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Your Google profile is used only to create and identify your ShowShot account. It is not transferred to others except as described here, is not used for advertising, and is not used to train models. You can disconnect ShowShot at any time from your Google account permissions page.

12. Security

Traffic is encrypted in transit, passwords are hashed, stored API keys are encrypted at rest and revealed only to their owner, and access to production systems is limited. No service can promise perfect security, so use a strong unique password and think before you publish.

13. Children

ShowShot is not intended for children under 13 and we do not knowingly collect their personal data. Write to us if you believe a child has given us data and we will remove it.

14. International transfers

Our providers operate globally, so your data may be processed outside your own country, including in the United States. We rely on the standard contractual protections those providers offer.

15. Changes

If we make a meaningful change we will update the date at the top of this page, and for significant changes we will tell you by email before they take effect.

16. Contact

Questions, requests, or complaints: [email protected]. ShowShot is operated by Workado LLC, Arizona, United States.