Overview
ShutterPost is operated by MegaPix Design Group, LLC, based in Canton, Georgia ("we", "us", or "our"). This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information. It applies to the ShutterPost website (shutterpost.net), the web app (app.shutterpost.net), and the ShutterPost mobile apps for iOS and Android.
By using ShutterPost, you agree to the collection and use of information in accordance with this policy.
Information We Collect
We collect the following information when you use ShutterPost:
- Account information: Your email address and password (stored as a secure hash) when you register.
- Connected account credentials: OAuth access tokens issued by Instagram and Facebook (Meta), TikTok, YouTube (Google), Google Drive, Dropbox, and Microsoft OneDrive when you choose to connect them. These tokens let ShutterPost read from your designated cloud folder or publish to your accounts on your behalf. We never see or store your passwords for these services.
- Connected account profile details: Basic details the platforms return when you connect, such as your account or channel name, Page name, and profile picture, so we can show you which account is connected.
- Photos and videos: Media read from the cloud folder you designate, or uploaded directly to ShutterPost, used to create and publish posts and to provide the AI features you choose to use.
- High-resolution output: High-resolution enhancement results are delivered to your device and are not kept on our servers.
- Posting history: Records of posts made on your behalf, including timestamps and captions, so you can review your history and so we can prevent duplicate posts.
- Billing information: Subscription status, credit balances, and payment details managed by Stripe. We do not store your full card number. Purchases are made on our website; the mobile apps do not sell anything.
- Usage data: Server logs including IP addresses and request timestamps, used for security and debugging.
How We Use Your Information
We use the information we collect to:
- Provide and operate ShutterPost: detecting new photos and videos, generating AI captions and hashtags, enhancing images, generating AI videos, and publishing to the accounts you connect.
- Send transactional emails such as sign-up verification codes, subscription confirmations, billing notices, trial reminders, inactivity reminders, and service alerts. Tips and reminder emails include an unsubscribe link; account and billing emails are always sent.
- Send app notifications you have allowed, such as when a post publishes or a connected account needs attention.
- Prevent abuse, fraud, and unauthorized access to your account — for example, limiting each person to one free trial, declining temporary email addresses, and limiting how many accounts can be created from one network in a day.
- Improve the service based on aggregate, anonymized usage patterns.
We do not sell your personal information. We do not show ads. We do not use your photos, videos, captions, or connected account data to train AI models.
Mobile Apps
The ShutterPost apps for iOS and Android give you access to the same account and features as the web app. In addition to the information described above:
- Photos and camera: The apps access your photo library or camera only when you choose a photo or video to upload, and only the items you select.
- Saving files: When you save an image or video, it is written to your device and handed to your device's share sheet. We do not read other files on your device.
- Signing in to connected services: Connecting Instagram, Facebook, TikTok, YouTube, Google Drive, Dropbox, or OneDrive opens that service's sign-in page in your device's browser. Your credentials go directly to that service, not to us.
- Notifications: The apps ask before sending notifications. If you allow them, we store a notification token for your device, along with its platform (iOS or Android), app version, and device model, so we can alert you when a post publishes or fails, when a reel or Photo Studio batch finishes, when content is blocked by moderation, or when a connected account needs to be reconnected. Notifications are delivered through Google's Firebase Cloud Messaging and, on iPhone and iPad, Apple's Push Notification service; they contain a short message about the event and no photos or videos. You can choose which notifications you get in Preferences, or turn them off in your device settings.
- No tracking: The apps contain no advertising or third-party analytics SDKs and do not track you across other companies' apps or websites.
Apple and Google distribute the apps through the App Store and Google Play and may collect information under their own privacy policies, such as download and crash statistics.
Instagram and Meta Platform Data
ShutterPost uses the Instagram Graph API and Meta's Facebook Platform APIs. Our use of Meta platform data is limited to publishing media to your Instagram account and/or Facebook Page on your behalf.
- We request only the permissions needed to publish media to the platforms you choose to connect.
- Instagram and Facebook connections are independent. You may connect either or both.
- We do not access your followers, direct messages, private profile data, or friend lists.
- We do not share your Instagram or Facebook data with third parties, except as required to operate the service.
- Your Instagram and Facebook Page access tokens are stored encrypted at rest and used only to authenticate API calls made on your behalf.
- You may revoke access at any time in each platform's app settings or by disconnecting in ShutterPost's Connections settings.
- Upon account deletion, all stored Meta access tokens are permanently deleted.
- Our use and transfer of information received from Meta APIs adheres to the Meta Platform Terms.
YouTube Data
ShutterPost uses the YouTube API Services to publish videos, including Shorts, to your YouTube channel when you connect it. We request two permissions: youtube.upload, to upload the videos you choose to publish, and youtube.readonly, to read your channel name so we can show which channel is connected. We do not read your subscribers, comments, watch history, or analytics.
By connecting YouTube, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
Your YouTube access token is stored encrypted at rest and used only to make API calls on your behalf. It is deleted when you disconnect YouTube in ShutterPost or delete your account. You can also revoke ShutterPost's access at any time from your Google security settings.
Google Drive Data
ShutterPost connects to Google Drive using the drive.readonly scope. We access only the folder you designate as your watch folder and its contents. We never modify, move, delete, or write files in your Google Drive.
You can revoke access at any time from your Google security settings or from ShutterPost's Connections settings.
Google API Limited Use Disclosure
ShutterPost's use and transfer of information received from Google APIs, including Google Drive and YouTube, adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Google user data is used only to provide the features you use in ShutterPost: reading media from your designated Drive folder, creating posts from it, and publishing videos to your YouTube channel.
- We transfer Google user data to third parties only as needed to provide those features, such as sending a photo you chose to the AI provider that writes its caption or enhances it, or publishing it to a social account you connected.
- We do not use Google user data for advertising, and we do not sell it.
- We do not allow humans to read Google user data, except with your consent, for security purposes, or to comply with the law.
- We do not use Google user data to develop, improve, or train generalized AI or machine-learning models.
Dropbox Data
ShutterPost connects to your Dropbox account to monitor the folder you designate during setup. We access only that folder and do not read any other files in your Dropbox. You can revoke access at any time at dropbox.com/account/connected_apps.
Microsoft OneDrive Data
ShutterPost connects to OneDrive through Microsoft Graph using the Files.Read, User.Read, and offline_access permissions. We read only the folder you designate as your watch folder and your basic profile (name and email) to show which account is connected. We never modify, move, or delete files in your OneDrive. You can revoke access at any time at account.live.com/consent/Manage or from ShutterPost's Connections settings.
TikTok Platform Data
ShutterPost connects to your TikTok account using TikTok's Content Posting API, solely to publish video content to your account on the schedule you configure. We do not access your TikTok followers, messages, analytics, or private account data. Your TikTok access token is stored encrypted at rest and used only to authenticate posting requests. You can revoke access at any time in TikTok's settings or from ShutterPost's Connections settings.
ShutterPost's use of the TikTok Content Posting API is subject to TikTok's Terms of Service and Privacy Policy.
AI Caption and Hashtag Generation
ShutterPost uses the Anthropic Claude API to write captions and suggest hashtags. To describe what is actually in your post, we send Anthropic up to three of the post's images (or a single frame taken from a video), along with post details such as the folder name and any instructions you have added. Anthropic processes this data under its commercial terms and privacy policy. We do not use your images, captions, or hashtags to train AI models.
AI Image Enhancement (Photo Studio)
Photo Studio uses Google's Gemini image editing API to enhance your photos. Images you submit for enhancement are sent to Google's API for processing. Enhanced images are stored on our servers for up to 30 days and then permanently deleted, and you can delete them sooner from within the app. We do not use your images to train AI models.
AI Video (Reels Studio)
Reels Studio uses third-party AI video providers to create short videos from your images, prompts, and scripts: fal.ai (Wan, Kling, Hailuo), Luma AI, and MiniMax for generated video, and HeyGen for avatar videos and AI voiceovers. The images, prompts, scripts, and voice or avatar selections you submit are sent to the provider you choose. Generated videos are stored on our servers for up to 30 days and then permanently deleted. Each provider handles data under its own privacy policy. We do not use your content to train AI models.
Agency and Client Workspace Data
Agency plan subscribers may create client workspaces within their ShutterPost account. Each workspace has its own social account connections, cloud storage folder, posting history, and settings. The agency account holder has administrative access to every workspace they manage. Client workspace data follows the same retention and deletion rules as standard accounts, and is deleted along with the agency account.
Content Moderation
ShutterPost uses automated tools, including AWS Rekognition and AI-based screening, to detect potentially inappropriate content before it is published. Images are screened when they are added. No human reviewers look at your images as part of this process. Images that fail moderation are flagged in your dashboard and are not published.
Data Retention
- Account data: Kept for as long as your account is active.
- Enhanced images and generated videos: Automatically deleted after 30 days, or sooner if you delete them.
- High-resolution outputs: Delivered to your device and not kept on our servers.
- Posting history and captions: Kept until you delete your account.
- Access tokens: Deleted when you disconnect the service or delete your account.
- Notification tokens: Deleted when you sign out of the app on that device, when you delete your account, or when the app is uninstalled and the token stops working.
- Server logs: Kept for up to 90 days for security purposes.
- Sign-up network addresses: The IP address used to create an account is counted for up to 3 days to limit repeated sign-ups, then discarded.
- Trial records: To allow one free trial per person, we keep a one-way cryptographic hash of the email address used for a trial, including after the account is deleted. The hash cannot be turned back into your email address and is used only to check whether an address has already had a trial.
- Unused photos after posting: Photos left over after you publish part of a post stay in your inbox for 30 days (you can extend this), then are removed.
Deleting Your Account
You can delete your account at any time from Preferences → Delete Account in the web app or the mobile apps. When you do:
- You are signed out on every device immediately.
- Any active subscription is canceled, so you will not be charged again.
- Your account and its data, including connected account tokens, posts, media, and workspaces, are permanently deleted after a 7-day grace period. Contact us during that period if you deleted your account by mistake.
- Any remaining copies in backups are removed within 30 days.
You can also request deletion by emailing privacy@shutterpost.net. For requests initiated through Meta, we provide a data deletion callback at https://app.shutterpost.net/instagram/data-deletion.
Third-Party Services
ShutterPost works with the following services, each governed by its own privacy policy:
Security
We use industry-standard practices to protect your data, including encrypted storage of OAuth access tokens, HTTPS for all data in transit, and hashed passwords. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
Children's Privacy
ShutterPost is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact privacy@shutterpost.net and we will delete it.
Your Rights
You can access, correct, or delete your personal data at any time. You may:
- Delete your account from Preferences in the web app or mobile apps.
- Disconnect any connected service from the Connections settings, which deletes the stored token.
- Delete enhanced images and generated videos from Photo Studio and Reels Studio.
- Request a copy of your data or ask about our data practices by emailing privacy@shutterpost.net.
Depending on where you live, you may have additional rights under local law, such as the right to know what we collect or to opt out of certain processing. We will honor those requests as the law requires.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or with a notice in the app. Continued use of ShutterPost after changes are posted means you accept the revised policy.
Contact
Questions about this Privacy Policy? Contact MegaPix Design Group, LLC, Canton, Georgia, at privacy@shutterpost.net.