Privacy policy

Jaywalk Labs AB (org. no. 556997-3109), Sweden, makes Bigshot and is the controller of the personal data described here. Bigshot is built to keep your screenshots on your Mac. We collect only what we need to sell and check a licence.

Your screenshots

• Captures, notes and the text Bigshot reads from them (OCR) are processed and stored on your Mac. OCR runs on the device. We never receive your screenshots.
• If you set up a Hook with the Anthropic API or the OpenAI API, Bigshot sends that capture, its OCR text, your note and the Hook's prompt straight from your Mac to that provider, using your own API key. If you use Claude Code or Codex, Bigshot runs the tool on your Mac and gives it the file. Those providers handle the data under their own privacy policies. Nothing is sent unless you set this up.
• Old captures are moved to the Trash after the retention period you choose in the app.

When you buy a licence

Paddle.com is our reseller and Merchant of Record. Paddle collects your payment and billing details and handles them under its own privacy policy. We never see your card details. From Paddle we receive and keep:

• your email address and, if given, your name
• Paddle's customer and transaction IDs, the amount, currency and date
• the details Paddle sends us about the purchase, refunds and chargebacks

We use these to issue your licence, email you the key, find your licence when you ask, handle refunds and keep the accounting records the law requires. Your licence key is stored only in a hashed form.

When the app checks your licence

When you activate a licence, and then at launch and once a day, the app sends us your licence key, an identifier for your Mac, your Mac's name (for example “Ada's MacBook Pro”) and the Bigshot version. We store the Mac identifier in hashed form, along with the name, version and when the Mac was activated and last checked in. This lets you see and free up your seats on the licence page. The app sends no analytics, crash reports or usage data.

The website

bigshot.pics sets no cookies of its own. To see which pages are read and whether the site is fast, it uses Vercel Web Analytics and Speed Insights. They record page views, a few events (such as a click on Download or opening checkout) and page load timings, each with the page address, the referring site, your country and region, and your browser, operating system and device type. They use no cookies and nothing stored in your browser; a visit is recognised by a hash of the request that is discarded after 24 hours, and IP addresses are not stored. Query strings are removed from page addresses before they are sent, except campaign tags such as utm_source. No email address, licence key or order number is ever included. PostHog, run in the same cookieless way, records the same page views and events, plus clicks on the page and how far a page is scrolled, so we can see where visitors stop between the home page and a purchase. It stores nothing in your browser and keeps no IP address or location. Paddle's checkout script may set cookies needed for payment and fraud prevention, and it is only loaded when you reach for a Buy button. Our host keeps short-lived server logs, which include IP addresses, for security and troubleshooting.

Who processes the data for us

• Paddle: checkout, payment, tax and refunds
• Vercel: hosting the website and the licence server, and the website's cookieless analytics
• PostHog: the website's cookieless product analytics
• Neon: the database that holds licences and activations
• Resend: sending the email with your licence key

Some of these companies are based in the United States. Transfers are covered by the EU–US Data Privacy Framework or the EU standard contractual clauses. We do not sell your data or share it with anyone else, unless the law requires it.

Legal basis and retention

We process purchase and licence data to perform our contract with you, and to meet accounting obligations. We keep it for as long as your licence exists. Accounting records are kept for seven years, as Swedish bookkeeping law requires. Ask us and we will delete everything else, which also ends the licence.

Your rights

You can ask to see, correct, export or delete your personal data, or object to how we use it. Email support@bigshot.pics from the address you bought with. If you are not happy with our answer, you can complain to the Swedish Authority for Privacy Protection (IMY) or the data protection authority where you live.

Changes

If we change this policy, we will update the date at the top. Questions about privacy: support@bigshot.pics.