Privacy Policy - Shortcuty

Introduction

Welcome to Shortcuty. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, share, and safeguard your information when you use the Shortcuty website, iOS app, and related services.

Information We Collect

Community Translation Data (if you opt in):

If you enable "Donate Your Translations," text content translated by Apple Intelligence on your device is anonymously submitted to Shortcuty's translation server
This includes the original text, the translated text, and the target language
No account information, user identifiers, or device identifiers are attached to donated translations
This feature is entirely opt-in and can be disabled at any time in Translation Settings
Legal basis (GDPR): We process this data based on your explicit consent when you enable the Donate Your Translations feature

Account Information:

Username (publicly visible)
Email address (for account management and notifications)
Password (encrypted and securely stored)

Content Data:

Shortcuts you create and share
Shortcut descriptions, categories, and metadata
Comments and interactions on shortcuts
Screenshots and images you upload

Usage Information:

Download counts and interaction metrics
App usage patterns and preferences
Device information for app functionality
Website analytics such as page views, referrers, and general device/browser information

Firebase Analytics Data:

App instance identifier unique to Shortcuty
App usage data such as screens viewed, features used, and session duration
Device information such as model and operating system version
General location derived from IP address, such as country or region
This data is collected automatically to help us understand app usage and improve our service
Data is processed by Google according to their privacy policy

API Usage Tracking:

When shortcuts use the Shortcuty update API (via Shortcut Action or REST API) to check for updates, we collect IP addresses server-side
IP addresses are hashed with the current date, the shortcut identifier, and a secret salt that changes daily to create dynamic daily identifiers
Hashing reduces direct identifiability but does not necessarily make information anonymous. We use hashed request information to produce usage estimates and limit abuse. Creators receive statistics rather than raw IP addresses or request signatures.
This hashed data is used to estimate active user counts for shortcuts and is shown in analytics charts to shortcut developers
Legal basis (GDPR): We process IP addresses based on our legitimate interest in providing analytics to shortcut developers and improving our service. You have the right to object to this processing (see "Your Rights" section)

Auto-Updater Tool Data:

When you use the auto-updater tool, we process your shortcut through our servers
We collect the shortcut UUID, version number, and iCloud URL needed to add update-checking functionality
The processed shortcut file is returned to you immediately
We do not store the shortcut content itself, only limited metadata needed for processing
Legal basis (GDPR): We process this data based on your explicit consent when you choose to use the auto-updater tool

Push Notification and Device Data:

If you enable push notifications, we store your device token, device type, app bundle ID, and notification preferences to send and manage notifications
We may also store notification records such as titles, messages, related shortcut identifiers, read state, and timestamps
You can disable notifications in your device settings and update notification preferences in the app

Authentication Data:

Shortcuty supports Sign in with Apple
When you sign in with Apple, we receive your Apple identifier, identity token, and for new accounts your email address
We validate the Apple identity token server-side before creating or authenticating your account

Biometric Data:

If you enable biometric authentication such as Face ID, Touch ID, or Optic ID, authentication is performed locally on your device
We do not collect, store, or transmit biometric data to our servers

Payment and Subscription Data:

When you make in-app purchases, payment processing is handled by Apple through the App Store
We do not collect or store credit card information or payment details
We receive subscription status and related transaction information through RevenueCat and Apple's App Store to manage premium access

Public and User-Generated Data:

Your username, shared shortcuts, public profile information, comments, interactions, screenshots, and certain activity may be visible to other users

How We Use Your Information

We use your information to:

Provide and maintain the Shortcuty service
Enable you to create, share, and discover shortcuts
Facilitate community interactions and comments
Send important account and service notifications
Improve our platform and user experience
Ensure security and prevent abuse
Provide analytics to shortcut developers about their shortcut usage and active-user estimates
Generate usage statistics and metrics for service improvement
Provide automatic translations of submitted text in supported languages
Process shortcuts through the auto-updater tool to add update checking functionality
Manage premium subscriptions
Store and serve anonymously donated translations to power community translations when you opt in

Automatic translations

Shortcuty processes text you submit, including shortcut names, descriptions, version notes, comments, replies, and profile biographies, to provide translations in supported languages. Processing may occur before content is approved or made public.

Our translation service generates translations on computing infrastructure operated by Shortcuty. We store translations and associated language, content-reference, and processing information so we can reuse translations and manage translation jobs. Your original text is preserved. Translation availability does not change who is permitted to view the underlying content.

Information Sharing

Public Information:

Your username and shared shortcuts are publicly visible
Comments and interactions on shortcuts are public
Your profile information may be visible to other users

Third-Party Services:

Cloudflare: Our servers use Cloudflare for security, performance, and DDoS protection. Cloudflare may process your IP address and request data according to their privacy policy.
Firebase Analytics (Google): We use Firebase Analytics to understand app usage and improve our service. Firebase may process app instance identifiers, usage data, device information, and general location. For more information, see Firebase Privacy Policy and Google Privacy Policy.
RevenueCat: We use RevenueCat to manage premium subscriptions, subscription status, and renewals.
Apple: Apple processes Sign in with Apple authentication and App Store payments under Apple's own terms and privacy policies.

Analytics Sharing with Developers:

Usage statistics, including active-user estimates, are shared with shortcut developers
Update-API active-user estimates are derived from hashed IP addresses and show trends over time in charts
Creators receive statistics rather than raw IP addresses or request signatures.
Developers can only see usage statistics for shortcuts they have created

Community Translation Donations:

If you enable "Donate Your Translations," translated text is stored on our servers and made available to other Shortcuty users
Donated translations contain no user identifiers and are intended to remain anonymous
You can opt out at any time in Translation Settings

We do not sell your personal information. We only share data:

When required by law or legal process
To protect our rights or the safety of users
With service providers who help operate our platform

Data Security

We implement appropriate security measures to protect your data:

Passwords are encrypted using industry-standard methods
Data transmission uses HTTPS/TLS where appropriate
Access to personal data is restricted to authorized personnel
We use secure authentication methods and access controls
Biometric authentication data is processed locally on your device and never transmitted to our servers

Data Breach Notification:

If a data breach may affect your personal information, we will notify affected users and relevant authorities when required by applicable law

Your Rights

You have the right to:

Access and update your account information
Delete your shortcuts and comments
Request account deletion
Opt out of non-essential communications
Export your data upon request

GDPR Rights (for EU users):

Right of access: Request a copy of your personal data
Right to rectification: Correct inaccurate data
Right to erasure: Request deletion of your identifiable personal data
Right to data portability: Receive your data in a structured format
Right to object: Object to processing based on legitimate interests (including IP tracking for analytics)
Right to restrict processing: Request limitation of how we process your data
To exercise these rights, contact us at [email protected]

CCPA Rights (for California users):

Right to know: Know what personal information is collected
Right to delete: Request deletion of your identifiable personal information
Right to opt-out: Opt out of sale of personal information (we do not sell your data)

Data Retention

We retain your data for as long as your account is active or as needed to provide services. When you delete your account:

Your personal information is permanently removed
Public content may remain for platform integrity
Backup copies are securely deleted within 30 days

Specific Retention Periods:

Account data: retained while your account is active, then deleted within 30 days of account deletion unless longer retention is legally required
Notification device tokens and notification preferences: retained while needed to provide notifications and removed or deactivated when no longer needed
Content such as shortcuts, comments, and screenshots: retained while your account is active and may remain for platform integrity, moderation records, or legal obligations after deletion
Payment and subscription records: retained as required by Apple, RevenueCat, tax, accounting, or other legal obligations
Existing download counts and update-API statistics are retained for service improvement and reporting.

API Usage Tracking Data:

Hashing reduces direct identifiability but does not necessarily make information anonymous.
Hashed IP address data used for active user estimates is retained for analytics purposes
You may contact us to exercise your applicable privacy rights. Whether we can locate and act on a particular record depends on what information we retain and whether it can be associated with you.

Previously collected optional usage aggregates

Shortcuty previously collected optional daily shortcut detail-view and counted-download request totals, and limited hourly totals. This additional collection has stopped. Existing aggregate rows are removed from the active statistics table after six UTC calendar months. Routine SQL backup exports exclude these rows; managed database recovery logs have a 27-day expiry setting with daily rotation. This does not delete historical totals immediately.

These historical aggregate records contained shortcut references, UTC dates or hours, request categories, counts, and limited referral categories or approved hostnames. They did not contain visitor identifiers. This retention schedule does not describe account records, existing download records, update-API statistics, Firebase data, or translations.

Age Requirement

Shortcuty is only for users 18 years and older. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from someone under 18, please contact us immediately and we will delete their account.

Children's Privacy (COPPA):

Shortcuty is not intended for children under 18 years of age
We do not knowingly collect personal information from children under 18
If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country.

Our servers and service providers may operate in multiple countries
Third-party providers such as Cloudflare, Google, RevenueCat, and Apple may process data in various locations
We take reasonable safeguards to protect your data regardless of where it is processed

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes through the app or via email. Your continued use of Shortcuty after changes take effect constitutes acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or our data practices, please contact us:

Email: [email protected]

You can also reach us through the app's support features or feedback system. We'll respond to privacy-related inquiries as promptly as possible.