Privacy policy

When you sign in we store the minimum needed to identify your account: your email address, your display name, your photo URL (if you sign in with Google), the timestamp of your last sign-in, and the Firebase user id that scopes your data.

When you create a project we store its name, your screenshot copy and caption settings, your design choices (font, colours, backgrounds, frame), and the per-project subscription state from Polar. Screenshots you upload remain in your browser storage by default; we only mirror non-image fields to our cloud backend so you can pick up where you left off across devices.

No advertising trackers. No selling your data, ever. We don't scrape the screenshots you upload for training or any other purpose. We do use a single privacy-respecting analytics property to understand traffic across popy.app — see Service providers below.

Heroshot runs on a small, named set of services:

• Firebase (Google) — Auth, Firestore database, Storage. Hosted in EU regions where available.
• Vercel — Hosting and serverless functions.
• Polar.sh — Subscription billing (handles payment data; we never see your card details).
• Google Gemini — Powers the AI background generator; only the prompt text you submit is sent.
• Google Analytics 4 — Aggregate site analytics (page views, traffic source, broad geography). One property spans landing, skills, and heroshot so we can see how people move between them. No advertising features are enabled and no user-level data is sent.

You can delete a project from the workspace at any time. To remove your entire account and associated data, fill out our contact form and we'll process the request within 30 days.

Privacy questions go through our contact form.