ShotvikPrivacy notice (beta)
Last updated: 3 October 2026
Shotvik is in a private beta. This short notice describes what happens with personal data during the beta. A full privacy policy will follow.
This website
- This website (shotvik.com, including the docs and the ShotvikBot page) sets no cookies and uses no analytics.
- The docs pages remember which sidebar sections are open in your browser’s session storage. That stays in your browser, isn’t sent to us, and is cleared when you close the tab.
- Our web server (Caddy) keeps an access log of requests to this website and the API: time, requested path without the query string, status and IP address. Logs are kept for at most 30 days.
When you email support@shotvik.com or abuse@shotvik.com, we receive your message and use it to answer you. Cloudflare Email Routing forwards these addresses to a Gmail mailbox (Google), where we read and answer them.
Beta users
If you’ve been invited to the beta, we keep:
- Account details: your email address, your plan, your API keys (stored only as a hash; the key is shown to you once), your signing secrets (stored encrypted), your monthly usage counts and any templates you save.
- API request log: for each request, the key and account ID, endpoint, target hostname (no path or query), time, status, duration, block reason and request ID. Your IP address is stored only as a hash with a salt that changes every 30 days; the old salt is deleted. Entries are kept for 30 days. No render content is logged.
- Renders: not stored by default. If you set
cache=true, the image is kept for up to 30 days. - Admin actions: actions we take on an account (for example blocking a key or deleting an account) are recorded in an audit log, kept for 12 months.
Who is involved
- Hetzner hosts our server (website, API, database and backups) in Helsinki, Finland, in the EU.
- Cloudflare provides DNS for shotvik.com and forwards email to support@ and abuse@. Website and API traffic goes directly to our server, not through Cloudflare.
- Google (Gmail) hosts the mailbox where email to support@ and abuse@ arrives.
Cloudflare and Google are US companies.
Access and deletion
You can ask for a copy of your data or for its deletion at support@shotvik.com.
When we delete an account, its API keys stop working immediately. There is a 7-day cooling-off period in which the deletion can be undone. After that, the account data is deleted, at the latest 30 days after the deletion. Backups are overwritten within 7 days after that. The audit log entry recording the deletion (account ID, no email address) is kept for 12 months.