Screenshot HeroLegal
Privacy Policy
Last updated 15 October 2026
Screenshot Hero ("the app") is made by Xueni Ji ("we"), Carrer del Berguedà 35, 08029 Barcelona, Spain. This policy explains what the app does with your information.
In short
- Your screenshots and photos are read on your iPhone. Images are never sent to an AI service.
- Only if you allow cloud AI, the app sends the recognized text of a screenshot or note (never the image) to be read by an AI model. Passwords, one-time codes, card numbers, IBANs and ID numbers are masked on the iPhone first.
- If you don't allow it, nothing goes to any AI service: your iPhone sorts on its own.
- We don't store your screenshots, photos, notes or their text, and no one at Screenshot Hero looks at them. Everything the app keeps is kept on your iPhone. Our server only passes text to the AI model and back.
- With Own Key, our server isn't used at all.
- We don't sell your data, show ads, or track you across apps or websites. There is no account and no analytics SDK in the app.
What stays on your iPhone
- Photos and screenshots you let the app see, the text recognized from them (Apple Vision), the sorted cards, and your Notebook notes with their image copies.
- Your choices and settings, your Notion secret and, with Own Key, your API key (both in the iOS Keychain, on this device only, not in backups or iCloud).
- Analysis by Apple Intelligence on the device, where available.
What leaves your iPhone, and why
Cloud AI (only with your permission). You're asked before the first cloud read, and can change your answer any time in Settings › Privacy.
- Free and Monthly: the app sends our server the recognized text (with secrets masked), decoded QR or barcode text (Wi-Fi passwords removed), simple image labels (for example "document"), a random install identifier, your time zone, language and the date. Our server runs on Amazon Web Services and passes the text to a language-model provider: Nebius or OpenAI. It returns the result and keeps nothing: the text and the answer aren't stored, written to logs or read by anyone at Screenshot Hero. The providers process it under their own API terms. OpenAI doesn't use API data to train its models and may keep requests for up to 30 days to prevent abuse. Nebius's terms describe its handling of inputs and outputs, including their use to speed up its models ("speculative decoding"); see Nebius's privacy policy.
- Own Key: the same text goes straight from your iPhone to the provider you chose with your own API key (for example OpenAI, Anthropic, Google Gemini, DeepSeek, OpenRouter, Nebius, or an address you enter). Our server is not contacted at all: not for reads, notes, limits or device checks. That provider's privacy policy applies, and it may process data outside your country (DeepSeek, for example, in China).
- Notes: with "Tidy notes" on, a note's text goes the same way, to be given a title and summary.
Limits and abuse prevention. To apply the limits our server keeps counters per install and per subscription (and, for requests from builds without App Attest, per IP address), which expire within two days of their period's end, the time zone first used (to count days and months in it), kept 40 days, and an App Attest public key that proves requests come from the genuine app, deleted 90 days after its last use. They hold no content. If a subscription is refunded or revoked, its original transaction identifier is kept for 400 days so that its old signed transactions stop giving Monthly's limits. Error logs (for example "a provider timed out") hold no text from your screenshots or notes and are deleted after 14 days.
Usage statistics. To plan costs and capacity, our server counts what it does: requests, screenshots and notes read, tokens, cost and response time, by plan (Free or Monthly) and AI model, and how many installs and subscriptions used it each day. The counts carry no install identifier, no transaction identifier and no content, so they can't be traced to anyone. Apple also tells our server when a subscription starts, renews, ends or is refunded; we count those events the same way and keep nothing else from them.
Purchases. Apple handles payment. With Monthly, the app sends our server the App Store's signed transaction (product, transaction identifiers, expiry) so it can apply Monthly's limits. We never receive your name, Apple Account or payment details.
Things you choose to do.
- Adding an event, reminder or contact uses the system apps.
- Sending a note to Notion sends its text, and its images if "Keep the image in notes" is on, to Notion with your own secret, straight from your iPhone.
- Other apps (Google Calendar, Things, Todoist and others) receive what you send them.
- Finding a place from a screenshot sends the search, and your approximate location if you allowed it, to Apple Maps.
Their privacy policies apply to what you send them.
Who processes it, where, and for how long
| Who | Role | What | Where | Kept |
|---|---|---|---|---|
| Amazon Web Services | runs our server (processor) | text in transit, counters, App Attest keys, error logs, anonymous usage counts | United States (N. Virginia) | text: not kept; counters: up to 2 days; App Attest key: 90 days after last use; error logs: 14 days; anonymous usage counts: 15 months |
| Nebius | AI model (processor) | the masked text of a screenshot or note | EU or US data centres | under Nebius's API terms and privacy policy |
| OpenAI | AI model, fallback (processor) | the masked text of a screenshot or note | United States | under OpenAI's API terms: up to 30 days for abuse monitoring, not used for training |
| Apple | App Store, payments, App Attest | purchases and the device check | Apple's terms | Apple's terms |
With Own Key, none of the first three are involved: the provider you chose receives the text directly from your iPhone, under your own agreement with it.
When data goes to a provider outside the European Economic Area or the UK (for example OpenAI in the United States), the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
Legal basis (EEA, UK, Switzerland)
- Cloud AI, for screenshots and notes: your consent (GDPR Art. 6(1)(a)), asked before the first cloud read. You can withdraw it any time in Settings › Privacy; that stops new cloud reads and doesn't affect earlier ones.
- Monthly's limits: performing our contract with you (Art. 6(1)(b)).
- Daily limits, App Attest and error logs: our legitimate interest in keeping the service working and preventing abuse (Art. 6(1)(f)). They hold no content.
Your rights
Depending on where you live (for example under the GDPR or the California Consumer Privacy Act), you can ask to access, correct or delete your personal data, restrict or object to its processing, receive it in a portable form, and withdraw consent. You can also complain to your data protection authority.
We hold no account, no content and nothing with your name, so there is usually nothing on our side to give or delete: what the app keeps is on your iPhone, under your control, and the counters and keys on our server expire by themselves. Write to contact@screenshothero.app and we'll answer within one month. We don't sell or share personal information, as those terms are defined in California law.
Your choices
- Turn cloud AI on or off in Settings › Privacy.
- Change Photos access (all photos, selected photos, or chosen albums) in the app or in iOS Settings.
- Remove your API key in Settings › Plan › Your API key.
- Delete the app to remove what it stored on your iPhone. Keychain items may survive reinstall until you remove them in the app. To ask about data on our side, contact us.
Children
The app isn't directed to children under 13, or under the age of digital consent where you live (16 in some EU countries).
Changes and contact
We'll update this page when the app's handling of data changes. The controller is Xueni Ji, Carrer del Berguedà 35, 08029 Barcelona, Spain. Questions: contact@screenshothero.app.