Privacy Policy

Last updated: 26 May 2026

This Privacy Policy explains how CodShot collects, uses, stores, shares, and protects personal data when you use our website, application, account features, workspace tools, public pages, AI-assisted features, subscriptions, and related services.

1. Data controller

The data controller responsible for CodShot is:

CodShot Kft.
Registered company name: CodShot Korlátolt Felelősségű Társaság
Registered Office: 36 Bercsényi Street, 1117 Budapest, Hungary
Hungarian tax number: 33080231-2-43
Company registration number: 01 09 458049

2. Personal data we process

Depending on how you use CodShot, we may process the following categories of personal data:

name, display name, username, email address, avatar, and profile information,
account registration data and account settings,
login, authentication, OAuth provider, email verification, password reset, 2FA, remember-me, and session data,
security logs, login logs, IP address, device information, browser information, operating system, and technical log data,
workspace data, including snippets, notes, collections, projects, tags, comments, shared content, collaboration data, and public snippets,
uploaded files, images, avatars, documents, AI input files, AI output files, and related metadata,
AI request data, prompts, submitted code, generated output, usage counters, and quota information,
subscription, plan, billing status, payment provider identifiers, invoices, tax-related and transaction-related data,
referral, affiliate, reward, commission, campaign, and promotional data,
newsletter preferences, email communication preferences, unsubscribe status, and communication logs,
support requests, feedback, ideas, bug reports, and messages sent through contact forms,
cookie identifiers, consent preferences, language settings, theme preferences, and analytics data where applicable.

3. Purposes of processing

We process personal data for the following purposes:

to provide, operate, maintain, and improve CodShot,
to create and manage user accounts,
to authenticate users and secure accounts,
to provide workspace, snippet, project, sharing, collaboration, and public discovery features,
to provide AI-assisted features such as code generation, code improvement, image-to-code, file-to-code, and metadata generation,
to manage plans, subscriptions, payments, billing, invoices, cancellations, and account access,
to enforce plan limits, AI quotas, storage limits, and feature restrictions,
to send service emails, security notices, account notifications, billing notices, and product updates,
to manage newsletters and marketing communications where you have subscribed or where otherwise legally permitted,
to prevent fraud, abuse, unauthorized access, spam, security incidents, and misuse of the service,
to analyze usage, fix bugs, monitor performance, and improve user experience,
to comply with legal, accounting, tax, regulatory, and dispute resolution obligations.

4. Legal basis for processing

Where the General Data Protection Regulation (GDPR) or similar laws apply, we process personal data based on one or more of the following legal bases:

Contract performance: when processing is necessary to provide CodShot, manage your account, deliver paid plans, or provide requested features.
Legitimate interests: when processing is necessary for security, fraud prevention, service improvement, abuse prevention, analytics, or protecting our rights, provided that your interests and rights do not override those interests.
Consent: when you subscribe to optional communications, accept optional cookies, or use features that require consent.
Legal obligation: when processing is required for tax, accounting, legal compliance, regulatory, or law enforcement purposes.

5. Account and authentication data

We process account and authentication data to allow you to register, sign in, verify your email address, reset your password, use two-factor authentication, manage sessions, and protect your account.

If you use Google, GitHub, or another OAuth provider to sign in, we may receive basic account information such as your email address, profile identifier, and name, depending on the provider and your settings.

6. User-generated content

CodShot is built around user-generated content such as code snippets, notes, projects, collections, files, comments, and shared materials.

We process this content to store, organize, display, search, share, synchronize, back up, and technically operate the service.

If you make content public, it may be visible to other users and visitors and may be indexed by search engines.

You should not upload or share confidential, sensitive, restricted, or third-party personal data unless you have the legal right to do so.

7. AI-assisted features

When you use AI-assisted features, the content you submit, such as code, text, images, files, or instructions, may be processed to generate, improve, analyze, or describe content.

AI requests may be sent to third-party AI service providers. These providers may process the submitted data only as necessary to provide the AI functionality, subject to their own terms and data processing rules.

You should not submit secrets, passwords, API keys, private credentials, confidential business information, sensitive personal data, or content you are not authorized to process through AI features.

We may store AI request metadata, generated outputs, usage logs, and quota information for security, abuse prevention, billing, debugging, and service improvement.

8. Payments and billing

If you purchase a paid plan, payment and billing data may be processed by third-party payment providers such as Stripe.

We do not store full payment card numbers on our own servers.

We may store payment provider customer IDs, subscription IDs, plan details, billing status, invoice references, cancellation status, transaction metadata, tax-related information, and related records needed to manage your subscription.

Payment providers may process your personal data according to their own terms and privacy policies.

9. Newsletter and communications

If you subscribe to newsletters, product updates, or marketing communications, we may use your email address and preferences to send such communications.

You can unsubscribe at any time using the unsubscribe link in the email or available account settings.

We may still send essential service emails, such as account security notices, password reset emails, billing notices, and important service-related messages.

10. Cookies and similar technologies

CodShot uses cookies, local storage, session storage, and similar technologies for authentication, session handling, CSRF protection, account security, language preferences, theme preferences, cookie consent storage, and core website functionality.

Optional analytics, marketing, or third-party cookies may be used only where legally permitted or based on your consent.

More information is available in our Cookie Policy.

11. Third-party service providers

We may use trusted third-party providers to operate CodShot. These may include providers for:

hosting and server infrastructure,
database and storage services,
email delivery,
authentication providers,
payment processing,
AI processing,
analytics and monitoring,
security and abuse prevention,
customer support and communication tools.

These providers may process personal data only as necessary to provide their services to CodShot or as otherwise described in their own legal documents.

We do not sell your personal data.

We do not share your personal data with third parties for their own independent marketing purposes unless you have given consent or where legally permitted.

12. International data transfers

Some third-party providers may process data outside your country or outside the European Economic Area.

Where required by applicable law, we rely on appropriate safeguards such as adequacy decisions, standard contractual clauses, data processing agreements, or other legally recognized transfer mechanisms.

13. Data retention

We keep personal data only as long as necessary for the purposes described in this Privacy Policy.

Account data is generally kept while your account is active.

User-generated content is generally kept while it remains in your account or until it is deleted, unless retention is required for backup, security, legal, or technical reasons.

Billing, tax, accounting, transaction, and legal records may be retained for the period required by applicable law.

Security logs and technical logs may be retained for a reasonable period to protect the service, investigate abuse, fix errors, and comply with legal obligations.

14. Account deletion

You may request deletion of your account and associated personal data.

Some data may remain temporarily in backups or logs, and some data may need to be retained for legal, tax, accounting, billing, fraud prevention, dispute resolution, or security reasons.

Public or shared content may need to be removed separately depending on how it was published, shared, copied, or referenced by other users.

15. Data security

We apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These measures may include access controls, password hashing, session security, CSRF protection, secure authentication flows, logging, monitoring, backups, and other security practices.

No online service can guarantee absolute security.

16. Your rights

Depending on applicable law, you may have the right to:

request access to your personal data,
request correction of inaccurate or incomplete data,
request deletion of your personal data,
request restriction of processing,
object to certain processing activities,
request data portability,
withdraw consent where processing is based on consent,
lodge a complaint with a data protection authority.

To exercise your rights, contact us at hello@codshot.com. We may need to verify your identity before fulfilling your request.

17. Children

CodShot is not intended for children who are not legally allowed to use online services without parental or guardian consent.

If we become aware that we have collected personal data from a child without the required consent, we will take appropriate steps to delete or restrict that data.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If changes are material, we may notify users through the service, by email, or by other reasonable means.

The latest version will always be available on this page.

19. Contact

If you have questions about privacy or data protection, contact us at hello@codshot.com or through the contact page.