Privacy Policy

This Privacy Policy explains how Shoot collects, uses, stores, and shares information when you use the Shoot website, the iOS and Android apps, the marketplace, onboarding flows, dashboards, campaign tools, chats, support tools, and related services.

Shoot is a clipping campaign marketplace. That means we process information about creators, businesses, campaigns, submissions, review decisions, community messages, notifications, identity checks, and payouts.

The data controller is Edward Forrester Limited.

We collect account information such as your name, email address, profile photo, selected role, username, date of birth, country, onboarding status, workspace preference, and authentication provider.

Authentication may be handled through Firebase Authentication with Google, Apple, or an emailed sign-in code. Those providers process sign-in information under their own privacy policies. Your date of birth is used to check that you meet the minimum age (13 to use Shoot; 18 to receive payouts) and is not shown on your profile.

Business users may provide business names, brand profiles, logos, websites, bios, team members, campaign thumbnails, descriptions, budgets, platform choices, guidelines, invite links, brand assets, and campaign settings.

Some brand and campaign information is public when a campaign or Shoot community is public, or when a creator views a campaign invite page.

Creator users may provide display names, usernames, profile photos, social handles, niche tags, campaign joins, submitted post links, captions, uploaded videos, notes, community messages, reactions, and payout preferences.

When you submit a post, we read its public metadata from the platform or from our view-data providers: the caption, length, sound, views, likes, comments, shares, and thumbnail. Submissions, review status, rejection reasons, view counts, and payout status are visible to the business running the campaign and its team.

If we ask you to prove your audience is real, you may record and send us a screen recording of your own analytics. That recording is stored with the submission and shown to the business only where it needs it to decide the payout.

Before your first payout we verify your identity through Didit, which asks for a government ID, a short liveness video, and a face match against the ID. Didit processes that data under its own privacy policy. Shoot stores the outcome, your verified name, your date of birth (to confirm you are 18 or over), the country of the document, and a reference to the check — not the ID images themselves.

Biometric processing (the face match) is carried out by Didit to confirm the ID belongs to you. It is only run when you start verification, and only for payouts.

Creators may provide bank account details for transfers through Wise (we store the account holder name, country, currency and a masked account reference; Wise holds the full details), or a USDT wallet address on the Ethereum network for crypto payouts. Wallet addresses are stored so we can send to them and so a payout can be traced.

Businesses fund campaigns through Stripe (cards) or through Plaid for bank debits. Card and bank credentials are entered in the provider's own fields and are never stored by or transmitted to Shoot. We store the transaction reference, amount, currency and status.

Stripe, Wise, Plaid, and banks may collect identity, tax, payment, fraud-prevention, and compliance information directly under their own terms and privacy policies.

We process campaign joins, submitted post URLs, review decisions, rejection reasons, resubmissions, view counts over time, bot-risk scores, payout estimates, payout status, notifications, and campaign analytics.

To read public post metadata and view counts we use our own scraping service and third-party data providers: SociaVault, Bright Data, HikerAPI (for Instagram), Jina Reader, the YouTube Data API, and, where you connect an account, the TikTok and Instagram APIs. These receive the public URL of the post and, for connected accounts, the tokens you authorise. We may also use xAI to help validate links or summarise content. Automated results can be wrong and may be reviewed or adjusted by a person.

Shoot records product analytics events (for example that a campaign was created or a clip was approved) against your account, on our own servers, to understand which features work and to find problems. We do not run third-party analytics or advertising trackers.

You can connect a YouTube channel, an Instagram professional account, or a TikTok account by signing in to that platform and approving Shoot's request. Access is read-only: Shoot can never post, comment, message, edit, or delete anything on your account.

What we read. YouTube (scopes youtube.readonly and yt-analytics.readonly): your channel's ID, name, handle and picture; and, for videos you submit to a campaign, their view, like and comment counts and their audience analytics (views by country, viewer age and gender, watch time, traffic sources and views over time). Instagram (instagram_business_basic and instagram_business_manage_insights): your account ID, username and picture, your media list (to find the post you submitted), that post's insights (views, reach, likes, comments, shares, saves and watch time), and your account's audience demographics (country, age and gender). TikTok (user.info.basic, user.info.profile and video.list): your profile (ID, display name, username and picture), and your videos' view, like, comment and share counts.

Why. To confirm that a post you submit was published from your own account, to count its views directly from the platform, and to show the business running the campaign the audience of that post in place of a screen recording, so it can release your payout. The same numbers help us detect bought or automated views. We read data only for posts you submit to Shoot and for the account you connected, and only while you remain connected.

Who sees it. The audience and view data for a submitted post is shown to the business running that campaign and its team, and to Shoot staff reviewing payouts or fraud. We do not sell it, use it for advertising, share it with data brokers, or use it to train AI models.

Storage and security. The access tokens the platform gives us are encrypted (AES-256-GCM) and held only on our servers; they are never sent to your browser or app. The numbers read for a submission are stored with that submission.

Disconnecting and deletion. You can disconnect an account at any time in Settings → Connected accounts; Shoot then revokes its access where the platform allows it and deletes the stored tokens immediately. You can also remove Shoot's access from the platform: Google at myaccount.google.com/permissions, Instagram in Settings → Apps and websites, TikTok in Settings and privacy → Security → Manage app permissions. To have the data read from a connected account deleted, email contact@tryshoot.com or delete your Shoot account; we delete it within 30 days, except numbers attached to a submission that was paid, which are kept with the payment record as described under Retention.

YouTube. Shoot uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service (www.youtube.com/t/terms), and Google's Privacy Policy (policies.google.com/privacy) applies to Google's handling of your data. Shoot's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

If you contact support or use in-app messaging, we collect message content, attachments, timestamps, sender details, conversation status, and related support metadata. Messages in community chats are visible to the members of that community.

We send push notifications through Apple's and Google's push services and transactional emails through Resend: account updates, clip review updates, campaign activity, support replies, payout updates, security codes, and service notices. Tips and digests can be switched off in Settings or from the link in any such email.

We may collect technical information such as device type, browser type, IP address, pages viewed, interactions, session state, errors, performance data, and approximate location derived from network information.

Shoot keeps you signed in with Firebase authentication state and remembers preferences in your browser's local storage. We set no advertising or analytics cookies. What is stored, and how to clear it, is described in our Cookie Policy at tryshoot.com/cookies.

We use information to create accounts, route onboarding, operate campaigns, display marketplace listings, process joins, accept submissions, support review queues, estimate payouts, verify identity where the law and our payment providers require it, provide dashboards, send notifications, prevent fraud and abuse, improve the product, and respond to support requests.

We may also use information to debug errors, enforce our terms, protect users, comply with legal obligations, maintain security, and understand which features are working.

Campaign and submission data is shared between the relevant business and creator accounts inside Shoot so campaigns can be operated. Public campaign and community information may be visible to visitors and signed-in users. Invite-only campaign information may be visible to people who receive the invite link.

We do not sell personal information. We share information with the service providers named in this policy as needed to run Shoot, with payment providers to move money, with authorities where the law requires it, and with parties involved in a business transfer such as a merger or acquisition.

Hosting and infrastructure: Cloudflare (hosting and runtime), Firebase by Google (authentication, database, file storage, push notifications). Email: Resend. Payments: Stripe, Wise, Plaid. Identity verification: Didit. Post metadata and view data: our own scraping service, SociaVault, Bright Data, HikerAPI, Jina Reader, the TikTok, Instagram, and YouTube APIs. AI-assisted checks: xAI.

Some of these providers are based in, or process data in, the United States. Where your information leaves the country you live in, it is protected by the provider's contractual safeguards, such as standard contractual clauses.

Account, profile, campaign, submission, chat, notification, and support records are kept for as long as your account exists, and are deleted or anonymised within 30 days of your account being deleted, except as set out below.

Payment, payout, ledger, invoice, and identity-verification outcome records are kept for as long as tax, accounting, and anti-money-laundering law require, typically 6 to 7 years. Submissions and review decisions on a campaign are kept as part of the business's campaign records. Fraud-prevention records are kept where an account was banned. Draft campaign data may be cached locally in your browser to prevent accidental loss.

We use reasonable technical and organisational measures designed to protect information. No internet service can be guaranteed to be fully secure.

You are responsible for using a secure sign-in, protecting your device, and telling us promptly if you believe your account has been accessed without permission.

You can update profile information, payout details, connected accounts, notification preferences, and theme preferences inside Shoot where those controls are available. Tips and digest emails have an unsubscribe link.

You can delete your account yourself in Settings → Account security → Delete account, or ask us to at tryshoot.com/delete-account. You may also contact us to request access to, correction of, or a copy of your personal information. Some information must be retained for legal, security, payment, fraud-prevention, or dispute reasons, as described under Retention.

Depending on where you live you may also have the right to object to or restrict certain processing and to complain to your local data protection authority. We reply to requests within 30 days.

You must be at least 13 years old to use Shoot, and the minimum age in your country if that is higher. We ask for a date of birth at sign-up and do not accept accounts under 13. If you are between 13 and 18, a parent or legal guardian must agree to our terms and supervise your use of Shoot. Payouts are only available to people aged 18 or over, confirmed by the date of birth on your government ID.

If you believe a child under 13 has provided personal information to Shoot, contact us so we can remove it.

Questions about this Privacy Policy, and access, correction, or deletion requests, can be sent to contact@tryshoot.com.

We may update this policy from time to time. If changes are material, we will take reasonable steps to notify users through the product or another appropriate channel.