ShotDemo

Policies

Privacy Policy

Last updated: 11 November 2026

ShotDemo is run by Narendra K Ram in India. This page explains what we collect when you make demos with ShotDemo, what we collect from the people who view them, why, and what you can ask us to do with it. Questions: email@shotdemo.com.

If you make demos

  • Your account. When you sign in with Google or Microsoft we receive your name, your email address and that account's id. We do not receive your password. The first time you sign in with Microsoft, we email you a code to confirm the address, because Microsoft does not confirm it for us. When you sign in with your email address instead, we email you a six-digit code to type back: we keep the address, and the code only in a scrambled form we can check against, until it is used or ten minutes pass. Whichever way you sign in, your email address is your account. We also note when you first signed in and when you last used ShotDemo.
  • Your workspace. Its name and settings, your brand (logo, colours, your button), the people you invite and their roles. The members of a workspace see each other's names and email addresses.
  • Your demos. The screenshots and pictures you upload, what the Chrome extension recorded when you make a demo from a recording (see The Chrome extension), the website address you give us and the pages our server captures from it, a video you upload to make steps of (each screen of it is kept as a step's picture), the frames of a Figma file you import, the words you write or approve, voice recordings and music you upload, the spoken lines we make, every published version, and the files you export (videos, GIFs, pictures and offline copies). Your workspace's library lists the pictures, videos and sounds you uploaded or use in your demos.
  • A Figma import. When you make a demo from a Figma file, you paste a personal access token from your Figma account: our server uses it once, to read that file's frames and prototype links through Figma's API and have Figma draw the frames, and keeps it nowhere (not in our database, our logs or the import's record).
  • Payments. Razorpay, our payment gateway, takes the payment: we pass its checkout your name and email address, and it asks for your mobile number and card details under its own privacy policy. We read the payment back from Razorpay to confirm it, and keep its id, the amount, the currency, how you paid (by card, and whether the card was issued outside India) and whether it succeeded; Razorpay's record also shows us the mobile number you gave it, which we do not keep. We never see your full card details.
  • Usage counts. How many AI requests, website captures, spoken lines and free video exports your account used in the last day, so we can keep free use fair.
  • Your messages. The emails you send us, so we can answer them and see the history when you write again.
  • Visits to our website and app. Which pages are opened, through Google Analytics, and whether a visit that began with one of our ads led to a sign-up or a purchase, through Google Ads: without cookies unless you allow them (see Cookies).

If you view a demo

When someone opens a published demo, on its share page, in an embed on another website, in a popup or inside an app, ShotDemo counts what happens so the demo's maker can see how it is doing:

  • What we record: the steps reached, the time on each, the clicks on hotspots, buttons and the clickable parts of a screen (and, in a demo to explore freely, a click on something that leads nowhere, without where on the screen it was), whether the demo was finished, the page it was opened from, campaign tags in the address (such as utm_source), the country (from our network provider), and the kind of device, browser and operating system.
  • How we tell viewers apart: the player keeps a random id in the viewer's browser storage (sd_vid), so a returning viewer is not counted twice. It is not a cookie, it holds nothing about the person, and clearing the browser's site data removes it. When a demo is shown through an A/B test's link, which of the test's versions you were shown is kept there too (sd_ab_ and the test's id), so you see the same one if you come back.
  • What we do not record: we do not store the viewer's IP address with any of this, and we leave out visits from known robots.
  • Forms: if a demo asks viewers for details in a form, the answers (such as a work email, a name or a company) are stored for the demo's workspace, shown to its members with the viewer's journey through that workspace's demos, emailed to the workspace's admins if they ask for that, and sent to the tools they connect (see below).
  • Links made for one person: if a demo was sent to you with a personal link, its maker can see that you opened it and how far you went, and, when their workspace asks for it, the teammate who made the link gets an email when you open the demo and when you finish it (at most one of each every six hours). If the demo shows a viewer's logo, ShotDemo reads your company's logo from its public website (the one its maker gave, or your work email's domain) to show it there.
  • Questions to a demo's AI agent: if a demo lets you ask questions, what you type or say is sent, with the demo's own words, to the AI provider named below to be answered, and your questions and the answers are kept for the demo's maker with the random viewer id, not your name (unless you also gave it in a form). A question said aloud is recorded only while the microphone button is on (20 seconds at most), sent to Microsoft Azure AI Speech to be turned into text, then thrown away: we keep its words, never the recording. When you ask aloud, or turn on reading answers aloud, Azure AI Speech also reads the answer to you; that sound is made once for you and not kept.

For these viewing records and form answers, the demo's maker decides what is collected and what it is used for; we keep and process them on their behalf. If you viewed a demo and want your details removed, ask its maker, or write to us and we will pass your request on and help them act on it.

A maker who puts a demo on their own website with ShotDemo's script may ask it to pass the demo's events (opened, steps, finished, a click on a call to action, a form sent, never what you typed) to the analytics tools of that website, such as Google Tag Manager, Google Analytics, Segment, Mixpanel, Amplitude, PostHog or Heap, under that website's own privacy policy.

A maker who has bought a demo may add their own Google Analytics to it. The player then sends that demo's events (opened, steps, finished, a click on a link, a form sent) to the maker's Google Analytics, in Google's consent mode with storage denied, so it sets no cookies on the viewer's browser. A maker may also connect webhooks, Slack, HubSpot or Salesforce, which then receive the form answers and, for viewers they already know from a personal link or a form, that the demo was opened or finished.

Why we use it

To sign you in, to make, store, show and deliver your demos and their files, to count what viewers do for the demo's maker, to take and verify payments, to answer you when you write to us, now and then to write to you ourselves about your account and your demos, such as asking how ShotDemo is working for you (a note from a person, never a mailing list: reply and say so, and we stop), and to keep the service safe from abuse. We do not sell anyone's data, and we do not use your screenshots, your words or your viewers' details to advertise to anyone.

Who helps us run ShotDemo

  • Google Firebase Authentication, for signing in with Google or Microsoft (Microsoft tells Firebase who you are when you choose it).
  • Anthropic (Claude) or Google (Gemini), which read your screenshots and words when you ask the AI to write, review or translate a demo's text or to find what to blur (a translation includes the words on its HTML pages); read the words and numbers of a captured page when you ask the AI to change its data; read what Ask the AI looks up for you, which is always the list of your workspace's demos (their titles, tags and whether they are live) and, when your question needs it, a demo's words, its numbers or your form answers; answer the questions viewers ask a demo's AI agent from that demo's words; and, when you ask, read one viewer's questions to that agent and its answers to write you a short note on them.
  • Microsoft Azure AI Speech, which turns written lines into spoken ones, reads a demo's AI agent's answers aloud, and turns a question said aloud to that agent into text.
  • Razorpay (India), which runs the checkout and takes card payments.
  • Oracle Cloud (servers in India), where workspaces, demos, viewing records, form answers and messages are stored, exports are made, and our emails are sent from.
  • Google Analytics and Google Ads, which count visits to this website and the app and, unless you decline, tell us whether a visit that began with one of our ads led to a sign-up or a purchase (see Cookies).
  • Figma, which our server asks for a file's frames and draws them, with the token you paste, when you import a Figma prototype.
  • Cloudflare, which delivers this website and the app, keeps copies of demo pictures at its network's edge so demos load fast, tells us a viewer's country, and receives the emails you send us.

Each of them handles the data under their own privacy terms and only to provide their service to us.

Website capture

When you give us a website address, our server opens the public pages of that site and takes screenshots, the way a visitor's browser would, on the screen you pick (a desktop, a laptop, a tablet or a phone). It also keeps each page's HTML, with the styles, pictures and fonts the page loaded but never its scripts, so your viewers see the page sharp and you can change its words; a page whose HTML does not come out like its screenshot is kept as the screenshot only. A link in a kept page keeps only a fingerprint of the address it leads to, so a demo can take a viewer from that link to the step showing that page. Only give us sites you are allowed to show in a demo.

The Chrome extension

The ShotDemo extension for Chrome (and Edge) records a demo when you ask it to, and only then.

  • What it reads, and when. Only while a recording runs, and only in the tab you started it in, including the other pages of the same website you open in that tab: a picture of what the tab shows, where you click, the name of what you clicked (a button's text or a field's label), what you type into fields, and each page's address and title. It never records what you type into a password, card number or one-time code field: dots stand in for it. Before you start, while paused and after you finish, it reads nothing.
  • Pages as HTML. With "Keep each page as HTML" on (it is unless you turn it off), it also writes out the page as HTML at each click, so your viewers see it sharp and you can change its words later. That HTML holds no more than your screen showed: never a hidden field or what was typed into a password, card number or one-time code field; email addresses only as blurred shapes; text that is off the screen or hidden only as its shape, without its letters; a link only as a fingerprint of the address it leads to (so a viewer who clicks it in your demo goes to that page's step), never the address. It also reads the stylesheets, pictures and fonts that page uses, from the same tab. When you finish, ShotDemo keeps each page beside its picture, and its server downloads from their public addresses the files of another website that the page loaded but the extension could not read.
  • Where it keeps it. In your browser, in the extension's own storage, until you finish. Then it opens ShotDemo, which brings the recording into your account to make the demo, and the extension deletes its copy. A recording you never finish is deleted after three days, and you can discard one at any time.
  • Blurring. Unless you turn it off, it marks the password fields, card number fields and email addresses it sees on the screen, and the demo's editor blurs them. Your workspace keeps the original pictures; people who view the demo only ever get the blurred ones.
  • What it never does. It does not read other tabs or websites, never records unless you started a recording, does not track what you browse, and sends nothing anywhere except to your own ShotDemo account when you finish.
  • Its permissions. "activeTab", to see the tab you record, which Chrome grants only when you click the extension's button or press its shortcut; "scripting", to notice your clicks and typing in that tab; "storage" and "unlimited storage", to keep the recording's pictures and pages in your browser until you finish; and access to app.shotdemo.com, to hand the recording to ShotDemo.

What the extension collects is used only to make your demo, never sold, never used for advertising, and handled according to the Chrome Web Store User Data Policy, including its Limited Use requirements.

Cookies

We set a cookie to keep you signed in and, if you pick a light or dark theme, one that remembers it. Neither is used to follow you. The demo player sets no cookies; for a demo with a password, it keeps a proof that the password was given in the browser tab's session storage for a day, so a reload does not ask again.

When you press Buy, Razorpay's checkout opens over the page, and it keeps its own cookie (rzp_unified_session_id) and a few identifiers in your browser's storage for app.shotdemo.com (rzp_device_id, rzp_checkout_anon_id, rzp_stored_checkout_id and __rzp_risk). The fraud checks it runs set cookies of their own (when we looked: Sardine's, and a check served from Stripe). They are there to take your payment and keep it safe, under Razorpay's privacy policy, so the cookie banner does not switch them off; none is set before you press Buy.

Google Analytics measures visits to this website and the app, and Google Ads tells us whether a visit that began with one of our ads led to a sign-up or a purchase. Both run in Google's consent mode, and the first time you visit, a banner asks whether they may set cookies:

  • Until you answer: neither sets cookies or keeps an identifier. Google Analytics receives only cookieless signals that a page was opened or a step was taken, which Google turns into aggregate counts. Google Ads also receives cookieless signals: that a page was opened, and when you sign in for the first time or buy a demo (the payment's id and amount, not who paid). If you came from one of our ads, the ad's click code stays in the page's address as you move between our pages and into the app and goes with these signals, so Google Ads can tell that the ad led to your sign-up or purchase; it is not stored.
  • If you decline: the same, except that Google Ads is no longer told when you sign in for the first time or buy a demo, and our pages stop carrying the ad's click code.
  • If you allow: Google Analytics also sets its own cookies, _ga and one starting with _ga_, kept for up to two years, so it can tell a returning visitor from a new one. Google Ads may set _gcl_au and _gcl_aw, kept for 90 days, which connect a sign-up or a purchase to the ad you clicked, and it is told when you sign in for the first time and when you buy a demo (the payment's id and amount, not who paid).

Either way, Google Analytics tells us how many people visit, which pages they open, where they came from, their kind of device and browser, and their rough location, and in the app which steps people take, such as signing in, starting and publishing a demo, opening the checkout and paying (the payment's id and amount, not who paid). Neither receives your screenshots, your demos, your viewers' details, your email address or your payment details. Ad personalisation and Google signals are switched off: your visits are never used to choose the ads you see or to build advertising audiences.

Your answer is kept for six months in a cookie named shotdemo_consent, shared by this website and the app. To change it, choose Cookie settings at the bottom of any page of this website; declining there also deletes the Google Analytics and Google Ads cookies.

How long we keep it

A demo stays until you delete it. A deleted demo waits seven days in its workspace's archive, then is removed for good with its versions, viewing records, personal links, the questions asked of its AI agent and exported files; form answers stay with the workspace, as its contacts, until it deletes them. Each demo keeps its last fifty published versions and its last ten exported files. Payment records are kept as long as tax and accounting law requires. Google Analytics keeps its detailed visit data for at most 14 months. We also back up ShotDemo's data every night and keep each backup for four days, so anything removed for good, such as a deleted demo or account, is gone from the backups within four days.

On 12 October 2026 ShotDemo changed from a video maker to a demo platform, and the video projects made before then were removed from the app. A copy is kept on our server, unused, until we delete it; to have yours deleted now, write to email@shotdemo.com.

Your choices

You can ask us for a copy of your data, to correct it, or to delete your account and everything in it, by writing to email@shotdemo.com from the email address you sign in with. We reply within 7 days.

Grievance officer

Narendra K Ram, Tirunelveli, Tamil Nadu, India, email@shotdemo.com, +91-7094-043-043. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Changes

If we change how we use your data, we will update this page and the date above before the change takes effect.