Legal menu
Privacy policy
What personal data Chartshot collects, why, where it's kept and for how long, and your rights.
Last updated 25 Oct 2026
Who we are
Chartshot ("we") decides how the personal data in this policy is used, which makes us the controller under UK and EU data protection law. For any question or request about your data, email support@chartshot.dev.
The data inside the charts you send is different. We process it on your behalf, and the data processing agreement covers it.
The short version
- We keep what we need to run your account and your plan: your email address, your name, your keys and your usage.
- We don't log chart data. The API's request logs hold the route, status, timings, the spec's size and hash, and which key was used.
- The website has no analytics or advertising cookies. Its analytics count visitors without cookies.
- Your account and stored charts are kept in the UK and the EU.
- We don't sell personal data or use it for advertising.
What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Your account: email address, name, and your profile picture if you sign in with GitHub or Google | To sign you in and to email you about your account, such as usage warnings | Our contract with you |
| Sign-in: sign-in links (valid for 15 minutes), sessions with the IP address and browser they started from, and the account id and tokens GitHub or Google give us to confirm who you are | To keep you signed in and to spot sessions that aren't yours | Our contract with you, and our legitimate interest in keeping accounts secure |
| API keys: each key's name, a hash of the secret, its last four characters, an encrypted signing key and when it was last used | To check requests and show you which key is which | Our contract with you |
| Usage: how many charts each key drew each day, and which usage emails we sent | To apply your plan's limits and show your usage | Our contract with you |
| Saved themes and stored charts, with their specs | To draw and serve them | Our contract with you |
| Billing: your Stripe customer and subscription ids, plan, status and renewal date | To give you the plan you pay for | Our contract with you |
| Emails you send us | To answer them | Our legitimate interest in helping you |
| Website visits: pages viewed, the referring site, browser, device type, country, and actions such as opening a template or copying a chart | To see which pages and features people use | Our legitimate interest in improving the site |
| Error reports: the error, the page or API route, and the browser | To find and fix bugs | Our legitimate interest in a working service |
We never see your card details or billing address. You enter them on Stripe's checkout page and they go to Link, which sells our paid plans (see Payments).
The API reads your IP address to apply rate limits, such as 60 charts a minute for chart URLs without a key. It keeps the count in memory for a minute and never writes the address down.
Charts and chart URLs
The API draws a chart from its spec and then forgets the spec. It keeps recently drawn images in memory for a short time so repeats load fast. The exceptions:
- Stored charts. When you store a chart, we keep its spec and image until it expires (90 days on Pro, 365 on Team and 365 on Business) or until you delete it.
- Cached images. Cloudflare caches chart images so they load fast: images from chart URLs without a key for 1 hour, signed URLs until they expire or for a year at most.
- Chart URLs. A chart URL carries its spec, so anyone who has the URL can read the data in it. Send spec data in a URL only to people who may see it.
Cookies and browser storage
The website sets these, all needed for what you asked it to do:
- A session cookie when you sign in, so you stay signed in.
- A cookie that only says you're signed in, holding no account details, so the site's pages can show a link to your dashboard. It lasts 7 days and signing out removes it.
- Short-lived cookies while you sign in with GitHub or Google, to finish the sign-in.
- Your light or dark choice in your browser's local storage, if you pick one.
There are no analytics or advertising cookies, so the site doesn't ask for cookie consent. PostHog counts visitors with a code made from your IP address, browser and the day, worked out on PostHog's servers, and then drops the IP address. The code changes every day, so PostHog can't follow you from one day to the next.
Stripe's checkout page sets its own cookies, under Stripe's privacy policy.
Who we share it with
The companies that run parts of Chartshot for us are on the subprocessors page. Each may use your data only to provide its service to us.
Some companies use your data under their own privacy policies:
- Link and Stripe, when you pay for a plan (see Payments). We give Stripe your name and email address to set up your customer record.
- GitHub and Google, when you sign in with them. They tell us your name, email address and profile picture.
We share data with authorities only when the law requires it. If Chartshot is sold or merged, your data moves with it, and we'll tell you before it does.
Payments
Paid plans are sold through Link, Stripe's merchant of record. Link takes the payment, works out and pays sales tax and VAT, sends your receipts and invoices, and handles questions about payments and refunds. Link and Stripe use your payment details under Stripe's privacy policy. We see your plan, its status and what you paid.
Where it's kept
- The API runs in London (Fly.io).
- The database is in Frankfurt (Neon on AWS).
- Stored chart images are in Cloudflare R2 in Western Europe.
- The website's server code runs in Frankfurt (Vercel).
- Emails go out through Resend in Ireland.
- Website analytics are in PostHog's EU cloud, in Frankfurt.
- Error reports are in Sentry's EU region, in Frankfurt.
Cloudflare and Vercel serve pages and images from the location nearest each visitor, which can be outside the UK and EU. Several of these companies are based in the US. Where data leaves the UK or EU, the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework and its UK extension) or by standard contractual clauses with the UK addendum. Email us for a copy of the clauses.
How long we keep it
- Your account, while it's open. When you close it, we delete it within 30 days, and copies in backups expire within 5 weeks after that.
- Sessions end 7 days after you last use the site, and sign-in links after 15 minutes.
- Stored charts until they expire or you delete them.
- API request logs for 7 days. They hold no chart data and no IP addresses.
- Website analytics for a year.
- Error reports for 90 days.
- Emails you send us for up to 2 years after we last write to each other.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to limit or stop how we use it, or to send it to you in a format a machine can read. Email support@chartshot.dev from your account's address and we'll reply within a month.
We make no automated decisions about you.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the UK's Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.
Children
Chartshot is for businesses and developers. It isn't meant for anyone under 16, and we don't knowingly collect their data.
Changes to this policy
When we change this policy, we update it here with a new date. If a change affects how we use your data, we email account holders 30 days before it takes effect.