Privacy Policy

Version 2026-10-14.1. Last updated 14 October 2026.

In short.

Failshot's photos stay on your phone or Mac unless you turn on email alerts or the web vault.
Email alerts pass through our service to your inbox. We don't store them. Our email provider keeps sent emails for 30 days.
Web vault photos are encrypted on your device before they leave it. We store only encrypted data that we can't read, and it's deleted after 30 days unless you choose 7 or 90.
Failshot doesn't recognise faces or create biometric data. It doesn't collect your location or record sound. There's no advertising and no tracking. We don't sell personal data, share it for advertising, or use it to train AI.
You can delete your account and your vault at any time.

1. Who we are

"We" and "us" mean the UK company that provides Failshot. We're the controller of the personal data described in this policy, except where we say that an organisation, or the owner of a device, decides how it's used.

To contact us about privacy, email privacy@failshot.app. We haven't appointed a data protection officer, because the law doesn't require us to, but this address reaches the people responsible for privacy at Failshot.

This policy covers the Failshot apps for iPhone, Android and Mac, our website at failshot.app, email alerts, the web vault and Failshot for organisations. Our Terms of Use explain the rules for using Failshot.

2. Where Failshot keeps photos

While Failshot is on, it photographs whoever unlocks the phone or Mac it's on, anyone who enters a wrong PIN, pattern or password at an Android phone's lock screen, and anyone who gets the Failshot PIN wrong. Each time, it takes a photo, and if that photo isn't clear, it tries again at random moments for a few seconds and keeps one. Where those photos go depends on the features the device's owner chooses:

On the device. This is the default. We never receive these photos. They're kept out of backups: iCloud and computer backups on iPhone, Time Machine on a Mac, and backups and device transfers on Android. On iPhone they also have the strongest file protection iOS offers.
Email alerts (off until the owner turns them on). Photos pass through our service to the owner's own email address. We don't store them. Our email provider keeps sent emails for 30 days.
The web vault (off until the owner sets it up). Photos are encrypted on the device before upload. We store only encrypted data that we can't read, and it's deleted automatically after 30 days, or 7 or 90 if the owner chooses.
Failshot for organisations (only on devices an organisation owns or issues, after the device's user joins). Photos are also encrypted for the organisation's security team.

Dark photos. On every device, Failshot checks on the device how bright each photo is. If a photo isn't clear, it tries again at random moments for a few seconds and keeps the first clear one; if none is clear, it keeps the brightest as a record. This check measures only overall brightness. It doesn't look for, detect or recognise faces. If it's dark, the screen may light up to light the face (on Android, only while Failshot is on screen).

3. What stays on your device

We never receive the following. It stays on your phone or Mac, under your control, until you delete it or delete the app:

photos, and the history of unlocks and wrong attempts, unless you turn on email alerts or the web vault;
your Failshot PIN and your Lockdown answer, which are stored only as protected hashes in your device's secure storage, and your Lockdown question;
your record of which version of our terms you accepted, and when;
your account token, if you sign in (section 4 explains what's in it); and
the status shown in widgets and on the Lock Screen, which is counts and times, never photos.

Face ID, Touch ID and fingerprints. Your device's operating system does these checks. Failshot receives only whether the check passed. So that Failshot can ask for your PIN instead when a face or fingerprint is added, it also uses an anonymous value from the system on iPhone and Mac, and on Android a key in Android's secure Keystore that Android cancels when a new fingerprint or face is added. Failshot never receives or stores any face or fingerprint data.

Notifications. The notifications Failshot shows are created on your device, including reminders such as "Your phone isn't protected" and, on iPhone, the Lock Screen notice. No data leaves your device for them. We don't use push notification services or receive notification tokens.

Permissions. Failshot asks for the camera and for notifications, and on iPhone to use Face ID. On Android it also asks for device admin permission, which it uses only to be told about wrong PIN, pattern or password attempts, and about the unlock that follows one. On a Mac you can choose to open Failshot at login, and macOS lists it in Login Items. You can withdraw any of these in your device's settings, though Failshot won't fully work without them.

4. What we process, why, and for how long

This table covers everything we handle on our servers or send on your behalf. The lawful bases are those of the UK GDPR and the EU GDPR.

Information	Why we use it	Lawful basis	How long we keep it
Account details, if you sign in: your email address, how you signed in (Apple, Google or an email link), the account identifier Apple or Google gives us, an Apple token we need to remove our access when you delete your account, the version of our terms you accepted and when, and when you signed in.	To create your account, send alerts to the right address, and keep a record of what you agreed to.	Contract. For the record of what you agreed, our legitimate interest in being able to show it.	For email alerts we don't keep these on our servers. They're sealed (encrypted) into a token kept on your device, which our service reads each time you use it. The token expires after about 13 months, or when you sign out or delete your account. For the web vault, see below.
Sign-in and confirmation emails: your email address, a sign-in link, and a record of the terms you accepted.	To check the address is yours, sign you in, and give you a copy of what you agreed to.	Contract. Legitimate interests (keeping a record of agreement).	Our email provider keeps sent emails for 30 days. Your copy stays in your inbox.
Email alerts, if you turn them on: up to four photos, or none if no usable photo could be taken; the time of the unlock or attempt; your device's time zone setting; the number of wrong Failshot PINs or the type of event; if a photo is dark or missing, a note saying why (for example, that camera access was switched off, the camera couldn't be used, or the camera may have been covered); and your email address. We also email you if Failshot's camera access is switched off while it's on.	To email the alert to you.	For you: contract. For the person photographed: legitimate interests (section 5).	Our service handles alerts in memory and doesn't store them. Our email provider keeps sent emails, including the photos, for 30 days. Your copy stays in your inbox until you delete it.
Web vault account, if you set one up: your email address; a random account identifier; what we need to check your password without ever receiving it (a salt, and a keyed hash of a value your browser works out from your password); your vault's public key and encrypted copies of its private key; a keyed hash of your recovery key; your passkeys' public keys, names and dates; your authenticator app secret; hashed recovery codes; your retention setting; the organisations you've joined and your device name; failed sign-in counts and lock-outs; and when you last signed out everywhere.	To run your vault and keep it secure.	Contract. For failed sign-in counts and lock-outs, our legitimate interest in keeping accounts secure.	Until you delete your vault or your account, even if your Failshot Pro subscription ends. Stored encrypted.
Web vault photos: photos and their details (time, type of event, wrong PIN count, device type and time zone), all encrypted on your device. We can see only each file's size, when it was uploaded, its random identifiers, which keys can open it, and when it expires.	To keep photos for you to see in a browser.	Contract. For the person photographed: legitimate interests (section 5).	30 days after upload, unless you choose 7 or 90. Deleted sooner if you delete them, delete your vault or account, or confirm the unlock was yours. If your Failshot Pro subscription ends, nothing more is uploaded, but photos already in your vault stay until they expire, and you can still see and delete them.
Organisation records, if you run or join an organisation: the organisation's name, its public key and encrypted copies of its private key for each admin, admins' and members' account identifiers, email addresses, roles and device names, the dates they joined, invite codes (stored only as keyed hashes) with their expiry dates and use counts, and links to shared photos.	To provide Failshot for organisations.	We process this on the organisation's behalf, and it decides the lawful basis (section 6). For admins' own accounts: contract.	Until the organisation removes it or is deleted, and in any case within 30 days after its agreement with us ends. Invite codes until they expire or are revoked.
Security and service emails: emails about important changes to your vault's security, such as when it's set up, when your password, passkeys, authenticator or recovery details change, when your recovery key or a recovery code is used, when sign-in is locked, and when your vault is reset or deleted, and reset links. Admins also get an email when a new photo is shared with their organisation, without the photo, at most once an hour.	To keep accounts secure, and tell admins about new alerts.	Contract. Legitimate interests (security).	Our email provider keeps sent emails for 30 days.
One cookie and one setup item, in the web vault only. The cookie keeps you signed in. While you set up your vault, the one-time setup link from the app is kept in your browser's session storage for that tab, so a page reload doesn't lose it.	To keep you signed in securely, and to let you finish setting up.	Strictly necessary for the service you asked for. Contract.	The cookie: up to 12 hours, or until you sign out. The setup link: until you finish setting up or close the tab. Our website and vault use no other cookies or similar technologies.
Technical data: IP address, time, the address requested, the result, and browser or app details, in our hosting provider's logs. Our own logs record only error codes, never photos or email addresses. We also count requests from each IP address and email address, in memory, to stop abuse.	To run and secure our service and prevent abuse, such as someone flooding a stranger's inbox with sign-in emails.	Legitimate interests (keeping our network and systems secure).	Hosting logs: a short period, never more than 30 days. Abuse counts: held briefly in memory and never written to storage.
Business enquiries from our website: name, work email, organisation, sector, number of devices and your message, and our team's notes on your enquiry and whether we've replied.	To reply, to keep track of enquiries, and to discuss a possible agreement.	Legitimate interests (responding to business enquiries and keeping track of them). Steps before a contract, where that applies.	We store each enquiry, encrypted, in our London storage so our team can keep track of it, and we email it to our team. Our email provider keeps a copy of that email for 30 days. We delete the stored enquiry 2 years after we last update it, and the emails about it within 2 years of our last contact. If it leads to an agreement, we keep what we need with that agreement's records instead.
Device sync, if you're signed in to Failshot on more than one iPhone or Mac: each device's push notification token, whether it's an iPhone or a Mac, the name the app gives it (such as your Mac's name), and when it last checked in. When one of your devices records an unlock, a wrong attempt or its camera access being switched off, a notice with that device's name, the type of event and the time.	To tell your other devices straight away.	Contract.	Each device's entry is kept, encrypted, until you sign out on that device or delete your account, or Apple tells us its token no longer works. We don't store the notices: Apple delivers them, and holds one for up to an hour if a device is offline. They never include a photo.
Subscriptions paid on our website, if you subscribe in a Mac or Windows app downloaded from failshot.app: your email address, your billing address and country, the plan, whether it is active and when it renews or ends. Stripe takes your card details; we never see your full card number. Your Failshot account is linked to the subscription by a code made from your email address, so the details we keep in our own records carry no email.	To take payment, give you Failshot Pro on every device you sign in to, and keep records the law requires.	Contract, and legal obligation for tax records.	Our record of whether you have Pro is kept, encrypted, while you have an account. Stripe keeps payment records for as long as tax and financial rules require, usually six years.
Early access list, if you join it on our website: your email address, whether you chose iPhone or Android, that you signed up on our website and confirmed by double opt-in, and when you confirmed or last changed your choice.	To send you a link to confirm, and to email you when Failshot is ready to download.	Consent. You give it by asking on our website and then confirming from the link we email you (double opt-in). You can withdraw it at any time by leaving the list.	Nothing is stored until you confirm. Until then your address is only in the confirmation email and, encrypted, in its link, which works for 7 days. Once you confirm, we keep your entry, encrypted, in our London storage until 6 months after Failshot is available for the phone you chose, or until you leave the list, whichever is sooner. You can leave from the link we show when you confirm or from our emails to the list, or by emailing privacy@failshot.app. Our email provider keeps sent emails for 30 days.
Messages you send us, including help requests, privacy requests and complaints: your email address, what you tell us, and our reply.	To help you, and to answer requests and complaints.	Legitimate interests (helping you). Legal obligation, for data protection requests and complaints.	Up to 2 years after we close your request, or longer if we need it for a legal claim.
Purchases: Apple or Google take your payment. They give us sales reports and, for some purchases, order details such as the order number, product, date, price and country. The app checks your subscription with Apple or Google on your device.	To provide Failshot Pro, help with refunds, and keep our accounts.	Contract. Legal obligation (accounting and tax records).	6 years, as accounting records. We never receive your card details.

You don't have to give us any personal data to use Failshot's features that work on your device alone. To use email alerts, the web vault or Failshot for organisations, you need to give us an email address. Without one, those features can't work.

We rely on consent only for our early access list. You can withdraw it at any time by leaving the list, and that doesn't affect anything we did before. Where we rely on legitimate interests, we've weighed our interests, and yours, and you can ask us for details of that assessment.

5. If Failshot photographed you

This section is for people who have been photographed by a Failshot user.

How it happens. Someone turned Failshot on, on their phone or Mac. While it was on, it took your photo because you did one of these:

unlocked the phone or Mac;
entered a wrong PIN, pattern or password at an Android phone's lock screen; or
entered a wrong Failshot PIN or answer, or used a face or fingerprint that Failshot didn't accept.

How Failshot shows it's on. Failshot never photographs in secret:

On iPhone, a notice on the Lock Screen says Failshot is on, unless the owner has switched it off. On a phone that shares photos with an organisation, it can't be switched off. Either way, Failshot only takes photos on its own screen, which says the phone is guarded, after someone unlocks the phone into it, and iPhone shows its camera indicator while the camera is in use.
On Android, a notification shows whenever Failshot is on, because Android requires it while Failshot can use the camera, and Failshot doesn't take photos without it. By default it also shows on the lock screen. The owner can make it silent and hide it from the lock screen, unless the phone shares photos with an organisation.
On a Mac, the menu bar shows whether Failshot is on, and the camera light comes on whenever it takes a photo.

What's recorded. A photo from the front camera, or a Mac's built-in camera (and one more for each wrong Failshot PIN), which show your face and what's behind you, with the time and the type of event. Failshot doesn't record your name, your location or sound, and it doesn't detect, recognise or identify faces.

Where the photos go, and who's responsible.

On the owner's device. The owner decides what to do with them. We never receive them. If the owner is using Failshot for purely personal reasons, data protection law may not apply to them. If they're using it for work, they may be the controller.
In an email alert. If the owner has turned on alerts, we pass the photos to the owner's own email address. We're the controller for that step. We don't store the photos, but our email provider keeps sent emails for 30 days.
In the owner's web vault. If the owner uses the vault, we store the photos for them in encrypted form for up to 90 days. We're the controller for storing them, but we can't see them.
On an organisation's device. If the device belongs to an organisation that uses Failshot for organisations, the organisation is the controller and we act on its instructions. Contact the organisation (section 6).

Our lawful basis. For our part, we rely on legitimate interests: helping people protect their own phones and computers, and find out who has got into them, or tried to, without permission. We've weighed this against your interests and rights:

Failshot works only on the owner's own device, or one an organisation has issued, and only photographs at the moment someone gets in or tries to.
It never photographs in secret, as described above. On a Mac, or on an iPhone whose owner has switched off the Lock Screen notice, you may not know Failshot is on until you've unlocked the device. You'll see it straight afterwards: Failshot's screen on iPhone, and the camera light on a Mac.
It doesn't recognise faces, and it keeps one photo for each unlock or attempt, not a series.
Email alerts and the vault are off unless the owner turns them on. We don't store alert photos ourselves, and our email provider deletes its copies after 30 days. Vault photos are encrypted and deleted after 90 days at most.

On that basis, we believe your interests and rights don't override ours. You can still object (section 11).

Why we can't tell you directly. We don't know who you are and have no way to contact you. Instead, Failshot shows that it's on, as described above, and this policy is public.

Your rights. You have the rights in section 11, including to object and to ask for deletion. In practice:

If you know whose device it was, the quickest route is to ask them to delete the photo. Our Terms of Use require Failshot users to delete photos of people who haven't misused their device.
We can't see photos on a device or in a vault, and they aren't labelled with names, so we usually can't find photos of a particular person. If you contact us, we'll explain what we hold. If you can help us identify the account involved, we'll act on your request as far as we can, which may include passing it to the owner.
If you think Failshot is being used to watch you, see "Reporting misuse" in our Terms of Use, and contact the police if you feel unsafe.

6. Devices that belong to an organisation

An organisation, such as an employer, can use Failshot for organisations on devices it owns or issues. If you use such a device and have joined the organisation's Failshot organisation with an invite code:

photos taken by Failshot on that device are also encrypted for the organisation, and its security team can see them;
the organisation's admins get an email, without the photo, when a new photo is shared; and
the app shows that photos are shared with the organisation, and on iPhone the Lock Screen notice can't be switched off.

The organisation decides how these photos and its member records are used, and is the controller. We process them only on its instructions, as its processor. Its own privacy notice should explain how it uses them and its lawful basis. To use your rights over this data, contact the organisation. We'll help it respond.

Your own Failshot account, your sign-in and any personal vault remain covered by the rest of this policy.

Cookies on our website

Our website's public pages (not the web vault, your account pages or the apps) can use Google Analytics and Google Ads cookies, only if you choose Accept in the cookie message. They tell us which of our ads and pages bring people to Failshot and whether a visit led to a download or a purchase. Google receives your IP address, browser details and the pages you visit, and acts as a separate controller for its own purposes under its privacy policy. We don't let Google use this for ad personalisation. If you choose Decline, or make no choice, no Google cookie or tag loads. To change your choice, clear this site's data in your browser and the message appears again. Nothing in the Failshot apps or your vault is tracked this way.

Service providers. These companies process personal data for us, only on our instructions, under contracts that require them to protect it to at least the standard this policy describes:

Vercel Inc. (United States) hosts our website and service, and stores the encrypted vault data in London.
Apple Inc. (United States) delivers notices between your own iPhone and Mac through its push notification service, if you're signed in on more than one.
Stripe Payments UK Ltd (United Kingdom, part of Stripe, Inc. in the United States) takes card payments for subscriptions bought on our website.
Plus Five Five, Inc., trading as Resend (United States) sends our emails, including email alerts. It keeps sent emails for 30 days.
Our business email provider holds the messages you send us.

Others, because of features you use. These receive data as separate controllers, under their own privacy policies:

Apple and Google, when you sign in with them, buy Failshot Pro through their stores, or save a passkey or password with their password managers;
your email provider, which receives the emails we send you; and
an organisation you join (section 6).

When the law requires it, or to protect people. We may disclose information if the law requires it, for example under a court order, or where it's necessary to protect someone's life or safety or to report a crime, as the law allows. We check that requests are lawful and disclose only what's needed. We can't decrypt vault photos. Unless the law forbids it, we'll tell you about a request for your information.

If our business changes hands. If Failshot is sold or merged, personal data may pass to the new owner, who must protect it as this policy describes. We'll tell you before that happens.

We don't sell personal data, share it for advertising, or use advertising or analytics software. We don't use personal data or photos to train artificial intelligence.

8. Transfers outside the UK

We're based in the UK, and our vault storage and servers are in London. Vercel, Resend, Stripe and Apple (for notices between your devices) are US companies, or part of US groups, so some personal data, such as emails, request logs and support access, may be processed in the United States.

When personal data goes from the UK to the US, we rely on the UK Extension to the EU-US Data Privacy Framework for providers certified to it. Otherwise, our contracts with them include the European Commission's standard contractual clauses with the UK's International Data Transfer Addendum. If you're in the EU, your data comes to the UK under the European Commission's adequacy decision for the UK. It goes on to the US under the EU-US Data Privacy Framework or the standard contractual clauses. Email us for a copy of these safeguards.

9. How we protect personal data

On your device, photos and records stay in Failshot's own storage and out of backups, and on iPhone they have the strongest file protection iOS offers. Your Failshot PIN is stored only as a slow, salted hash.
Every connection to our service uses HTTPS, with strict security settings on our website.
Vault photos are end-to-end encrypted: they're encrypted on your device, and only your vault key (and the key of any organisation you've joined) can open them. Your vault password never reaches us.
The web vault needs a second step to sign in, such as a passkey or an authenticator code, and locks after repeated wrong attempts.
Account and organisation records are encrypted at rest. Invite codes and recovery codes are stored only as keyed hashes.
We keep as little as we can, for as short a time as we can.

No system is perfectly secure. The vault runs in your web browser, so its security also depends on your device, your browser and your passwords. Keep your devices and browser up to date.

If a security breach affects personal data, we'll tell the regulator within 72 hours where the law requires, and we'll tell you without undue delay if it's likely to put your rights at high risk.

10. Faces, biometrics and health data

Failshot takes ordinary photographs. It doesn't detect, measure, analyse, compare or recognise faces, and it doesn't create face geometry, face templates, faceprints, or any other biometric identifier or biometric information. We don't extract anything from photos. Face ID, Touch ID and fingerprint checks happen entirely in your device's operating system (section 3).

So Failshot doesn't collect, capture, store or use biometric identifiers or biometric information under the Illinois Biometric Information Privacy Act, Texas's law on the capture or use of biometric identifiers, Washington's biometric identifiers law, or similar laws. It doesn't collect consumer health data under Washington's My Health My Data Act, Nevada's consumer health data law, or similar laws.

Our Terms of Use forbid Failshot users from running Failshot photos through face recognition.

11. Your rights

Under UK and EU data protection law, you can ask us to:

give you a copy of your personal data (access);
correct it if it's wrong;
delete it;
restrict how we use it;
stop using it, where we rely on legitimate interests (objection); and
give it to you, or to another organisation, in a portable form, where we use it under a contract with you.

How. Much of this is in your hands already. You can delete photos in the app and in the vault, delete your vault, leave an organisation, and delete your account (Account, then Delete account, or see failshot.app/delete-account). For anything else, email privacy@failshot.app. It's free.

When. We'll reply within one month. If your request is complex, or you've made several, we may need up to two more months, and we'll tell you within the first month. If we need information to confirm who you are, or to understand your request, the time starts when we receive it. We'll make reasonable and proportionate searches.

What we can't do. We can't see photos on your device or open your vault, and we hold very little else. For data an organisation controls, contact the organisation (section 6).

Complaints. You can complain to us at privacy@failshot.app. We'll acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome. You can also complain to the UK's data protection regulator, the Information Commission (ICO), at ico.org.uk, or, if you're in the EU, to the data protection authority where you live or work. You can find yours at edpb.europa.eu.

12. No automated decisions or profiling

We don't make decisions about anyone based solely on automated processing that have legal or similarly significant effects, and we don't build profiles of people.

13. Children

Failshot is for adults. You must be 18 or over to use it, and it isn't directed at children. We don't knowingly collect personal data from anyone under 18, including children under 13. If we learn that we have, we'll delete it. If you think we hold a child's personal data, email privacy@failshot.app.

A child who picks up a Failshot user's phone, or uses their Mac, may be photographed. Our Terms of Use require users to delete photos of anyone who hasn't misused their device.

14. Your rights in the United States

This section is for residents of US states with consumer privacy laws: California, Virginia, Colorado, Connecticut, Utah, Texas, Florida, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, and Oklahoma, Louisiana, Alabama and Vermont when their laws take effect. Some of these laws may not apply to us because of our size, but we give the rights in this section to everyone in the United States.

What we collect (notice at collection). In the last 12 months we've collected these categories of personal information, for the purposes, and for the periods, in section 4:

Identifiers, such as your email address, account identifiers and IP address.
Commercial information, such as your subscription and purchase records.
Internet or other electronic network activity, such as request logs.
Audio, electronic, visual or similar information: photos in email alerts, and encrypted photos in the web vault.
Professional or employment-related information, for organisation members: the organisation you've joined and your device name.
Sensitive personal information: your account login with the information needed to check your vault password. We use it only to sign you in and keep your account secure.

We collect this from you, from your device, from Apple or Google when you sign in or buy, and from organisations you join. We use it to provide Failshot, keep it secure, and meet our legal obligations. We disclose it to our service providers for those business purposes, and to the others listed in section 7.

No sale, no sharing, no targeted advertising. We don't sell personal information, share it for cross-context behavioural advertising, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, and we haven't in the last 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. We use sensitive personal information only for purposes the law allows without giving you a right to limit it.

Your rights. You can ask us to:

tell you what personal information we collect, use and disclose, and give you a copy of it in a portable form;
delete it;
correct it;
give you a list of the specific third parties we've disclosed your personal information to; and
opt out of sale, sharing, targeted advertising and profiling. We don't do any of these, so there's nothing to opt out of, but we treat a Global Privacy Control signal from your browser as an opt-out request.

We won't treat you differently for using your rights.

How. Email privacy@failshot.app. You can also delete your account and vault in the app. We'll ask you to confirm the request from the email address on your account, so we know it's you. An authorised agent can make a request for you with your signed permission. We may ask you to confirm your identity and the permission directly with us, unless the agent holds a power of attorney under California Probate Code sections 4121 to 4130.

When. We'll confirm we've received your request within 10 business days and respond within 45 days. If we need longer, we'll tell you why, and may extend that by up to 45 more days where the law allows.

Appeals. If we turn down your request, you can appeal by replying to our decision. We'll respond within 45 days. If you're still unhappy, you can contact your state attorney general.

Other notices. We don't disclose personal information to third parties for their own direct marketing. We don't track you across other websites, and we don't allow other parties to collect information about your online activities over time and across websites when you use Failshot, so we don't respond differently to "Do Not Track" signals. We don't use personal data to train large language models or any other artificial intelligence. We don't sell covered information as defined by Nevada law; Nevada residents can still send an opt-out request to privacy@failshot.app.

15. Changes to this policy

We'll update this policy when Failshot or the law changes. If a change matters, we'll tell you in the app, and by email if you have an account, before it takes effect. The version and date are at the top of this page.

16. Contact us

Privacy questions and requests: privacy@failshot.app. Help: support@failshot.app.