Privacy Policy

Last updated August 5, 2026

AfterShot turns the before and after photos from your jobs into short branded videos and posts them to your social accounts. This page explains exactly what we collect to do that, who we share it with, and how to get it deleted. It is written for the person actually using AfterShot — the owner of a trade business — not for lawyers.

AfterShot is operated from the United States. If you use the service, your information is processed there.

1. Signing in with Google or Facebook

You can create or get back into an AfterShot account with Sign in with Google or Sign in with Facebook. When you do, that provider sends us a small, fixed set of information:

Your email address (and whether the provider has verified it)
Your name and, if the provider supplies one, your profile picture
A provider account ID — an opaque identifier for your Google or Facebook account

We ask for nothing else. The permission scopes we request are limited to basic profile and email. We do not receive your password, your friends or contacts, your posts, your photos, your ad data, or your messages.

We use this information for one purpose: to work out which AfterShot account is yours. We match the verified email address from Google or Facebook against the email on your AfterShot account and store the provider account ID so we recognise you next time. That is the whole job. Signing in with Facebook does not give us the ability to post anything to your personal Facebook profile.

Signing in is separate from publishing. Connecting Instagram, TikTok, YouTube or a Facebook Page so AfterShot can post your reels is a different, optional step that you take from your account page, and it asks for its own permissions at that time. Section 3 covers it. You can use Facebook only to sign in and never connect it for posting, and nothing will be published anywhere.

2. What you give us directly

Business details from setup: business name, email, phone number, trade, service area, social handle, starting price, brand colour, call to action, whether you are licensed and insured, and your logo. Most of this is printed onto your videos, so treat it as information you intend to be public.
Job photos and videos — the before and after shots you upload after a job, any extra shots, and any caption or hook you type.
Your Google Business listing, if you link one. We store the place ID and re-read the public star rating and review count from Google so your videos stay current.
Billing details handled by Stripe. We store your Stripe customer and subscription IDs and your plan status. We never see or store your full card number.
Push notification subscription, only if you allow notifications, so we can remind you to post a job.

Please do not upload photos of the inside of a customer's home, of people, or of anything showing an address, licence plate, or document, if you have not been given permission to publish it. Videos AfterShot makes are intended to be posted publicly.

3. Connecting accounts for publishing

If you want AfterShot to post for you, you link your Instagram, TikTok, YouTube or Facebook Page from your account page. That handshake is run by upload-post.com, our publishing provider. You authorise the platform directly; the access tokens are held by upload-post, and AfterShot never sees or stores your platform passwords.

From that point we send finished videos, captions and your business details to those platforms on your behalf, and we store what came back — the connected handle or page name, the post ID, and the permalink. We do not read your existing posts, followers, messages or analytics.

Facebook reels are published to a Facebook Page you manage, never to a personal profile. You can disconnect every linked account at once from your account page, which revokes our ability to publish. Anything already posted stays on the platform until you delete it there.

4. What we collect automatically

Standard server logs (IP address, browser type, pages requested, and time) kept for security and debugging, and a session cookie that keeps you signed in. We do not run advertising trackers and we do not sell or rent your information to anyone, for any purpose.

5. Who we share it with

Only the companies needed to run the service, and only for that purpose:

Supabase — database, file storage, and the sign-in system
Vercel — hosting
Stripe — payments and card handling
Resend — the emails we send you
upload-post.com — publishing to your connected social accounts
Google Maps Platform — looking up your public business listing
Instagram, TikTok, YouTube and Facebook — the videos and captions you have asked us to publish there

We will also disclose information if the law requires it, or to investigate fraud or abuse of the service.

6. Where your files live

Photos you upload are stored in a private bucket that is not publicly browsable. Finished videos and their cover images are stored at public, unguessable URLs — this is a technical requirement, because the social platforms have to be able to fetch a video by link in order to post it. Anyone given one of those links can view that video. Since these videos are made to be posted publicly, that is the intent, but it is worth knowing.

Your upload link (/u/<token>) contains a secret token and works as a key to your account. Treat it like a password and do not share it publicly.

7. How long we keep things

We keep your account details, jobs and videos for as long as your account is open, so your history stays available to you. Server logs are kept for a short period for security. When you delete your account we remove your data as described in section 8. We may keep billing records where tax or accounting law requires it.

8. Getting your data deleted

Email hello@theaftershot.com from the address on your account and ask us to delete it. We will remove your account, your business details, your uploaded photos, your rendered videos, your publishing connections and your Google or Facebook sign-in link, and confirm when it is done — normally within a few days, and within 30 days at the outside.

Full step-by-step instructions, including how to disconnect Facebook from the Facebook side, are on the data deletion page.

Posts already published to Instagram, TikTok, YouTube or Facebook live on those platforms under your own account. We cannot remove them for you — you delete those in the platform's own app.

9. Your choices and rights

See or correct your details from your account page, or ask us and we will send you a copy
Disconnect any or all linked social accounts at any time
Turn off push notifications in your browser, and unsubscribe from emails
Delete your account and everything in it (section 8)

Depending on where you live you may have additional rights over your personal information, including access, correction, deletion, and the right to complain to a regulator. Write to us and we will honour them. We do not sell personal information.

10. Children

AfterShot is a tool for businesses and is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it.

11. Security

Traffic is encrypted in transit, files sit behind access controls, and card details never touch our servers. No system is perfect, so if we ever discover a breach affecting your information we will tell you.

12. Changes

If we change this policy we will update the date at the top, and for anything significant we will email you. Continuing to use AfterShot after a change means you accept the updated policy.

13. Contact

AfterShot — hello@theaftershot.com

Questions about anything here? Email hello@theaftershot.com and a person will answer.