Privacy Policy

Effective 13 November 2026 · updated 14 November 2026

This policy explains what the Real or AI app and the shotorai.com website (together, "Real or AI"; the website is at shotorai.com) do with the images you check and the small amount of other data they handle. The short version: your image is checked and then deleted; it is never stored, never used for training and never shared.

1. Who we are

Real or AI is operated by Radhika Purushothaman, Bangalore, India ("we", "us"). We decide how and why the data described here is processed: we are the data controller under the GDPR and UK GDPR and the data fiduciary under India's Digital Personal Data Protection Act, 2023.

Privacy questions and requests, and our grievance officer: [email protected].

2. What we process and why

What	Why	How long
The image you check and its file details (type, size, dimensions, embedded metadata such as Content Credentials)	To give you the answer you asked for	Only in memory while it is checked, a few seconds. Never written to disk.
A link you paste on the website	Our server downloads the picture from that address (or a page's main picture) to check it	Not kept: only the downloaded picture's fingerprint and the answer, as below
A fingerprint of the image (a SHA-256 hash, which cannot be turned back into the image) and our answer	So the same image always gets the same answer, without checking it again	90 days
A random device ID created by the app, or kept in your browser by the website (not your phone's hardware ID or advertising ID), and your IP address, both stored only as salted hashes, with a daily count	To apply the daily limit on free checks and stop abuse	30 days
A check log: time, answer, model score, how long it took, app or website. It contains no device ID, IP address or image fingerprint.	To measure accuracy, speed and use, and to fix problems	365 days
If you sign in: your Google account's email address, name and account ID, given to us by Google when you choose "Continue with Google"	To keep your account and the checks you bought, on all your devices	Until you delete your account
If you buy checks: your balance and purchases (pack, amount, time, the payment or order ID from Razorpay or Google Play)	To give you what you paid for, handle refunds, and keep the accounts the law requires	Balance: until you delete your account. Purchase records: 8 years (Indian tax and accounting law), no longer linked to you once your account is deleted
Network logs kept by Cloudflare, which carries traffic to our server (IP address, time, request details)	Security, protection against attacks	Per Cloudflare's policy, typically a few days

Checking a photo needs no account. Signing in is optional and only needed to buy checks. We never see your card, UPI or bank details: Razorpay and Google Play handle payments. We do not ask for your phone number or location. The app has no ads, no analytics or tracking SDKs, and does not read your photos except the one you choose to check.

If you email us, we use your email to reply and keep it as long as the conversation needs, at most 2 years.

3. Legal basis (EU, EEA, UK)

Checking the image you send, your account and your purchases are necessary to provide the service you request (Art. 6(1)(b) GDPR); purchase records are also kept to meet legal obligations (Art. 6(1)(c)). Free-check limits, abuse prevention and the check log rely on our legitimate interests in running a fair, secure and accurate service (Art. 6(1)(f)); we keep them minimal and hashed.

4. Who else handles data

Hetzner Online GmbH, Germany: hosts our server in Nuremberg, where images are checked.
Cloudflare, Inc.: network, security and website hosting, and Turnstile, the website's check that you're not a bot (it looks at your browser, not at your pictures); traffic may pass through Cloudflare data centres worldwide.
Supabase, Inc.: sign-in and the account database (your email, balance and purchases), on servers in London, United Kingdom.
Razorpay Software Private Limited, India: takes payments on the website.
Google: "Continue with Google" sign-in, and Google Play, which distributes the app and takes payments in it, under Google's own privacy policy.

We do not sell or share data with anyone else, and we do not send your images to any other company or AI service.

5. Transfers outside India and the EU

Images are checked in Germany (EU). Accounts are kept in the United Kingdom, which the EU recognises as protecting personal data adequately. Cloudflare may carry traffic through other countries; it provides the EU Standard Contractual Clauses for such transfers.

6. Your rights

You may ask to access, correct or delete personal data, object to processing, or complain. You can delete your account yourself, in the app's settings or at shotorai.com/account (how); checks left in it are lost. Device IDs and IP addresses are stored only as hashes, so we usually cannot link them to you; if you send us the device ID shown in the app's settings, we can find and delete what belongs to it. You can also complain to your data protection authority or, in India, to the Data Protection Board of India.

7. Children

Real or AI is meant for people aged 18 or older. Do not use it if you are younger.

8. Security

Traffic is encrypted (HTTPS) end to end. The server accepts web traffic only through Cloudflare and administrative access only with keys.

9. Changes

We will post any change here with a new date, and tell you in the app if it matters.