What data does Shotluma collect?
Published
Short answer
The editor stores your work in your own browser and sends it to no Shotluma server, because none exists to receive it. Projects live in IndexedDB and API keys in local storage. The one time data leaves your browser is an AI run: your prompt and the screenshots you attached go to the AI provider whose key you supplied, and to nobody else. This marketing site counts pageviews and AI-crawler requests; that measurement does not run inside the editor.
Key points
- No account, no login and no user record — there is nothing to sign up to.
- Projects, uploads, prompts and API keys stay in browser storage on the device you used. They are not synced, not backed up and not readable by the maintainer.
- AI generation does send your prompt and attached screenshots to your chosen provider. That request is governed by their terms, not this page.
- Analytics on shotluma.com cover pageviews and crawler traffic only, and are absent from the editor at app.shotluma.com.
- Clearing your browser storage deletes your projects permanently. There is no copy anywhere else to restore from.
What the editor stores, and where
| Data | Where it lives | Who can read it |
|---|---|---|
| Projects, slides, uploaded screenshots | IndexedDB, in your browser | You, on that device |
| AI provider API keys | localStorage, in your browser | You, and the provider you send a request to |
| Prompts and app descriptions | Held with the project, in your browser | You, plus the provider during an AI run |
| Exported PNG and ZIP files | Your download folder | You |
There is no Shotluma backend behind the editor1 (source 1). Both shotluma.com and app.shotluma.com serve static files; neither receives a project, an upload or a key.
What leaves your browser during an AI run
This is the part worth reading carefully, because it is the one place your content genuinely travels.
- You choose a provider and paste its API key. The key is written to local storage on your device.
- When you start a generation, your browser calls that provider directly. The request carries your prompt, your app description and the screenshots attached to the run.
- The provider answers, and the editor turns the answer into real layers. Nothing in that round trip passes through a Shotluma server.
What the provider then does with that request — how long it retains it, whether it may be used for training — is set by the provider’s own policy for the account and key you used. If your screenshots contain anything sensitive, that policy is the one that matters, so read it before the first run.
One exception exists and it is local only: Moonshot is reachable through a CORS proxy that runs on your own machine in development. It is not part of the deployed editor.
What this marketing site measures
shotluma.com is a plain marketing site and measures like one. Two tools run here, and neither is loaded by the editor.
- DataFast — pageviews, plus server-side reporting of AI and search crawler requests, so it is possible to tell which answer engines actually fetch these pages.
- Plausible — a self-hosted, cookieless instance counting pageviews, run in parallel while the two are compared.
Both answer the same narrow question: did anyone read this page. Neither receives editor data, because neither is present in the editor.
What there is none of
- No accounts, no email collection, no newsletter and no contact form.
- No advertising network, no retargeting pixel and no data broker.
- No server-side copy of your projects, screenshots or keys.
- No payment processing, because nothing is for sale.
How to remove everything
- Delete the API key from the editor’s provider settings, or clear local storage for the site.
- Clear site data for app.shotluma.com in your browser settings. That drops the IndexedDB database holding your projects.
- Nothing further is needed. There is no account to close and no deletion request to file, because there is no record held elsewhere.
Keys already sent to a provider are a matter for that provider — revoke them in its dashboard, which is good practice regardless.
Frequently asked questions
Can you see my screenshots?
No. They stay in your browser and no Shotluma server receives them. During an AI run they go to the provider whose key you supplied, and that provider can see them.
Can I use the editor without sending anything anywhere?
Yes. Skip the AI features and build a set by hand: uploads, layout and export all run locally, and no key is needed.
Are my API keys safe in local storage?
They are as safe as the device and browser profile holding them. Local storage is readable by anything running on that origin, so use a scoped key with a spending limit where your provider offers one, and revoke it when you are done.
Do you use cookies?
The Plausible instance is cookieless by design. The editor uses browser storage for your own projects and keys, which is not tracking and never leaves the device.
How can I verify any of this?
Read the code1 (source 1). The editor is MIT licensed and public at github.com/realZachi/shotluma, or open your browser’s network tab during a run and watch where the requests go.
Sources
- 1Shotluma editor source code — Shotluma on GitHub, storage and provider modules. Read .