Fastshot for ChatGPT privacy notice

This notice explains how Fastshot handles information in its ChatGPT connection and embedded app cards. It supplements the Fastshot Privacy Policy, which also covers your Fastshot account, projects and website use. ChatGPT and your chosen sign-in provider have their own privacy policies.

Information we use and why

• App descriptions and project results: we receive the description you choose to send to the build tool, create a project in your account, and return its name, link and progress. We do not request or retrieve your full ChatGPT conversation.
• Account linking: we use your account ID, email, verified-email status, permissions and authentication tokens to connect the correct account and authorize builds. If you use email sign-in, your password is passed to our authentication provider; the gateway does not store it. Never include credentials in an app description.
• Security and operation: we use a signed browser cookie to protect sign-in, short-lived authorization records, IP-based abuse limits and build-admission records. Where supplied by our trusted network edge, a country code supports account eligibility rules; the connection does not request precise location.
• Usage records: to run and improve this connection, we record each account connection and tool use: the tool, its result, the time, ChatGPT's anonymized user ID and, once connected, your Fastshot account. Projects started here are marked as coming from ChatGPT. These records do not contain your app description or conversation.
• Support: if you contact us, we use your message and relevant account or project details to answer your request.

Analytics and cookies

The ChatGPT gateway and embedded cards do not send optional usage events to PostHog or link browser identifiers to analytics profiles. Usage records stay in Fastshot's own database. The gateway does not use the sign-in cookie for advertising, behavioral profiling or analytics. Opening the separate Fastshot website is covered by the website's privacy policy and controls.

The security cookie is limited to the gateway host, inaccessible to page scripts, and expires after 30 days. You can remove it in your browser settings. Removing or blocking it during sign-in may prevent account linking.

Who receives information

Fastshot's authentication provider (Supabase, and Google if you choose Google sign-in), hosting and infrastructure providers process data needed to authenticate, secure and operate the connection. Configured AI and build-service providers process your app description and project content to generate the requested app. ChatGPT receives the tool results and account-linking responses needed to display and operate the integration. We do not sell personal information. Other disclosures, including legally required disclosures, are described in the Fastshot Privacy Policy.

Retention

• Unfinished sign-in: browser-bound sign-in state expires after 20 minutes. Authorization codes expire after 10 minutes and can be used only once.
• Account connection: access tokens and their gateway references expire after 60 minutes. Connection records, including provider credentials, expire 30 days after issue or the most recent refresh. Refresh renews that period. Revoking the connection removes its active session and immediately blocks further use. Older token references and replay-protection records expire on their original schedules.
• Build admission: the temporary record preventing overlapping start requests expires within 5 minutes. It is separate from the project itself.
• Projects and account data: descriptions, generated files and project conversations remain in your Fastshot account so you can continue working. Disconnecting ChatGPT does not delete them. You can request account deletion; the Fastshot Privacy Policy provides for erasure within seven days, with exceptions for records needed for financial, legal and security purposes.
• Usage records: deleted after 12 months, or with your Fastshot account if that happens first.
• Other records: infrastructure security logs, support correspondence and any analytics collected before this version follow the retention and deletion provisions of the Fastshot Privacy Policy.

Your controls and contact

You can disconnect Fastshot in ChatGPT's plugin settings to stop further access through that connection. To request deletion of your account and its content, use Account → Delete Account. For access, correction, deletion or questions about previously collected data, email support@fastshot.ai. We may need to verify the request before acting on it.