← ShotWitness · Terms · Privacy · Contact

ShotWitness Privacy Policy

This policy may be updated as the app changes.

Effective date: October 17, 2026 Last updated: October 18, 2026 Operator: ShotWitness, operated by its owner ("ShotWitness," "we," "us"). A ShotWitness company is being formed. When it is, it will become the operator and we will update this policy. Contact: use the contact form at shotwitness.com/contact.

The short version

Your photos and your medication log stay on your device. We don't receive them, see them, or store them on our servers.
You don't need an account. Accounts for syncing across devices are planned, but they are not turned on yet. Today everything stays on your device.
Apart from websites you choose to open, the doctor lookup is the one thing that leaves your device. Drug names, barcodes, reminders, dose logs, side-effect notes and weights never do. When you type a doctor's name, the first few letters are sent to the free public U.S. government NPI Registry so the app can suggest matches (see Section 2).
We don't sell or share your data, and we don't use it for advertising.
We don't use analytics or advertising trackers. In the iPhone app, Google's on-device text reader sends Google technical diagnostics (no photos and no label text). See Section 2.
You control deletion and backups. Delete entries in History, delete everything from Profile, or clear the app or browser data. If you want a backup, the app makes an encrypted file that you keep. We never receive it.

1. What the app handles, and where it lives

Information	Where it goes	Do we receive it?
Label photos you take or upload	Processed and saved only on your device. In the web app this is browser storage. In the mobile apps it is the app's private storage.	No
Text read from the label (drug, dose, form, pharmacy, Rx number, fill date, directions, lot), notes you type, your confirmations, and results	Saved only on your device	No
People and pets you add (name or nickname, relationship, kind of pet, optional pet weight, and an optional profile photo or avatar), and the pharmacies and doctors you used before	Saved only on your device	No
My Meds (medicines you save), reminder times, doses you mark Taken or Skipped, supply counts, and med buddies you add (name and optional email or phone)	Saved only on your device. Med buddy invites and missed-dose alerts are not sent to anyone yet. They wait on your device until optional account sync exists, and we will update this policy before that happens.	No
Health log: side-effect notes you add (tags, how strong, an optional note, and which dose it followed) and weights you enter	Saved only on your device. Shared only if you create a doctor report PDF and choose where to send it with your phone's share sheet.	No
Progress photos you choose to add (with a date and an optional note)	Saved only on your device. They are never put in doctor reports. They go into a backup file only if you choose to include photos.	No
Encrypted backup file (optional)	Created on your device only when you tap "Save encrypted backup" in Profile. It is locked with a passphrase you choose (AES-256 encryption) and goes only where you save or send it with your phone's share sheet (for example Files or iCloud Drive). We never receive the file or the passphrase, so we can't open it or recover a lost passphrase. Restoring reads the file on your device.	No
Refill notes	Text the app writes for you (medicine, pharmacy and your own supply count) when you tap "Refill note". It goes only where you paste or send it. The app keeps only the date you made it.	No
Support info (optional)	When you tap "Copy support info" in Profile, the app copies app version, device type and counts (for example how many checks or doses are saved). It has no names, medicines, photos or notes. It goes only where you paste it.	Only if you send it to us
Barcodes on labels	Read on your device and looked up in a drug-code list (the public FDA NDC directory) that is built into the app. The barcode is not sent anywhere.	No
Drug name suggestions	Come from a public drug-name list (NLM RxTerms) built into the app. What you type is not sent anywhere.	No
Doctor name you type in the Doctor field	The first letters of the name are sent to the public CMS NPI Registry to suggest matches (Section 2). The doctor you pick is saved only on your device.	Passes through our web host only (Section 2)
Text recognition (OCR)	Runs on your device. The web app uses the open-source tesseract.js library in your browser. The mobile apps use Google ML Kit on-device text recognition, which reads the image on your device and does not send the image or the text to Google.	No
Camera access	Used only while you are taking a photo or scanning a barcode, and only after you allow it	No
"Find a lower price" links in My Meds	The tips are built into the app. If you tap a price or assistance website (for example GoodRx, SingleCare, Cost Plus Drugs, NeedyMeds, or VA), it opens in your browser, and that website receives the medicine name in its address plus standard technical information, under its own privacy policy. ShotWitness doesn't send it anything else and isn't paid by these sites.	No
Doctor report PDF	Created on your device. It goes only where you send it (for example email, Messages, or Files), using your phone's share sheet. We never receive it.	No
Notifications	Dose and low-supply reminders are created on your device, only if you turn them on and allow notifications	No
PDF or printed reports	Created on your device. If you share or print one, it goes only where you send it.	No

Please be careful with labels. They often show your name, address, prescriber, and pharmacy. Anyone with access to your unlocked device can see your saved history. If you share or print a report, the person or service you send it to receives that information, and their privacy terms apply.

2. Information that leaves your device

We do not run our own analytics. The following technical information is handled by other services:

Hosting. Netlify, Inc. hosts shotwitness.com. Like any web host, it may log your IP address, browser type, the pages requested, and the time of each request, for security and to run the service.
Doctor lookup (CMS NPI Registry). The Doctor field can suggest prescribers from the National Provider Identifier (NPI) Registry. This is a free public directory run by the U.S. Centers for Medicare & Medicaid Services (CMS). When you type at least 3 letters, the app sends a search containing only the first 3 letters of the last name and the first 2 letters of the first name you typed. It never sends label photos, label text, drug names, or who the medication is for.
- On the website, the search goes to the Registry through our proxy on Netlify (shotwitness.com/api/npi). We don't keep these searches. Netlify may log the request like any other page request.
- In the mobile apps, the search goes from your device directly to the Registry at npiregistry.cms.hhs.gov.
- The Registry receives the search, plus standard technical information such as an IP address, under CMS's own policies.
- If you don't want any lookup, type the doctor's name into the Notes field instead, or leave the Doctor field blank. Doctors you used before are suggested from your device without any lookup.
Google ML Kit (mobile apps). ML Kit reads labels and barcodes on your device and does not send photos or label text. It does send Google technical diagnostics about how ML Kit itself is working: device model and operating system version, app name and version, performance and error information, and a per-installation identifier that is not meant to identify you. Google handles these under its own privacy policy. On Android, the text-recognition model is delivered and updated through Google Play services.
Price and assistance websites you choose to open. "Find a lower price" only shows links. Nothing is sent unless you tap one. When you do, your browser opens that website, and it receives the medicine name (as part of the web address) and standard technical information such as your IP address. These websites are not run by us, and their own privacy policies apply.
Code libraries and data. The open-source code and public data the app uses (tesseract.js, its English language data, jsPDF, ZXing, the NLM RxTerms drug list, and the FDA NDC directory) is served from shotwitness.com itself and is built into the mobile apps. No outside content delivery network is used.
App stores. Apple and Google may collect information when you download or update the app. Their privacy policies govern that, not ours.

3. Optional accounts (not yet available)

The app works fully without an account. We are preparing optional sign-in so you can sync your people and records between your own devices. It is not turned on yet, and no account data is collected today. Before it is turned on, we will update this policy to explain exactly what is stored, where, and for how long. Syncing will happen only if you sign in and choose to sync. Without an account, nothing changes.

4. How we use information

We use the limited technical information above only to deliver, secure, and fix the website and app, and to show doctor suggestions. We do not use any information to build profiles, target ads, or make decisions about you.

5. We don't sell or share personal information

We do not sell your personal information. We do not "share" it for cross-context behavioral advertising, as U.S. state privacy laws use that term. We do not disclose health information to advertisers, data brokers, insurers, or employers.

6. If you contact us or join the waitlist

If you use the contact form, we receive the message you write and any reply address you choose to give. The form is processed by our web host, Netlify. We use your message only to reply to you, and we delete it when it is no longer needed. Please don't send photos of labels or other health information through the contact form.

If you join the launch waitlist on shotwitness.com, we receive only the email address you enter. The form is processed by our web host, Netlify. We use it only to tell you when the ShotWitness app launches and to send related launch news, and we don't sell or share it. To be removed, use the contact form. The waitlist is on the website only, not in the app.

7. HIPAA

ShotWitness is not a HIPAA "covered entity" (a health plan, health care clearinghouse, or health care provider that conducts certain electronic transactions). It is also not a "business associate" of one. The app is a consumer tool that you choose to use for your own purposes. It is not provided on behalf of your doctor, pharmacy, hospital, or health plan.

8. Breach notification

We do not hold your photos or logs, so there is nothing of yours on our servers to breach. If we ever begin storing health information, for example when optional sync launches, we will follow the FTC Health Breach Notification Rule and applicable state breach laws.

9. Your choices and deletion

Delete one entry: open History, choose the entry, and tap Delete.
Delete all history: open History and tap Delete all history (removes saved checks and photos).
Delete everything: tap Profile (or Account on the website), then "Delete all my data on this device". This removes checks, photos, people, My Meds, reminders and snoozes, dose and site logs, side-effect notes, weights, progress photos and refill notes. It doesn't delete backup files you saved outside the app (for example in Files or iCloud Drive); delete those where you saved them. You can also uninstall the app, or clear the site data for shotwitness.com in your browser settings.
Notifications: turn reminders off for any medicine in My Meds, or turn off notifications in your device settings.
Camera permission: you can turn it off at any time in your device settings and upload photos instead.
Doctor lookup: leave the Doctor field blank, or put the doctor's name in Notes, and no lookup is made.
Export and backup: Profile → Backup & restore makes an encrypted backup file you keep. Doctor report and history PDFs are made on your device.
Because we don't have your app data, we can't access, correct, export, or delete it for you. You hold it.

10. Children

The app is not directed to children under 13, and we do not knowingly collect personal information from children. Users under 18 should use the app only with a parent or guardian (see the Terms of Use, Section 2). A parent or guardian may add a child as a person in the app. That profile stays on the device.

11. Security

On-device storage is protected by your device's own security, such as your passcode and encryption. Use a screen lock. Backup files are encrypted on your device with your passphrase before they leave the app. Choose a strong passphrase and keep it safe. The website uses HTTPS.

12. State privacy rights

Depending on where you live, you may have rights to access, delete, or correct personal information, or to opt out of its sale or of targeted advertising. These states include California, New Jersey, and Washington (My Health My Data Act). We don't collect app data about you, and we don't sell your data or target ads. To ask about any information we may hold, such as contact form messages or a waitlist email address, use the contact form at shotwitness.com/contact.

13. Changes

We will post any changes here with a new effective date. If a change is material, especially one that would send more data off your device (such as turning on account sync), we will tell you in the app before it takes effect and ask for your consent where the law requires it.

14. Contact

Use the contact form at shotwitness.com/contact.