1. Who this policy covers
This Privacy Policy explains how Outshot.lol, operated by Omar Abdelsattar Abadi (عمر عبد الستار عبادي), collects and uses information when you use Outshot.lol (the "Service"). It does not cover the separate privacy practices of our payment processors — see Section 5.
2. What we collect
- A pseudonymous identity. Outshot sets a first-party session cookie named
outshot_session. It contains a random identifier and an issue time, signed by our server. It is HttpOnly, Secure when served over HTTPS, SameSite=Lax, and lasts up to 90 days. There is no account, password, email address, or sign-in. Clearing your cookies or changing devices creates a new identity, and an existing ownership cannot be recovered from the old identity. - The display name you choose. It is stored in our database and a copy is kept in your browser's local storage for convenience.
- Images and captions you upload. Uploads happen before checkout. If an image is accepted, it is stored in Cloudflare R2 and linked to a database record. Images and captions may remain stored even if you do not complete checkout. Images rejected before storage are not uploaded to R2, but a moderation record, caption, and image hash may remain.
- Public ownership data. Your display name, image, caption, selected duration, start and end times, and current or ended status may be shown on the current screen, the public ownership history, a public ownership page at
/o/…, and a share card. Anyone with the page or share link can see this data. - Payment metadata from Whop. We receive and store the Whop order or payment reference, amount, currency, status, and tier. We do not receive or store your full card number or other full card details. Whop may collect your payment and contact information under its own privacy policy.
- Basic usage events. Events such as an upload, checkout, taking or losing the screen, creating a share link, and opening a share link may be stored with your anonymous identifier. Some events may be stored without an identifier.
- Technical logs and IP addresses. We process IP addresses for rate limiting and security. Our hosting infrastructure may generate standard logs containing IP address, request time, and user agent.
- Reports you submit. If you report content, we store the report note, the related screenshot identifier, and its status.
3. How we use it
We use this information to operate the Service, confirm payments and activate runs, show the current screen and public ownership history, generate public pages and share cards, moderate uploads, prevent abuse and rate-limit requests, understand basic usage, respond to support and refund requests, and meet legal and accounting obligations.
4. Automated content moderation
Uploads are screened by a mandatory NSFW classifier, a gore classifier, and local OCR for Arabic and English. If a required check is unavailable or fails, the upload is rejected and cannot proceed to payment. Object detection (OWL-ViT) runs as an additional asynchronous check; an upload is not eligible for payment until that check completes successfully. Gore, object-detection, and borderline NSFW results may be sent to manual review. Duplicate-image checks are also used.
We do not claim reliable detection of every category. We do not currently operate a dedicated exposed-hair or hijab classifier, and we do not represent that such content is detected. The optional text-toxicity model and optional cloud escalation are disabled by default. If cloud escalation is enabled, the image and any OCR text may be sent to Gemini or Groq for a moderation decision; we will update this policy before enabling a new third-party moderation provider.
5. Payment processors
Whop is the only payment provider for new purchases. Checkout is hosted by Whop, and Whop processes your payment. Whop may collect and process your payment and contact information under its own privacy policy. We receive transaction metadata needed to confirm payment and operate the Service.
Whop Privacy Policy: whop.com/privacy
Whop Buyer Terms: whop.com/buyer-terms
6. Cookies and similar technology
Outshot sets the first-party outshot_session cookie described in Section 2. We do not set first-party advertising or tracking cookies. Your chosen display name is also stored in local storage.
When you open Whop's hosted checkout, Whop may set cookies or similar technology on its own domain under its privacy policy. Our pages also load fonts from Google Fonts and a Tailwind CDN script; those providers may receive your IP address and standard request metadata under their own policies.
7. How long we keep it
We do not currently run an automatic deletion schedule for uploaded images, captions, ownership history, share links and click counts, analytics events, moderation records, or payment records. We keep them for as long as needed to operate the Service, including maintaining the public ownership history, preventing abuse, resolving disputes, and meeting legal or accounting obligations.
An image uploaded before checkout may remain stored even if you do not complete the purchase. Completed Whop webhook event records are pruned after about 30 days; failed or pending webhook records are retained longer for retry and review. Database backups, where enabled, may retain copies beyond the deletion of the live record. Hosting and infrastructure logs are retained according to the hosting provider's settings.
8. Your choices and contact
Because there is no account or sign-in, we identify you by the anonymous identifier in your browser cookie. To ask about, request correction of, or request removal of data associated with your identity, contact omarabdelsattar2006@gmail.com.
We will review requests and take the steps required by applicable law. Some records may remain in backups, in public pages or share links that others have copied, or where we need to retain them for legal, accounting, security, or dispute purposes. Clearing your cookie creates a new identity and does not recover an existing ownership.
Depending on your location, you may have additional rights under applicable data protection law.
9. Children
Outshot.lol is not directed at children, and we do not knowingly collect personal data from children.
10. Changes to this policy
We may update this Privacy Policy from time to time. The version posted on this page applies from the date it is published.