Privacy & Policy

Welcome to Shorty! Shorty summarizes YouTube videos, web pages, documents and pasted text, transcribes audio and video, generates subtitles, and converts files. This Privacy Policy explains what we collect, why, who receives it, how long we keep it, and what you can control — including what we share with an AI assistant when you connect one. By accessing and using our services, you agree to the terms of this Privacy Policy.

What information do we collect?

• Account information — your email address, the name or username you give us, and a hashed password. If you sign in with Google or Apple we store the link to that account, never its password.
• Content you submit — the links you paste (YouTube videos, web pages, audio and video URLs), text you type, and the files you upload (audio, video, PDF, Word documents, images and other files you convert).
• Content we generate for you — summaries and their sections, article and transcript text, transcription results and the detected language, subtitle files and captioned videos, and converted files. These are stored with your account so you can come back to them.
• Processing records — one record per job you start: its type, status, progress, a title derived from your content, the identifier of what it produced, timestamps, and any error message the pipeline reported.
• Plan and billing — your plan tier, entitlements, trial and renewal dates. Payments are handled by RevenueCat and the app stores; we never receive or store your card number.
• Developer and integration data — API keys you create, webhook endpoints and their signing secrets, a log of your API requests (method, path, status, duration and request id), records used to make retries safe, and — for each AI assistant you connect — the app, the permissions you granted, and its access and refresh tokens.
• Technical data — your IP address and browser user agent are stored with your sign-in session, along with cookies, device push tokens if you enable notifications, product analytics events, and error diagnostics.
• Chats with Shorty's assistant — the messages you send to the in-app AI assistant, its replies, and any thumbs-up or thumbs-down you leave on an answer.
• Support messages — what you write to us through the support form or by email, and the address we reply to.

How do we use this information?

• To run the product: send your content to the AI models and transcription service that produce your summaries, transcripts and subtitles, and to store the results in your library.
• To operate your account: sign you in, apply your plan's limits and quotas, and send the emails the service needs to send (verification, password reset, account deletion, and the occasional lifecycle notice).
• To keep the service working and safe: diagnose errors, measure how features are used, rate-limit abuse, and answer your support requests.
• To fulfil requests you make through a connected AI assistant — see the next section.

We do not sell your personal information, and we do not use your content to advertise to you.

AI assistants and connected apps

You can connect Shorty to an AI assistant — for example ChatGPT or Claude — so it can work with your Shorty data on your behalf. This only happens after you sign in and approve the specific permissions on a consent screen; an assistant can never reach your data without that approval, and it only gets the tools covered by the permissions you granted.

When a tool runs, its result is sent to the AI assistant provider you connected — OpenAI if you connected Shorty to ChatGPT, Anthropic if you connected it to Claude — and from that point it is also handled under that provider's own privacy policy. Below is everything those tools can return, including nested fields.

• Your summaries and articles — for each item: its identifier, title, description, type and creation date; and for a single item you ask about, its summary sections and the article or transcript text it was built from.
• Your transcriptions — for each one: its identifier, status, progress, detected language, the name of the file or link you submitted, and its creation date; and for a single transcription you ask about, the full transcript text.
• Your jobs — for a job you started through the assistant: its identifier, status, type, and the identifier of the item it produced.
• Your plan and usage — your plan name and tier, the limits that come with it (upload sizes, realtime minutes, conversion caps), and how much of your daily cloud-conversion quota you have used and have left.
• Creating new work— an assistant can start a summary, transcription or subtitle job from a link, pasted text or a file you already uploaded. Shorty receives what the assistant sends (the link, text or file reference, the language and the subtitle style) and returns the new job's identifier, a link to follow it, and — if your plan does not allow the request — a plain message naming the limit.
• Our public documentation — an assistant can search Shorty's developer docs. That content is public and contains none of your data.

Deliberately not sent to a connected assistant: your email address, your name, your account identifier, your IP address or browser user agent, your device push tokens, your payment details or subscription renewal and trial dates, your API keys or webhook secrets, the internal identifiers of the AI and transcription engines we run, and raw error or debug output from our pipeline.

You can see every connected app and disconnect it at any time under Settings → Connected Apps. Disconnecting deletes the permission record and that app's stored access and refresh tokens, and because every tool call re-checks your permission, the app stops being able to read or create anything immediately.

Who else receives your information?

We do not sell your personal information or share it for anyone else's marketing. We do rely on service providers who process it on our behalf, only to run Shorty:

• AI model providers (OpenAI, and models reached through OpenRouter) — they receive the content being summarized or edited so they can produce the result.
• Our transcription service — receives the audio or video you submit in order to transcribe it.
• Cloud storage and search — your uploads and generated files are stored in object storage, and your summaries are indexed so you can search your own library.
• Sign-in providers (Google, Apple) — if you choose to sign in with them.
• Billing (RevenueCat and the Apple and Google app stores) — to manage subscriptions and entitlements.
• Email, notifications and support — to deliver account emails, push notifications you opted into, and replies to your support messages.
• Analytics and error monitoring (PostHog, Sentry, Google Analytics) — to understand feature usage and diagnose failures. Ordinary usage events carry identifiers rather than your content; the exception is your chats with Shorty's in-app assistant, whose traces include the message and the reply so we can debug and improve it.
• An AI assistant you connect — as described in the section above.

We may also disclose information where the law requires it.

How long do we keep it?

• Your content and results — kept while your account exists, so your library stays available. You can ask us to delete specific items at any time.
• Connected-app permissions and tokens — kept until you disconnect the app, which deletes them. An access token already issued to an app expires on its own within an hour, and consent is re-checked on every call, so revocation takes effect straight away.
• Sign-in sessions — kept until they expire or you sign out, and deleted when you delete your account.
• Records that make retries safe — when an assistant or an API call supplies a retry key, we store that key with the job it produced so a repeat does not run the work twice.

Deleting your account removes your sign-in identity (email, name, username and password), your linked Google and Apple sign-ins and all your sessions immediately. Stored content is not erased in that same step — email us and we will delete it.

Your choices and controls

• Disconnect an AI assistant — Settings → Connected Apps.
• Delete your account — Settings → Danger Zone.
• Manage API keys, webhooks and notifications — the matching tabs in Settings.
• Access, correct or delete your data — email us and we will act on the request.
• Cookies — you can manage or block them in your browser settings, with the caveat that signing in requires a session cookie.

You can also choose not to provide certain information, but that may limit the features available to you.

Do we use cookies?

We use cookies to keep you signed in, to carry out the sign-in and connected-app approval handshakes securely, and to measure how the product is used so we can improve it.

How do we protect your information?

Your library is private to your account: a request for your saved work is matched against the signed-in user, and a connected app reaches only your own items plus the public ones Shorty publishes to everybody. Passwords are stored hashed, webhook signing secrets are stored encrypted, and traffic is served over HTTPS with a baseline of security response headers. We implement technical and organizational measures to safeguard your data against unauthorized access and data breaches.

Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Any updates will be posted on our website, and the revised policy will take effect immediately upon posting.

Contact us

If you have any questions or concerns about this Privacy Policy, or you want to access, update or delete your information, please contact us at hello@devino.ca.