shottxt collects the minimum it needs to be a social network. It also carries advertising, which is what pays for it, and that means one other company learns that you were here. This page says exactly what that means.
1. Who runs shottxt
shottxt.com is operated by Ahn (Seoul, South Korea). For anything in this policy, including requests to access or delete your data, write to shottxt0901@gmail.com.
2. What we collect
There are three sources, and that is all of them. The ad network described below collects on its own account rather than ours — we never receive what it gathers.
- From Google, when you sign in: your name, email address, profile picture URL, and the Google account identifier that lets us recognise you next time. We never receive your Google password.
- From you, as you use the site: posts, replies, reposts, likes, saved posts, poll votes, follows, reports you file, and anything you put in your profile (display name, ID, bio, location, website, and a profile photo if you upload one — stored by our database provider as a small copy, and deleted when you replace or remove it).
- Automatically, as a side effect of serving the site: our hosting provider records request logs containing IP addresses and user-agent strings, and we store rate-limiting counters keyed to your account so one person cannot flood the service. Each post also counts how many times its page has been opened: a number attached to the post, not a record of who opened it. Your account carries one timestamp saying when it was last seen, overwritten on each visit — it lets us count how many accounts are around in a day or a month, and it is never a history of when you came, went, or what you read.
3. What we do not collect
- No passwords. Google handles sign-in.
- No analytics trackers of our own. We do not run Google Analytics or anything like it, and the only third-party code on the page is the ad script described below.
- No contact list, location data, or device identifiers beyond what is in an ordinary HTTP request.
- No payment details — shottxt does not charge you for anything. The advertising is why it does not have to.
4. Cookies
shottxt sets only the cookies it needs to work: a signed session cookie that keeps you logged in, and a CSRF token that prevents other sites from acting on your behalf. Both are set by the authentication layer, are strictly necessary, and expire when your session does. Because they are strictly necessary, they do not require your consent, and there is no way to browse a signed-in session without them.
Advertising sets cookies too, and those are not ours. Google and its ad partners may read and write cookies in your browser to choose which ads to show and to count how they did. We do not control them, cannot read them, and they outlive your session. The section on advertising below says what you can do about them.
Beyond those two kinds, no cookie is set. We set nothing to profile you, and we hand nothing to anyone who would.
5. Advertising
shottxt shows ads between posts. They are served by Google AdSense, and they are what pays for the hosting and the database. We do not choose which ad you see, and no ad is ever chosen from anything you typed into shottxt — your posts, your profile, your likes and your votes are never sent to the ad network.
What Google does receive is what any embedded script receives: your IP address, your user-agent, the page you are on, and whatever its own cookies already hold from other sites you have visited. Google and its partners use that to pick ads and to measure them. This is Google acting for itself, not processing on our behalf, and it is governed by Google's own policy at policies.google.com/technologies/ads.
You can turn personalised advertising off at any time. google.com/settings/ads switches it off for your Google account everywhere Google's ads run; optout.aboutads.info does the same for the other vendors in the industry programme. The ads do not go away, but they stop being picked from a profile.
Ads are labelled, and they sit between posts rather than inside them. Nothing in your feed is a paid placement: we do not take money to rank a post, and no post is an ad.
6. Why we use it
We do not sell your data or rent it, and showing you an ad is not selling it — nothing about you leaves us for the ad network. We would disclose it only if legally compelled, and we would tell you unless the law forbids it.
- To run the service: show your posts to the people who follow you, deliver notifications, and let people find you by ID.
- To keep the service usable: rate limits and abuse reports exist to stop spam and harassment.
- To respond to you when you contact us.
- To pay for it: the ads between posts cover the hosting and the database. That is the whole business model — we are paid for the space on the page, not for anything about you.
7. What is public
shottxt is a public network. Your display name, ID, profile picture, bio, location, website, join date, posts, replies and reposts are visible to anyone, signed in or not, and are included in the site's sitemap so search engines can index them.
Five things stay out of that. Your email address is never shown to other users. Reports you file are private and are not shown to the person you reported. Who you follow and who follows you is visible only to you — the counts on your profile are public, but the names behind them are not. The list of posts you have liked is visible only to you — though the like itself still counts towards the total shown on a post, so it is not anonymous so much as unattributed. And how you voted in a poll is visible only to you, on the same terms: your choice is never attached to your name, but it is counted in the tally the poll shows.
8. Who else sees it
Running a website means other companies process data on our behalf. For shottxt those are the hosting provider that serves the site, the managed database provider that stores it, and Google, which handles sign-in. Each of them only processes what is needed to do its job. Our database is hosted in South Korea.
Those three process on our behalf. One more company is in the picture and does not: Google's advertising business, which receives your IP address and user-agent when an ad loads and uses them for its own purposes, as described above. Serving that ad means the request reaches Google's servers outside South Korea. No other company receives anything about you, and nothing about you ever reaches an advertiser.
9. How long we keep it
Your account and its content stay until you delete them. Rate-limiting counters expire within an hour. Deleting a post removes it, along with its reposts, likes, and any poll on it and the votes cast in it — unless somebody has replied to it, in which case the post is blanked and a marker is left in its place, because deleting it would delete their replies too. Backups and provider logs may retain copies for a short period before they roll over.
Deleting your account is anonymisation rather than erasure, and this is the part worth reading twice. Everything that identifies you goes: your name, email address, picture, bio, location, website, when you were last seen, your follows, your notifications, your saved posts, the reports you filed, and the link to your Google account. Your posts stay, shown as written by [deleted]. They stay because replies belong to the post they answer — deleting yours would delete the replies other people wrote under them, and theirs is not ours to take. Delete any post you want gone yourself, before or after; a post somebody has replied to is blanked rather than removed. Your handle stays reserved so that nobody can register it and inherit your old mentions. Your likes and poll votes stay as anonymous rows, so the tallies they are part of stay true; nothing anywhere lists who liked or voted.
Moderation records are the one exception. When somebody reports a post, we keep the report — the reason given, and a copy of the reported content as it stood at that moment — even after the post or account is removed, so there is a record of what was acted on and why. A report about you keeps pointing at your account after you delete it, because your posts stay up and a moderator has to remain able to act on them; by then the account it points at holds nothing but the handle already printed on those posts. Reports are never public. Reports you filed yourself are deleted along with your account.
Advertising cookies are not ours to expire. Google sets their lifetimes, and the opt-outs above are how you get rid of them.
10. Your choices
If you are in a jurisdiction that grants you rights of access, rectification, erasure, portability or objection, this is how you exercise them, and you may also complain to your local data protection authority.
- Export: Settings → Account → Download your data gives you a JSON file with everything listed above.
- Correct: Settings → Edit profile changes your name, ID, bio, location and website at any time.
- Delete: Settings → Account → Delete account removes everything that identifies you, permanently. Your posts stay under [deleted] — delete the ones you want gone first. There is no undo and no archive.
- Ask: if you would rather have a human do any of the above, or you want to know what we hold, email shottxt0901@gmail.com.
- Opt out of personalised ads: google.com/settings/ads, as described above. It applies here and everywhere else Google's ads run.
11. Age
shottxt is not for children. You must be at least 13 years old to hold an account, or older where your local law requires it. If we learn an account belongs to someone younger, we delete it.
12. Changes
If this policy changes in a way that matters, the effective date at the top changes and we will say so on the site before it takes effect.
Questions about this document? Write to shottxt0901@gmail.com.