ShowForAi (SFA) Privacy Policy

1. Introduction

This Policy explains how ShowForAi (“SFA” or the “Software”) collects, uses, stores, and protects information during the public beta / commercial-feature trial. Our architecture is local first: core data stays on your local device by default.

Scripts and combinations can be shared for free. Paid script purchases, creator revenue and payouts are paused. Stripe is used for international memberships only.

2. Information we collect

2.1 Information you provide

• Email address: Used for registration, sign-in, password recovery, and contact.
• Script metadata: Script name, step count, creation/modification time, and a content hash used to deduplicate cloud synchronization.
• Cloud script content: Only when you actively enable cloud sync, create a share, or import a cloud share, related script structure, visual templates or screenshot crops, step parameters, and typed text may be uploaded to the cloud or downloaded to your device.
• Sharing information: Script content you actively share, its description, price, publishing status, and expiration, uploaded only when you use sharing.
• Commercial-ledger information: Content and membership orders, purchase history, refund/dispute records, creator revenue, settlement, and manual-payout status, created when you use the corresponding commercial features.

2.2 Information collected automatically

• Usage statistics: Software launch count, script-run count, and run duration, used to improve the product experience.
• Error logs: Error stacks generated on a crash, excluding screen content and keyboard input.
• Device information: Operating-system version and screen resolution, used to tune the visual-matching engine.

3. Information we do not collect by default

By default, local scripts, visual templates and typed text stay in the desktop data folder, normally %LOCALAPPDATA%\ShowForAi. Cloud sync, sharing/import and authorized AI visual recognition can transfer the relevant data described in this Policy. AI recognition can send the current action's screenshot crop, click coordinates and necessary diagnostics through OpenRouter to its model providers. Examples of local data:

• Screenshot pixel content, including recording-time visual templates, screenshot crops, and bbox thumbnails
• The specific text typed through keyboard actions
• Screen recordings or video streams
• Any other files on your computer

4. Cloud storage

4.1 Storage location: We use Railway-hosted PostgreSQL database services located in Singapore.

4.2 Authentication uses JWTs. The saved Global sign-in token is encrypted locally with Windows DPAPI, normally at %APPDATA%\SFA\global\.auth_cache.json.

4.3 Transport security: Client-cloud traffic uses HTTPS (TLS 1.2 or later).

4.4 Scope of cloud actions: Cloud sync, sharing and import are user-triggered. To complete synchronization, preview, authorization, purchase, download, or import, related script structure, visual templates or screenshot crops, step parameters, and typed text may be uploaded or downloaded.

4.5 AI visual recognition: Local heuristic output may be used to finish an already-authorized generation session only after a third-party model or provider call fails. A local fallback will not bypass sign-in, allowance, or authorization. After authorization, recognition may send the screenshot crop for the current action, the operation point (click coordinates), and necessary diagnostic information to our cloud service and route them through OpenRouter to its model providers to identify the visual target region.

5. Third-party services

We do not use third-party analytics services and do not embed tracking code.

6. Data retention

6.1 Cloud account data is retained as needed to provide the service. Necessary purchase, financial and audit records may be retained longer for reconciliation, tax, dispute resolution, security and legal obligations.

6.2 After a confirmed account deletion, sign-in is disabled and profile identifiers are anonymized. Cloud scripts, eligible unpurchased shares, playlists and feedback are removed. Necessary purchase, financial and audit records, and content needed to preserve existing purchases, including purchased shared scripts and their snapshots, remain for their continuing purposes. Unsettled transactions, disputes or active generation may prevent deletion until resolved.

6.3 Backups may contain older account data until they expire under the configured retention schedule. Account deletion does not immediately erase every backup copy. Contact onesteptomu@gmail.com for a specific erasure request; applicable privacy rights remain unaffected.

6.4 Local files remain under your control. Cloud account deletion does not delete saved files on your device.

7. Your rights

• Export: After signing in, open Manage account → Account data and security → Data export to download a JSON export of the available cloud account data. This is not an export of every local script as .sfa files; back up local scripts separately.
• Access: View sign-in and membership information under Manage account → Account status. Use Data export for the available stored cloud account data.
• Deletion: After signing in, choose Delete account under Manage account → Account data and security and confirm with your current password, or contact onesteptomu@gmail.com. Never email your password.
• Correction: Correct inaccurate information in the Software or contact us.

8. Children

The Software is not directed to children under 14. If you are a minor, use the Software only with a guardian’s consent.

9. Policy changes

We may update this Policy as the product evolves. Material changes, such as collecting a new category of data, will be prominently announced in the Software and require renewed consent.

10. Contact us

Questions, complaints, or suggestions about this Policy may be sent to onesteptomu@gmail.com.