Your data
Where your work actually is.
A full copy on the machine in front of you, a second one in your workspace, and neither of them is “the cloud”.
Where the work lives
In two complete places, and the first one is the machine in front of you.
On your machine
First, and always.
Every module is written to your browser's own database before anything else happens, which is why the app opens and works before it's talked to us at all. On a train, on a location with no bars, on a plane: that isn't a degraded mode, it's the normal one.
In your workspace
Second, and completely.
From there it syncs to a database we run, and back down to every other machine on the production. Both copies are whole, so losing either one still leaves you working. It's also what lets you close a laptop in an edit suite and open the same call sheet on a phone at a location.
The rest of it
What leaves my machine, and when?
Four things, and this is all of them.
Signing in Your email address and password go to our authentication service. Once. After that a stored session keeps you signed in, including offline. Both products.
The licence check A workspace identifier and a device identifier go out, and a short signed statement comes back saying the licence is valid, which major version it covers and until when. Nothing about your productions travels either way. Both products.
Sync Productions, shots, storyboard frames, schedules, call sheets and budgets travel up to your workspace and back down to your team. PreShot only.
Inviting or sharing The email address you type is stored with the invitation until it's accepted or you withdraw it, which is also why an unaccepted invitation holds a seat. Pro only, since Standard has nobody to invite.
What is that device identifier?
A random value your browser generates the first time the app runs, kept so a licence issued for one install can't be copied to another. It isn't a hardware fingerprint, it isn't derived from anything about you, and clearing site data replaces it with a new one.
What do you never hold?
No card number, no billing address, no tax or VAT number. Payment happens on Paddle's own checkout, and Paddle is the merchant of record on every sale, so whatever your tax authority needs is Paddle's record to keep rather than ours. None of it reaches this website or our servers.
No analytics profile either. This website sets no cookies and carries no third-party trackers.
Do you track whether my crew opened the call sheet?
No, and we turned it down rather than never having it. Our mail provider offers open and click tracking, and PreShot throws those events away.
An open is a tracking pixel. It's blocked by default in Apple Mail and most company inboxes, so it misses the careful reader and counts the one whose software loaded the image on its own. Put a number like that next to the confirmations and it makes the real one look optional.
So there are two things PreShot knows: whether the email reached the address, which your provider tells us, and whether the person ticked the box. The tick is someone saying they've read it and they'll be there. A call sheet isn't a newsletter, and your crew aren't being watched.
What do you hold, then?
A “we never store” list on its own invites you to conclude the answer is “nothing”, which isn't true of anything that syncs. So: your email address, so you can sign in and be invited. A display name, because the activity log attributes changes to a person and “someone edited the budget” is no good on a shoot day. Your productions, as rows in your workspace. And any invitation you've sent, until it's accepted or withdrawn.
On Pro, one more: the crew book. Those are names and numbers belonging to people who never signed up here, so they get their own rules — see {crewBook}.
What happens if I clear my browser data?
The local copy goes. So does opening the app in a different browser profile, because that's a different store and it starts empty.
That costs you a sync and nothing else: sign in again and your workspace fills the machine back up. It's the whole reason the second copy exists.
Can a browser delete my work on its own?
Yes. Under disk pressure a browser can discard a site's storage without asking. PreShot asks to be exempted from that on every launch, and installing it properly makes a browser far likelier to agree, but nothing promises it and a browser that agrees can change its mind. It's a mitigation rather than a guarantee.
Which is what the workspace copy is for: the machine losing its store is a sync, not a loss. Backups cover the rest — a single file holding your whole library, every production, folder, preset and setting, not one export per job. Restoring it puts all of them back. You keep the file, and we never see it.
The part nobody advertises
Your work is not encrypted at rest.
The local copy sits on your disk in the clear, and the server copy is readable by us. That's a trade rather than an oversight: end-to-end encryption and the things you're buying — two people editing one production, a call sheet you hand to a gaffer outside the team — don't work together.
If your work can't be readable by a supplier at all, that's a real requirement and this isn't the tool for it. Say so before you buy rather than after, and we'll tell you straight whether we can meet it.
On your machine
The local copy is a database file on your disk, stored in the clear. Anyone who can log into your computer account can read it, with or without PreShot.
Your operating system's own full-disk encryption is what protects it: FileVault on a Mac, BitLocker on Windows. That's worth more than anything we could layer on top, and if it's already on, this is handled.
On the way to us
Every request is HTTPS, on both products, including the licence check. Nothing travels in the clear between your machine and us. This is the one of the three with no caveat attached.
On our server, in PreShot
The database decides, row by row, who may read what, and refuses to hand a production to anyone outside its workspace. That rule lives in the database itself, not in the app asking politely.
What it isn't is end-to-end encrypted. We run that database and hold its keys, so we could read your call sheet if we went looking. We don't, and the privacy policy binds us to it, but that's a promise rather than mathematics and you should know which of the two you're holding.
The privacy policy is where the commitments are written down.
Get your crew into one file.
No card. 14 days. 2 seats. Viewers are always free.