Privacy Policy

Section 1Data Collected via the Service and SDK

When developers use the Service or integrate the SnappySnag SDK into mobile/web applications, the Service collects the following categories of data:

• Developer Account Information: Name, email address, password hashes, project settings, and team collaborator configurations.
• Feedback Screenshots & User Annotations: Captured app UI screens, drawing annotations (red pen markings), mosaic/blur masked areas, pin coordinate locations (normalized x/y vectors), and itemized feedback notes attached to pins.
• User Account Information (Optional / Opt-Out Supported): End-user identifier (reporter_user_id) and email address (reporter_email) passed by the host app for diagnostic follow-up. Users have full control to uncheck account sharing before submitting feedback, sending the report 100% anonymously.
• Diagnostic & Device Telemetry: App package name, screen identifier/signature, device model, operating system name and version, and anonymized installation UUID (used strictly for rate limiting and duplicate detection).
• External Notification Integration Data (Slack & Discord Webhooks): Incoming Webhook URLs supplied when developers enable real-time team notifications within Project Settings. These URLs are treated with utmost confidentiality and are strongly encrypted at rest in the database using industry-standard AES-256-GCM algorithms.
• Billing & Subscription Data: Plan status, transaction records, and invoice identifiers (all payment processing is handled by Lemon Squeezy, LLC; no credit card numbers touch the Service's servers).
• Bot Prevention & Security Telemetry (Cloudflare Turnstile): To safeguard sign-in, registration, and password recovery against automated spam and brute-force credential stuffing, the Service utilizes Cloudflare Turnstile. Turnstile processes non-identifying technical metadata (such as browser capabilities, HTTP request headers, and challenge responses) strictly to determine human interaction without tracking personal browsing history or deploying persistent user tracking cookies.
• Website Analytics & Traffic Telemetry (Google Analytics): To analyze site interactions, evaluate documentation efficacy, and improve overall developer user experience, the Service employs Google Analytics (GA4) provided by Google LLC. Google Analytics uses cookies to collect anonymous, aggregated traffic and usage data without identifying individual personal identities. Users may opt out of data collection by configuring browser cookie permissions or by installing the Google Analytics Opt-out Browser Add-on. For further details, please review Google's Privacy Policy.

Section 2Purpose of Data Usage

• To capture, process, and display bug reports and user feedback on the developer project dashboard.
• To analyze UI layouts, error logs, and screenshots using automated AI diagnostics to summarize issues and generate actionable bug fixes.
• To dispatch real-time instant alerts (issue summary, category, severity rating, and authenticated deep-links directly to ticket views) to developer-configured Slack or Discord channels. *To preserve end-user privacy, raw screenshot graphics are never attached directly to external chat payloads; only secure links pointing to the authenticated dashboard are provided.
• To allow developers to reach back to users who consented to sharing their email address for customer support and issue resolution.
• To enforce fair use rate limits, prevent automated spam submissions, block brute-force account attacks, and maintain platform stability and security.

Section 3AI Processing & Strict Model Non-Training Guarantee

The Service leverages advanced generative AI models (such as Google Gemini API via enterprise endpoints) to provide intelligent issue categorization, priority assessment, automated code-fix suggestions, and interactive ticket consultation / version synchronization.

Section 4Privacy by Design: Automatic Masking & Consent Controls

The SnappySnag SDK incorporates multi-layered privacy safeguards to protect sensitive end-user information:

• Automatic Sensitive Field Masking: Passwords, credit card numbers, email addresses, phone numbers, postal codes, and profile avatars are automatically detected and masked with mosaic blur prior to capture.
• Widget Tree Hierarchy Opt-Out Control: Via the SDK initialization option (enableWidgetTree: false), developers can completely prevent the extraction of UI layout hierarchies across the application. In this mode, AI analysis executes securely based solely on screenshot visual cues and user memos.
• Pre-Submission Privacy Confirmation: In user feedback mode, users are presented with a dedicated confirmation modal verifying that sensitive information is properly blurred.
• Explicit Consent for Account Sharing: Users can toggle a checkbox to choose whether to share their account email/ID or submit feedback completely anonymously.
• On-Device Offline Draft Protection: In the event of network disruption during submission or when an unfinished capture is dismissed, draft contents (annotated images and memos) are temporarily preserved strictly within the device's local sandbox storage (such as SharedPreferences). No draft data is transmitted to external servers until the user explicitly initiates submission, remaining exempt from App Store and Google Play data collection disclosures as non-transmitted on-device processing.

Section 5Data Retention, Account Deletion & Lifecycle Auditing

Feedback logs and screenshot assets are stored securely and retained according to the active subscription tier:

• Free Plan: Feedback logs and screenshot media are automatically and permanently purged after 30 days.
• Pro Plan: Feedback logs are retained indefinitely during active subscription and preserved for a 14-day grace period upon cancellation.
• Immediate Deletion of Personal Data: When an account is deleted via the dashboard, all personally identifiable information (PII), authentication credentials, owned projects, API keys, uploaded screenshots, and feedback logs are immediately and irreversibly purged from the Service's active databases.

Section 6Data Subject Rights (Self-Management, Data Export & Deletion)

In strict compliance with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act / CPRA, and the Act on the Protection of Personal Information (APPI) of Japan, the Service fully respects and enforces your rights regarding personal data:

• Right of Access & Data Portability (Data Export): Users can directly download screenshot image assets (both numbered pin overlay graphics and pristine raw captures) per ticket directly to their local devices from the web dashboard. Feedback notes, pin item annotations, AI diagnostics, and device metadata can be exported directly to external developer repositories via our GitHub Issue integration, enabling permanent retention outside the platform. Users may also request a comprehensive archive of their account profile and project configurations in a structured, machine-readable format (JSON/CSV) by contacting support@snappysnag.com.
• Right to Erasure ("Right to be Forgotten"): Users retain absolute ownership to permanently delete their account at any time via Account Settings ("Danger Zone") on the dashboard. Upon triggering account deletion, all personal data, authentication credentials, owned projects, API keys, screenshot blobs, feedback logs, and AI conversation histories are immediately and irreversibly erased from production databases and active cloud object storages.
• Right to Rectification & Restriction of Processing: Users can update or rectify their name, email, and security settings directly within the account dashboard or request restrictions on data processing via customer support.
• End-User Privacy Requests on Behalf: Host app developers who receive deletion requests from their end-users can independently delete corresponding feedback tickets from the SnappySnag dashboard or request selective purging of logs associated with specific reporter_user_id records by contacting our support team.