Controller and contact
Philipp Rufinatscha, Am Europlatz 2, 1120 Wien, Austria, is responsible for Snipfolio's processing of personal data. Contact support@snipfolio.app for privacy requests.
Accounts and subscriptions
We process your email, account identifier, optional name, authentication records, subscription status and purchase references to create and secure your account and provide paid features (Article 6(1)(b) GDPR). Supabase provides authentication and database storage. Email/password sign-in uses Supabase; where Google sign-in is available, Google also processes the sign-in you choose. We do not receive your Google password. Required account information is necessary to provide account-based features.
Payments and legal records
Stripe processes billing contact details, address, payment method, tax information, transaction identifiers and subscription/invoice data. We receive payment status and billing references, not your full card number. Processing is necessary for the contract and accounting/tax duties (Articles 6(1)(b) and (c)). We retain necessary accounting records for the applicable Austrian statutory period, generally seven years, and longer where a legal obligation or pending matter requires it. Terms acceptance, contract confirmations and withdrawal requests are retained as contractual evidence for applicable legal limitation periods.
Local screenshots, backup and sharing
Screenshots, OCR and markups are processed locally on your Mac until you choose cloud or sharing features. OCR uses Apple's on-device Vision framework. Optional cloud backup uploads images and collection metadata to private Cloudflare R2 storage; account and backup metadata are held in Supabase. Processing is necessary to provide the features you request (Article 6(1)(b)). A backup is not end-to-end encrypted. Selecting Share creates a link accessible to anyone who has it; links expire after seven days unless revoked earlier. Expired share objects are scheduled for deletion after eight days. Deleting local content and deleting cloud backups are separate actions. You can manage backups in the app or contact support to request cloud deletion. Avoid uploading other people's sensitive data unless you have a lawful basis.
Hosting, security and support
Cloudflare hosts the website and runs our API and storage. These services process connection details such as IP address and technical request information to deliver and protect the service. We process necessary security logs to prevent abuse and investigate incidents (Article 6(1)(f), legitimate interest in a reliable, secure service). Amazon SES in eu-north-1 sends transactional emails. Gmail receives support correspondence. Support processing is necessary for the contract or our legitimate interest in answering enquiries. Technical and support information is kept only as long as needed for its purpose, unless legal retention applies.
Browser storage and email
Essential browser storage maintains your sign-in and purchase flow. Signing out removes the session; you can clear site data in your browser. We do not use optional advertising cookies or website marketing analytics in the current site. Stripe and sign-in providers have their own essential storage on their services. Email-open and link-click tracking are disabled for all transactional Snipfolio emails. We do not insert tracking pixels or rewrite links to track engagement. Contract confirmation and withdrawal acknowledgement are sent as plain text. We do not send promotional campaigns through this purchase flow.
International processing
The R2 backup bucket is configured for EU jurisdiction and SES sends from Stockholm. Some providers operate globally, so this is not a promise that all processing occurs exclusively in the EU. Where a provider processes data outside the EEA, applicable safeguards such as adequacy decisions or EU standard contractual clauses must cover the transfer. You can request information about the safeguards used for your data. Provider privacy information: supabase.com/privacy, cloudflare.com/privacypolicy, stripe.com/privacy, aws.amazon.com/privacy, openai.com/policies/privacy-policy, policies.google.com/privacy.
Your rights
Depending on the circumstances, you can request access, correction, erasure, restriction, portability, and object to processing based on legitimate interests. You may withdraw any consent without affecting earlier lawful processing. Contact support@snipfolio.app; we may need to verify your identity. You may complain to the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Wien, https://dsb.gv.at, or your competent supervisory authority. We do not use solely automated decisions producing legal or similarly significant effects. Statutory retention may prevent immediate deletion of required billing records; this does not justify retaining unrelated screenshots indefinitely.