Information We Collect
Account Information
(Unencrypted)
- •Email address
- •Display name
- •Profile photo (optional)
- •Date of birth (for age verification)
- •Language preference
Encrypted Content
(We Cannot Access)
- Post text
- Photos and videos you share
- Comments on posts
- Reaction emojis
- Group names and descriptions
- Notification content
Automatically Collected Information
- •Device type and operating system
- •Browser type and version
- •IP address (logged for security, then discarded)
- •Session information
- •Feature usage patterns
- •Error logs and crash reports
Payment Information
Payments are collected and processed by Stripe. We receive only subscription status, billing cycle, and payment method type (e.g., "Visa ending in 1234"). We never see your full payment card details.
How We Use Your Information
To Provide the Service
Create and manage your account, authenticate via magic links, store and transmit encrypted content, display profile information, process notifications, and enable group functionality.
To Process Payments
Manage your subscription through Stripe, send billing notifications, and handle refunds and cancellations.
To Improve the Service
Analyze aggregated usage patterns (no individual tracking), debug errors, improve performance, and develop new features based on usage trends.
To Ensure Security
Detect and prevent fraud and abuse, enforce our Terms of Service, and respond to legal requests when required.
To Communicate with You
Send transactional emails (magic links, billing), respond to support requests, send important announcements, and marketing emails (only if you opt in).
What We Never Do
- We don't read your encrypted content (we can't)
- We don't sell your data to anyone
- We don't use your data for advertising
- We don't train AI models on your content
- We don't share your data with data brokers
End-to-End Encryption
How It Works
- 1Your Keys: You have a unique encryption keypair generated on your device
- 2Group Keys: Each group has a symmetric encryption key shared only with members
- 3Content Encryption: All posts, comments, and media are encrypted before leaving your device
- 4Our Role: We store only encrypted ciphertext—we cannot decrypt it
What This Means
- Your content is encrypted before it reaches our servers
- We store only scrambled, unreadable data
- Only you and your group members can decrypt the content
- Even if compelled by law, we cannot provide plaintext content
- If you lose your encryption keys, we cannot recover your content
Encryption Limitations
- •Metadata is not encrypted (who sent what, when, and to which group)
- •Profile information is not encrypted (so other users can see it)
- •Some features (like search) are limited by encryption
How We Store Your Data
Infrastructure
Hosted on Cloudflare's global network with enterprise-grade security certifications. Data stored in Cloudflare D1 (database), R2 (media), and KV (cache). Data may be replicated globally for performance.
Encryption at Rest
Cloudflare encrypts all stored data at rest. Your content is double-encrypted: once by you (E2E), once by Cloudflare (infrastructure).
Data Retention
- •Active accounts: Data retained while account is active
- •Deleted accounts (grace period): Encrypted data retained for 7 days, then destroyed
- •Deleted accounts (immediate): Encryption keys destroyed immediately, making data unrecoverable
- •Legal holds: May retain data if legally required
How We Share Your Data
With Other Users
Your display name and profile photo are visible to your group members. Your posts, comments, and reactions are visible to group members (after decryption).
With Service Providers
We share minimal data with trusted third parties:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare | Hosting, CDN, infrastructure | Global |
| Stripe | Payment processing | USA |
| Resend | Transactional email | EU |
| Plausible | Privacy-friendly analytics | EU |
| Sentry | Error tracking | USA |
All providers have Data Processing Agreements and are GDPR compliant.
For Legal Reasons
We may disclose information if required by law: to comply with legal process, to protect rights, property, or safety, in connection with fraud investigation, or to enforce our Terms.
Important: Due to end-to-end encryption, we can only provide account information, metadata, and encrypted content (which is useless without decryption keys). We cannot provide decrypted content.
Business Transfers
If Snugg is acquired or merged, your data may transfer to the new owner. You will be notified and given options including account deletion.
Your Privacy Rights
Under GDPR and other data protection laws, you have the following rights:
Right to Access
Request a copy of all personal data we hold about you. Exercise via Settings > Export Data.
Right to Rectification
Correct inaccurate personal data. Exercise via Settings > Edit Profile.
Right to Erasure
Delete your account and all associated data. Exercise via Settings > Delete Account.
Right to Data Portability
Export your data in standard formats (JSON, media files). Exercise via Settings > Export Data.
Right to Restrict Processing
Limit how we process your data. Contact us to exercise this right.
Right to Object
Object to certain types of processing, particularly for marketing.
Right to Withdraw Consent
Withdraw consent for optional features. Delete account to fully withdraw consent.
Right to Lodge a Complaint
File a complaint with your data protection authority. EU citizens: Contact your national DPA. UK citizens: Information Commissioner's Office (ICO).
To Exercise Your Rights
Most rights can be exercised in Settings. For complex requests, email privacy@snugg.social. We respond within 30 days.
Data Security
Technical Measures
- End-to-end encryption using TweetNaCl (audited cryptography library)
- TLS 1.3 for all connections
- Encryption keys stored securely on your device
- Regular security audits
- Secure session management
Your Responsibilities
- •Protect your email account (used for authentication)
- •Don't share magic links with others
- •Review active sessions regularly
- •Set up account recovery options
- •Report security issues to security@snugg.social
Data Breach Notification
If a breach occurs that affects your personal data, we will notify you within 72 hours, notify relevant data protection authorities, and provide guidance on protective measures.
International Data Transfers
Snugg uses Cloudflare's global network. Your data may be stored and processed in multiple countries. All transfers comply with GDPR requirements.
- •Cloudflare provides appropriate safeguards (Standard Contractual Clauses)
- •Data Processing Agreements in place with all processors
- •Transfers necessary for service performance
Children's Privacy
Snugg is only for users 16 years and older. We do not knowingly collect data from children under 16. We verify age at signup via date of birth.
If you believe your child under 16 has created an account, contact us immediately at privacy@snugg.social. We will delete the account and data.
Cookies and Tracking
Essential Cookies
We use minimal cookies necessary for the Service: session cookies (authentication), security cookies (CSRF protection), and preference cookies (language selection).
Analytics
We use Plausible Analytics (privacy-friendly, GDPR compliant). No cookies or personal identifiers. Anonymized aggregate data only. No cross-site tracking.
Do Not Track
We respect Do Not Track signals and don't track users across websites.
California Privacy Rights (CCPA)
If you're a California resident, you have additional rights:
Important: We do not sell your personal information. Ever.
Changes to This Privacy Policy
We may update this policy from time to time. We will notify you of material changes by:
- •Email to your registered address
- •Prominent notice in the Service
- •At least 30 days before changes take effect
Continued use of Snugg after changes constitutes acceptance. If you don't agree, you should delete your account before changes take effect.
Contact Us
For privacy questions or to exercise your rights, reach out to us.
This Privacy Policy was last updated January 2025.