Privacy Policy
Last updated: 24 September 2026
Who we are
Snixt is operated by Individual Entrepreneur Kozlov Dmitrii Vyacheslavovich (HVHH 20272245), registered in the Republic of Armenia (Yerevan, Movsesa Khorenaci 26a, apt. 201). Privacy contact: support@snixt.com.
What we collect
When you sign up, we collect your email address and (optionally) your display name and avatar. When you sign in with Apple or Google, we receive an authentication identifier from those providers; we do not see your password. When a screenshot enters Snixt — either because you saved or shared it yourself, or because you turned on gallery auto-sync (see "Gallery auto-sync" below) — we store the image, the OCR-extracted text, and the AI-derived metadata (title, summary, content type, tags, action items) in your account. We also store your subscription state (free / Pro / Premium, any bulk-credit balance, and the renewal date), your language and notification preferences, and an Expo push token if you enable reminders. If you send feedback from the app (Profile → "Tell us something"), we store the text with the app version, OS version, device model, app language, theme and your plan, linked to your account, so we can reply and fix the right build; it is not shared with anyone. Separately, the app sends crash diagnostics and product-analytics events — see "Analytics and crash reporting" below.
How we use your data
Your data is used solely to provide and improve the Snixt service: storing your saved items, displaying them in the feed and search, running AI analysis, sending the reminders you have asked for, gating subscription features, helping us debug crashes, and measuring how the app is used so we can improve it. We do not sell, rent, or share your personal data with third parties for marketing purposes.
Third-party processors
The following processors receive specific subsets of your data, and only what is needed for their role: • Alibaba Cloud (Model Studio) — receives the image and OCR text for each item you save, plus a system prompt asking it to extract a title, summary, content type, tags, and action items. It also receives the stored text of a card when you ask for it in another language, for translation. Model used: qwen3.7-flash, Singapore region when we connect to Alibaba Cloud directly. Alibaba Cloud states that Model Studio does not use customer data to train or improve its models. • OpenRouter, Inc. (United States) — a routing service we use to reach the same Alibaba Cloud model when our direct connection to Alibaba Cloud is unavailable. While we use it, the image, OCR text and system prompt for screenshot analysis pass through OpenRouter on their way to Alibaba Cloud. We restrict the route to Alibaba Cloud and to endpoints that do not use request data for training. OpenRouter states that it does not use API content to train models and does not keep prompts or responses beyond routing them; it records request metadata such as token counts and timing. Through OpenRouter, the Alibaba Cloud region is chosen by the route and may be outside Singapore. • OpenAI — receives the OCR text and the stored card content of your saved items for enrichment and semantic search, plus a system prompt. Models used: gpt-4.1-mini and text-embedding-3-small. Card translation moved to Alibaba Cloud; if we switch it back — a fallback we keep configured — the card text goes to OpenAI instead. If we switch screenshot analysis back to OpenAI — a fallback we keep configured — the image goes to OpenAI instead. Per OpenAI's API data usage policy, customer data submitted via the API is retained for up to 30 days for abuse and misuse monitoring and is then deleted. OpenAI does not use API data to train its models. • Supabase — hosts our database, authentication, file storage, and edge functions. All your stored data sits in Supabase's EU region. Supabase has SOC 2 and HIPAA-eligible controls. • RevenueCat — receives your anonymized RevenueCat App User ID and subscription events (purchase / renewal / cancellation / trial start). RevenueCat does NOT receive your email. • Apple App Store / Google Play — process the actual subscription payment. We never see your card information. • Sentry — receives error and performance events for crash diagnostics. Before an event leaves your device we strip anything that looks like an email address, a JSON Web Token, an Authorization header, or an auth token in a URL, from both the event and its breadcrumbs. Your account UUID is deliberately NOT stripped: it is attached to crash reports so we can group and diagnose them, and it is not accompanied by your email or your name. Signing out removes it from subsequent reports. • PostHog (EU Cloud) — receives product-analytics events: a fixed, pre-declared list of app events (app open, sign-up, sign-in and sign-out, onboarding steps, AI permission given, declined or withdrawn, item saved, item opened, screenshot shared into the app, AI queued and processed, monthly limit reached, paywall viewed, purchase and restore started / succeeded / failed, search performed and search result opened, a card tapped in the feed and a card opened, an action button on a card tapped, a screenshot opened full-screen, a tag opened as a search, an element extracted from a multi-item card, action completed, gallery synced, reminder opened, feedback opened and sent), automatically captured screen-view events, and technical context (app version and build, OS name and version, device type, screen size), plus the IP address the request arrives from. Each event also carries your current plan (free / Pro / Premium), your platform and your app version, so we can tell whether a problem affects one group of people or everyone. Once you are signed in, these events are associated with your account UUID. Our servers send a second, smaller set of events for work that happens while the app is closed: a processing job starting, succeeding or failing; a batch being submitted; a subscription renewing, being cancelled, refunded or expiring; bulk credits being granted. These carry your account UUID so they line up with the events from your device. Our servers also send counters for each AI request — the model name, how many tokens went in and out, how long it took, and what it cost us — so we can see what the service costs to run. These counters contain no content: the prompt we send to the model and the answer it returns are deliberately never included. PostHog does not receive your email, your name, your screenshots, your OCR text, or your AI metadata. • Expo Push Service — receives your Expo push token and the body of any reminder we send you, for delivery to your device. • Apple / Google identity providers — when you sign in with them, they verify your credentials and return us an authentication token.
AI processing details
AI requests run inside our edge functions on Supabase, not on your device. The image you saved is sent to Alibaba Cloud Model Studio — directly, or through OpenRouter while we use that route — for one-shot analysis; the response is parsed into structured fields and stored in your account. The resulting text is sent to OpenAI for the embedding used by semantic search, and to Alibaba Cloud for card translation if you ask for it. OpenAI's 30-day retention applies to the payloads OpenAI receives. We do not retain a separate copy with any of these providers; the image you uploaded sits in our Supabase storage with row-level security scoped to your account. Nothing is sent to an AI provider before you allow it. The app asks at the end of onboarding, or at your first save if you skipped that step. Without your permission, screenshots are saved but not analyzed, search works on the text of your cards only, and no card text is sent for translation or completion. You can give or withdraw the permission at any time in Profile → AI and your data; withdrawing stops new sends and leaves cards already analyzed as they are.
Gallery auto-sync
Gallery auto-sync is OFF by default, must be turned on by you, and is available on paid plans only. If you enable it (Profile → Gallery sync) and grant the operating-system photo-library permission, Snixt picks up new screenshots from your device and uploads them to your account automatically — including in the background, whenever the operating system chooses to run our background task while the app is closed. The app limits what this can reach: • Only screenshots are picked up. Where your device exposes a dedicated screenshots album, the scan is scoped to that album. Where it does not, the app reads the photo list and keeps an asset only if the operating system explicitly marks it as a screenshot — anything the OS does not label that way is discarded rather than uploaded. Either way, a regular photo is never sent to us. • Only screenshots created AFTER the moment you turned the feature on. Your existing gallery is never back-filled. • Each screenshot picked up this way goes through exactly the same upload and AI pipeline as one you save by hand, and counts against your monthly AI allowance. You can turn auto-sync off at any time on the same screen; that also unregisters the background task. Revoking the photo-library permission in your device settings stops it as well. Screenshots that were already imported stay in your account until you delete them.
Analytics and crash reporting
Crash reporting (Sentry) and product analytics (PostHog) start when the app starts, in released builds. There is currently no in-app switch to turn them off, and this policy does not claim one: if you do not want to send this data, do not use the app. We do not use these events for advertising, and we do not sell them. Signing out clears your account UUID from both — crash reports and analytics events sent afterwards are no longer associated with your account.
This website
snixt.com is a marketing site. Two things on it touch your data, and neither is the app. • The launch list. If you enter your email address, we store it — along with the language you were reading in and which form you used — in the same Supabase database in the EU that the app uses. We write to you exactly once, on the day the app is available, and delete the address afterwards. You can ask us to remove it sooner at any time by writing to support@snixt.com. We do not sell it, share it, or send anything else to it. • Anonymous traffic measurement. The site reports page views to PostHog (EU Cloud), so we can see which pages people read and where they arrive from. It runs in PostHog's cookieless mode: the site sets no cookies whatsoever, stores nothing in your browser for analytics, and creates no identifier that follows you between sites or between visits — visitors are counted from a short-lived hash computed on PostHog's own servers. What is sent is the page address, the page you came from, your browser, operating system and screen size, and the country your request arrives from. It does not include your email address, your name, or anything you type into the form beyond the fact that a submission happened. The only thing this site keeps in your browser is the language you chose, so it opens in that language next time. Nothing else is stored, which is also why there is no cookie banner: there is nothing non-essential to ask about.
Data storage and security
Your saved items, OCR text, and AI metadata live in Supabase, in the EU region. Files (images) live in Supabase Storage with row-level-security policies that prevent another user from listing or downloading them. Passwords are hashed by Supabase Auth using industry-standard algorithms. Server-side secrets (such as the OpenAI API key) are stored in Supabase secrets and are never exposed to the client. Encrypted database backups may be retained for up to 35 days before they rotate.
Push notifications
If you enable reminders, we use the Expo Push Notification Service to deliver them. The notification payload is generated by our backend (e.g. "Recipe Carbonara — try tonight at 19:00") and sent to your device through Expo. You can disable notifications at any time in the app (Profile → Reminders → Notifications switch) or in your device settings.
Your rights
You can: access your data (Profile → Account → Export My Data, returns a JSON bundle of everything we hold for you); correct your display name, language, or notification settings (Profile → respective sections); delete your account in-app (Profile → Account → Delete Account; the deletion runs server-side via auth.admin.deleteUser and cascades to all your items, embeddings, action items, collections, push tokens, and storage objects within minutes; if you signed in with Apple, it also revokes Snixt's access to your Apple ID); withdraw the permission for AI processing in Profile → AI and your data (cards already analyzed keep working; nothing new is sent to our AI providers). You can always also email support@snixt.com and we will respond within 30 days. If you are in the EEA, UK, or Switzerland, the legal basis for our processing is the contract you accept by using Snixt. You also have the rights to lodge a complaint with your local data-protection authority. If you are a California resident, you have the rights described in the CCPA, including the right to know, the right to delete, and the right not to be discriminated against for exercising those rights.
International transfers
Your primary data is stored in the EU, and PostHog is configured to use its EU cloud region. Some of our processors (OpenAI, OpenRouter, Sentry, RevenueCat) operate from the United States, and Alibaba Cloud processes screenshot analysis and card translation in Singapore when we connect to it directly; through OpenRouter, the region is chosen by the route. Where data is transferred outside the EEA, we rely on Standard Contractual Clauses or the EU-US Data Privacy Framework as appropriate.
Data retention
We keep your data for as long as your account is active. After account deletion, your account record, items, embeddings, action items, collections, and push tokens are removed from production within 30 days; encrypted backups rotate within 35 days. The OpenAI 30-day retention described above applies independently to the payloads OpenAI received. Alibaba Cloud does not publish a fixed retention window; see their Model Studio privacy notice. OpenRouter does not keep the content of requests beyond routing them.
Children
Snixt is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please email support@snixt.com and we will delete the information.
Changes to this policy
We may update this policy from time to time. We will notify you of material changes via in-app notification or email. Continued use of the app after a material change constitutes acceptance.
Contact
For privacy-related questions: support@snixt.com Individual Entrepreneur: Kozlov Dmitrii Vyacheslavovich · HVHH 20272245 · Yerevan, Movsesa Khorenaci 26a, apt. 201, Republic of Armenia