Privacy Policy
Last updated: 25 August 2026
Who we are
Snixt is operated by Individual Entrepreneur Kozlov Dmitrii Vyacheslavovich (HVHH 20272245), registered in the Republic of Armenia (Yerevan, Movsesa Khorenaci 26a, apt. 201). Privacy contact: support@snixt.com.
What we collect
When you sign up, we collect your email address and (optionally) your display name and avatar. When you sign in with Apple or Google, we receive an authentication identifier from those providers; we do not see your password. When a screenshot enters Snixt — either because you saved or shared it yourself, or because you turned on gallery auto-sync (see "Gallery auto-sync" below) — we store the image, the OCR-extracted text, and the AI-derived metadata (title, summary, content type, tags, action items) in your account. We also store your subscription state (free / Pro / Premium, any bulk-credit balance, and the renewal date), your language and notification preferences, and an Expo push token if you enable reminders. Separately, the app sends crash diagnostics and product-analytics events — see "Analytics and crash reporting" below.
How we use your data
Your data is used solely to provide and improve the Snixt service: storing your saved items, displaying them in the feed and search, running AI analysis, sending the reminders you have asked for, gating subscription features, helping us debug crashes, and measuring how the app is used so we can improve it. We do not sell, rent, or share your personal data with third parties for marketing purposes.
Third-party processors
The following processors receive specific subsets of your data, and only what is needed for their role: • OpenAI — receives the image and OCR text for each item you save, plus a system prompt asking it to extract a title, summary, content type, tags, and action items. Models used: gpt-4o-mini and text-embedding-3-small. Per OpenAI's API data usage policy, customer data submitted via the API is retained for up to 30 days for abuse and misuse monitoring and is then deleted. OpenAI does not use API data to train its models. • Supabase — hosts our database, authentication, file storage, and edge functions. All your stored data sits in Supabase's EU region. Supabase has SOC 2 and HIPAA-eligible controls. • RevenueCat — receives your anonymized RevenueCat App User ID and subscription events (purchase / renewal / cancellation / trial start). RevenueCat does NOT receive your email. • Apple App Store / Google Play — process the actual subscription payment. We never see your card information. • Sentry — receives error and performance events for crash diagnostics. Before an event leaves your device we strip anything that looks like an email address, a JSON Web Token, an Authorization header, or an auth token in a URL, from both the event and its breadcrumbs. Your account UUID is deliberately NOT stripped: it is attached to crash reports so we can group and diagnose them, and it is not accompanied by your email or your name. Signing out removes it from subsequent reports. • PostHog (EU Cloud) — receives product-analytics events: a fixed, pre-declared list of app events (app open, sign-up, sign-in and sign-out, onboarding steps, item saved, item opened, screenshot shared into the app, AI queued and processed, monthly limit reached, paywall viewed, purchase and restore started / succeeded / failed, search performed and search result opened, action completed, gallery synced, reminder opened, feedback opened and sent), automatically captured screen-view events, and technical context (app version and build, OS name and version, device type, screen size), plus the IP address the request arrives from. Each event also carries your current plan (free / Pro / Premium), your platform and your app version, so we can tell whether a problem affects one group of people or everyone. Once you are signed in, these events are associated with your account UUID. Our servers send a second, smaller set of events for work that happens while the app is closed: a processing job starting, succeeding or failing; a batch being submitted; a subscription renewing, being cancelled, refunded or expiring; bulk credits being granted. These carry your account UUID so they line up with the events from your device. Our servers also send counters for each AI request — the model name, how many tokens went in and out, how long it took, and what it cost us — so we can see what the service costs to run. These counters contain no content: the prompt we send to the model and the answer it returns are deliberately never included. PostHog does not receive your email, your name, your screenshots, your OCR text, or your AI metadata. • Expo Push Service — receives your Expo push token and the body of any reminder we send you, for delivery to your device. • Apple / Google identity providers — when you sign in with them, they verify your credentials and return us an authentication token.
AI processing details
AI requests run inside our edge functions on Supabase, not on your device. The image you saved is sent to OpenAI for one-shot analysis; the response is parsed into structured fields and stored in your account. The 30-day retention applies to the request payload OpenAI receives — that is how long they may keep the image for abuse monitoring before deleting it. We do not retain a separate copy with OpenAI; the image you uploaded sits in our Supabase storage with row-level security scoped to your account.
Gallery auto-sync
Gallery auto-sync is OFF by default, must be turned on by you, and is available on paid plans only. If you enable it (Profile → Gallery sync) and grant the operating-system photo-library permission, Snixt picks up new screenshots from your device and uploads them to your account automatically — including in the background, whenever the operating system chooses to run our background task while the app is closed. The app limits what this can reach: • Only screenshots are picked up. Where your device exposes a dedicated screenshots album, the scan is scoped to that album. Where it does not, the app reads the photo list and keeps an asset only if the operating system explicitly marks it as a screenshot — anything the OS does not label that way is discarded rather than uploaded. Either way, a regular photo is never sent to us. • Only screenshots created AFTER the moment you turned the feature on. Your existing gallery is never back-filled. • Each screenshot picked up this way goes through exactly the same upload and AI pipeline as one you save by hand, and counts against your monthly AI allowance. You can turn auto-sync off at any time on the same screen; that also unregisters the background task. Revoking the photo-library permission in your device settings stops it as well. Screenshots that were already imported stay in your account until you delete them.
Analytics and crash reporting
Crash reporting (Sentry) and product analytics (PostHog) start when the app starts, in released builds. There is currently no in-app switch to turn them off, and this policy does not claim one: if you do not want to send this data, do not use the app. We do not use these events for advertising, and we do not sell them. Signing out clears your account UUID from both — crash reports and analytics events sent afterwards are no longer associated with your account.
This website
snixt.com is a marketing site. Two things on it touch your data, and neither is the app. • The launch list. If you enter your email address, we store it — along with the language you were reading in and which form you used — in the same Supabase database in the EU that the app uses. We write to you exactly once, on the day the app is available, and delete the address afterwards. You can ask us to remove it sooner at any time by writing to support@snixt.com. We do not sell it, share it, or send anything else to it. • Anonymous traffic measurement. The site reports page views to PostHog (EU Cloud), so we can see which pages people read and where they arrive from. It runs in PostHog's cookieless mode: the site sets no cookies whatsoever, stores nothing in your browser for analytics, and creates no identifier that follows you between sites or between visits — visitors are counted from a short-lived hash computed on PostHog's own servers. What is sent is the page address, the page you came from, your browser, operating system and screen size, and the country your request arrives from. It does not include your email address, your name, or anything you type into the form beyond the fact that a submission happened. The only thing this site keeps in your browser is the language you chose, so it opens in that language next time. Nothing else is stored, which is also why there is no cookie banner: there is nothing non-essential to ask about.
Data storage and security
Your saved items, OCR text, and AI metadata live in Supabase, in the EU region. Files (images) live in Supabase Storage with row-level-security policies that prevent another user from listing or downloading them. Passwords are hashed by Supabase Auth using industry-standard algorithms. Server-side secrets (such as the OpenAI API key) are stored in Supabase secrets and are never exposed to the client. Encrypted database backups may be retained for up to 35 days before they rotate.
Push notifications
If you enable reminders, we use the Expo Push Notification Service to deliver them. The notification payload is generated by our backend (e.g. "Recipe Carbonara — try tonight at 19:00") and sent to your device through Expo. You can disable notifications at any time in the app (Profile → Reminders → Notifications switch) or in your device settings.
Your rights
You can: access your data (Profile → Account → Export My Data, returns a JSON bundle of everything we hold for you); correct your display name, language, or notification settings (Profile → respective sections); delete your account in-app (Profile → Account → Delete Account; the deletion runs server-side via auth.admin.deleteUser and cascades to all your items, embeddings, action items, collections, push tokens, and storage objects within minutes); withdraw consent for AI processing by turning gallery auto-sync off (if you enabled it) and no longer saving items (existing items keep working; nothing new is sent to OpenAI). You can always also email support@snixt.com and we will respond within 30 days. If you are in the EEA, UK, or Switzerland, the legal basis for our processing is the contract you accept by using Snixt. You also have the rights to lodge a complaint with your local data-protection authority. If you are a California resident, you have the rights described in the CCPA, including the right to know, the right to delete, and the right not to be discriminated against for exercising those rights.
International transfers
Your primary data is stored in the EU, and PostHog is configured to use its EU cloud region. Some of our processors (OpenAI, Sentry, RevenueCat) operate from the United States. Where data is transferred outside the EEA, we rely on Standard Contractual Clauses or the EU-US Data Privacy Framework as appropriate.
Data retention
We keep your data for as long as your account is active. After account deletion, your account record, items, embeddings, action items, collections, and push tokens are removed from production within 30 days; encrypted backups rotate within 35 days. The OpenAI 30-day retention described above applies independently to the request payloads OpenAI received.
Children
Snixt is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please email support@snixt.com and we will delete the information.
Changes to this policy
We may update this policy from time to time. We will notify you of material changes via in-app notification or email. Continued use of the app after a material change constitutes acceptance.
Contact
For privacy-related questions: support@snixt.com Individual Entrepreneur: Kozlov Dmitrii Vyacheslavovich · HVHH 20272245 · Yerevan, Movsesa Khorenaci 26a, apt. 201, Republic of Armenia