Privacy Policy

Effective date: September 18, 2026 · Version 2026-09-18-1 · Terms of Service

1. Scope and who we are

1.1 This Privacy Policy describes how Snailsy ("Snailsy," "we," "us," "our") collects, uses, discloses, and protects personal information when you use the Snailsy website at www.snailsy.com and any successor domain, the installable Snailsy web app, the Snailsy browser extension, and related services (together, the "Service"). It is part of, and uses terms defined in, the Terms of Service.

1.2 Snailsy is the controller (or "business") responsible for personal information processed through the Service, except that Stripe is an independent controller of the payment and identity information it collects (see Section 7), and Makers are independently responsible for anything they do with information about their Buyers outside the Service.

1.3 "Personal information" means information that identifies, relates to, describes, or could reasonably be linked with you. It does not include information that has been de-identified or aggregated so that it can no longer reasonably be linked to you.

2. Information we collect

2.1 Information you give us

• Account: email address (used to sign in and to send service messages; never shown publicly), password (stored only as a salted hash by Supabase Auth; we never see it), username, and the version and time at which you accepted the Terms and this Policy.
• Signup attribution: if your signup link included a ref parameter or standard UTM tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), we store those values on your member record so we can tell which posts, partners, and campaigns bring people who join. A short-lived first-party attribution cookie or storage value (snailsy_attr, at most 30 days) may hold the same tags until signup so we can attach them to the new account.
• Profile: anything you add to your showcase, such as an emoji avatar, headline, bio, and links to your other sites or profiles. All of it is public.
• Creations and content: titles, one-liners, stories, tags, the AI tools you say you used, demo and code links, prices, the images and clips you upload, and the deliverables you attach (files, private links, or text). Published creations are public; deliverables are private to you and to members who got or bought them; drafts are private to you.
• Interactions: votes, saves, comments, comment loves, follows, and reports (including any reason you give).
• Purchases and sales: which creation, the amount, the platform fee, the status of the purchase, and Stripe's session, payment, and connected-account identifiers. We do not collect card numbers, bank details, or government ID; Stripe does.
• Communications: emails you send us (support, appeals, legal notices, deletion requests) and our replies.
• The Trail (optional): if you opt in, your digest preference, and if you set it, a timezone for Monday-morning send. Default is off. See below.
• Extension notes: if you use the browser extension to leave a Snail Trail, the note, its tags, and the site or normalized page address it is anchored to.

The Trail (weekly digest)

The Trail is Snailsy's optional weekly email: short notes on creations and product. It is off by default. We only send it if you turn it on. We use the email on your account. We do not use The Trail list for third-party ads.

How to opt out. Turn off The Trail in settings, or use the unsubscribe link in any Trail email. Unsubscribing records that you left and turns the digest off. Essential service messages (security, receipts, policy updates, moderation) may still send while you have an account — see the Terms.

What we store for this. Your digest preference (on or off); if you unsubscribe, the time you unsubscribed; and, if you set it, a timezone so we can aim Monday sends at your local morning. You can clear timezone in settings. These stay with your account and follow the same deletion schedule as other account fields (plus the backup window in the retention table).

2.2 Information collected automatically

• Rate-limit and abuse signals: when you view a creation, post, vote, comment, or report, our database records a salted SHA-256 hash of your IP address (or your member ID if you are signed in) to enforce rate limits and count unique daily views. The raw IP address is not stored in our database.
• Server and security logs: our infrastructure providers (Vercel for the website, Supabase for the API, database, storage, and authentication) automatically log requests, including IP address, browser type and version, operating system, referring page, request path, timestamps, and error details. These logs are kept for short periods by those providers for security, debugging, and abuse prevention, under their own policies.
• Authentication events: Supabase Auth records sign-up, sign-in, token refresh, and email-confirmation events with timestamps and IP addresses as part of operating authentication securely.
• Device storage: we store your session tokens, username, avatar, and a few interface preferences in your browser's local storage so you stay signed in and the interface remembers you (see Section 5). The extension stores its settings and your session in extension storage.
• Extension lookups: the extension sends the normalized address of the site or page you are on to our backend to check for Snail Trails; lookups are answered and not retained as a browsing history (see Section 8).
• Product analytics: we use Vercel Web Analytics (first-party, cookie-free) to measure page views and aggregate usage so we can fix broken flows and improve the Service. We do not export raw Vercel Analytics events into our own long-term store. Optional first-party product events we record ourselves (for example publish or checkout starts) are retained up to 13 months. This is not advertising measurement. There are no advertising or social-media pixels.

2.3 Information from third parties

• Stripe: when you connect a Stripe account we receive your connected-account ID and status flags (for example whether charges and payouts are enabled and whether onboarding is complete). When someone buys your creation we receive confirmation of payment, the amounts, and identifiers. Stripe may also send us dispute, refund, and account-update events.
• Other members: comments that mention you, reports about your content, and purchases of your creations.

2.4 What we do not collect

We do not collect precise geolocation, biometric information, health information, contacts, or the contents of web pages you visit. We do not run advertising trackers, fingerprinting, session recording, or social-media pixels. We do use first-party product analytics as described in Section 2.2. We do not buy data about you from data brokers.

3. How we use information

We use personal information to:

• provide the Service: create and secure your account, sign you in, display your profile and creations, deliver feeds, search, notifications, and leaderboards, and unlock deliverables you have got or bought;
• process transactions: start Stripe Checkout, record purchases, calculate the platform fee, unlock and revoke access, show your library and earnings, and enable Stripe payouts;
• communicate with you: send confirmation, security, purchase, payout, moderation, and policy-update messages; if you opt in, The Trail weekly digest; and answer your requests;
• keep the Service safe: enforce rate limits, detect and prevent spam, fraud, vote manipulation, abuse, and security incidents, handle reports, and enforce our Terms;
• comply with law: respond to lawful requests, meet tax, accounting, and record-keeping obligations, handle intellectual-property notices, and establish, exercise, or defend legal claims;
• improve the Service: debug errors, understand usage (including via Vercel Analytics and signup attribution in Sections 2.1–2.2), and develop features, using aggregated or de-identified data wherever practical; and
• promote the Service: feature public creations and makers in the Service and in our own channels, with attribution to the username.

We do not use personal information for targeted advertising, do not sell it, and do not use it to make decisions with legal or similarly significant effects about you without human involvement, except automated content-hiding based on community reports, which you may appeal under the Terms.

4. Legal bases (EEA, UK, Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:

5. Cookies, local storage and tracking

5.1 No advertising or cross-site tracking cookies. Snailsy does not set advertising cookies or cross-site tracking cookies, and does not run advertising pixels. Vercel Web Analytics is first-party and cookie-free. We may set a first-party attribution value named snailsy_attr (cookie or equivalent browser storage, maximum 30 days) solely to remember ref / UTM tags from a landing link until you sign up; it is not used for ads. We do not show a cookie banner for advertising consent because we do not run ads.

Necessary session values stay in local storage as in Section 5.2. No ad cookies. If a future auth change reintroduces sb-* cookies, name them here in the same PR.

5.2 Strictly necessary browser storage. The website stores the following in your browser's local storage, which stays on your device and is not sent to third parties: your session tokens (so you stay signed in), your username and avatar (so the navigation can show them without a request), and small interface preferences. Signing out clears the session values. You can clear local storage in your browser at any time; you will be signed out.

5.3 Service worker. The website registers a service worker so it can be installed as an app. It caches nothing and does not track you.

5.4 Third-party requests. Pages load typefaces from Google Fonts, which means your browser sends your IP address and browser information to Google when a page loads; Google's privacy policy applies. Stripe Checkout, which opens when you buy, may set its own cookies for fraud prevention under Stripe's policy. Links you click to demos, code, or other sites take you to those sites, which have their own practices.

5.5 Do Not Track and Global Privacy Control. We do not track you across sites or sell or share personal information, so there is nothing for these signals to switch off; we treat any Global Privacy Control signal as a valid opt-out request in any event.

6. How we share information

We share personal information only as follows:

• Service providers (processors): companies that process information on our behalf under contracts that restrict their use of it. Currently: Supabase, Inc. (database, authentication, file storage, and serverless functions; data hosted in the United States), Vercel, Inc. (website hosting, delivery, and first-party Vercel Web Analytics), and Stripe, Inc. (payments and payouts; also an independent controller as described in Section 7). We may add or replace providers; the current list is always available on request.
• Other members and the public: your username, profile, published creations, media, comments, vote totals, follower counts, purchase counts, level, and leaderboard standing are visible to everyone. When you buy or get a creation, the Maker sees your username in their sales and activity views. Individual votes and your email are never shown to anyone.
• Makers: a Maker whose creation you bought can see the purchase (username, amount, time) in their earnings view and receives Stripe's own records of the payment. Makers are independently responsible for how they handle that information.
• Legal, safety, and enforcement: we may disclose information if we believe in good faith it is required by law, subpoena, court order, or governmental request; to enforce the Terms; to respond to intellectual-property or other complaints; to protect the rights, property, or safety of Snailsy, our members, or the public; or to detect, prevent, or address fraud, abuse, security, or technical issues. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children as the law requires.
• Business transfers: if Snailsy is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, personal information may be transferred as part of that transaction, subject to this Policy or a successor policy that gives you notice of material changes.
• With your direction or consent: for example when you ask us to share something.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws. We have not done so in the preceding 12 months.

7. Payments and Stripe

7.1 Buying and selling run through Stripe. When you buy, you enter card details on a Stripe-hosted Checkout page; when you sell, you enter identity, tax, and bank details on Stripe's hosted onboarding. That information goes directly to Stripe and is governed by the Stripe Privacy Policy. Snailsy receives only confirmation that a payment or onboarding step succeeded and the identifiers needed to unlock deliverables, revoke access on refund, account for the platform fee, and comply with law.

7.2 Stripe is an independent controller of the information it collects for payments, identity verification, fraud prevention, and regulatory compliance, and it may share some of that information with Snailsy (for example account status and dispute information) as needed to operate the marketplace.

7.3 We keep purchase and payout records for as long as tax, accounting, anti-fraud, and dispute-resolution obligations require, even after you delete your account (see Section 10).

8. The browser extension

8.1 What it reads. The extension reads only the address (URL) of the tab you are on. It never reads, scans, stores, or modifies the content of web pages, form fields, or keystrokes.

8.2 Normalization on your device. Before any lookup, the extension strips fragments, tracking parameters (such as utm_* and click IDs), and session-like tokens from the address, and reduces personal-looking addresses to the domain. If you turn off "Check individual pages" in Settings, every lookup is reduced to the domain only.

8.3 Lookups are not retained. The extension sends the normalized address to our backend to ask whether it has Snail Trails. The lookup is answered and forgotten; we do not build or keep a browsing history. Nothing about a page is stored unless you choose to leave a Snail Trail on it.

8.4 What it stores locally. Your session tokens, your settings (badge, banner, notification toggles, page-level lookups), and, for legacy crowdsourced fee reports, a random anonymous device identifier that you can rotate or delete from Settings.

8.5 Chrome Web Store user data policy. Our use of information received from Google APIs and the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We do not sell extension data, do not use it for advertising or creditworthiness, and do not use it for any purpose unrelated to the extension's single purpose of surfacing community notes for the site you are on.

8.6 Deleting extension data. "Delete all my data" in the extension's Settings removes every Snail Trail, comment, love, and follow you made through the extension. Account deletion is described in Section 13.

9. Public content and search engines

Published creations, their media, comments, your profile, your follower and following counts, your level, and leaderboard placements are public. They can be viewed by anyone, indexed by search engines, and copied, shared, or archived by third parties beyond our control, and they may continue to exist in caches, archives, or third-party sites after you delete them. Do not post anything you would not want to be public. Drafts are private to you. Deliverables are available only to you and to members who got or bought the creation, but we cannot control what a Buyer does with a deliverable after downloading it.

10. How long we keep information

We may keep information longer where required by law, to resolve disputes, to enforce our agreements, or in de-identified or aggregated form.

11. Security

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including: encryption in transit (TLS) and at rest by our providers; password hashing by Supabase Auth; a deny-by-default database design in which every table is protected by row-level security and clients reach data only through server-side functions that check the signed-in member; private storage buckets and time-limited signed URLs for deliverables; salted hashing of IP addresses; and rate limiting. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your password confidential. If we learn of a breach affecting your personal information we will notify you and regulators as applicable law requires.

12. International transfers

Snailsy operates from the United States and our providers store and process information in the United States and other countries that may not have data-protection laws equivalent to those where you live. Where the law of your country requires a transfer mechanism, we rely on our providers' commitments, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum incorporated in the data-processing agreements of Supabase, Vercel, and Stripe, and, where applicable, their certification under the EU-U.S. Data Privacy Framework. By using the Service you understand that your information will be transferred to and processed in the United States.

13. Your rights and choices

13.1 Everyone. Regardless of where you live, you can: edit your profile and creations at any time; delete any creation from its page (its media, votes, saves, and comments go with it); delete your Snail Trails and extension data from the extension's Settings; sign out to clear your session; and delete your whole account by emailing hello@snailsy.com from the account's email address. Account deletion requests emailed to hello@snailsy.com from the account's email address are completed within 30 days of verification, subject to the retention rows in Section 10 (purchase records and legal holds). Account deletion removes your profile, creations, media, drafts, votes, saves, comments, loves, follows, notifications, and authentication record. We retain purchase and payout records, records needed to honor other members' purchases, and anything the law requires us to keep, as described in Section 10. Buyers keep deliverables they already downloaded.

13.2 Access, correction, deletion, portability, restriction, objection. Depending on where you live, you may have the right to ask us to confirm whether we process your personal information and to access it; to correct inaccurate information; to delete it; to receive a portable copy of information you provided; to restrict or object to certain processing (including processing based on legitimate interests); to withdraw consent where processing is based on consent; and not to be discriminated against for exercising your rights. Send requests to hello@snailsy.com with "Privacy request" in the subject line.

13.3 Verification. To protect your information we will verify requests by asking you to email from the address on your account or, where necessary, by asking for additional information. We may decline requests we cannot verify or that are manifestly unfounded, excessive, or would adversely affect the rights of others, and we will explain why. We respond within the time the applicable law requires (generally 30 to 45 days, extendable where permitted).

13.4 Authorized agents. Where the law allows, you may designate an authorized agent to make a request for you; we may require proof of the agent's authority and direct confirmation from you.

13.5 Appeals. If we deny your request you may appeal by replying to our decision with "Appeal" in the subject line. If you are still dissatisfied you may complain to your data-protection or consumer-protection authority (see Sections 14 and 15).

13.6 Email choices. We send transactional and service emails needed to run your account. The Trail is optional digest mail: off by default; sent only if you opt in. Opt out anytime in settings or via the unsubscribe link in the email. If we offer other marketing email later, it will be opt-in with unsubscribe.

14. Additional disclosures for U.S. states

This section supplements the rest of the Policy for residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states with comprehensive privacy laws, to the extent those laws apply to Snailsy.

14.1 Categories of personal information (California)

We use each category for the purposes in Section 3 and retain it as described in Section 10. We do not sell personal information, do not share it for cross-context behavioral advertising, do not use or disclose sensitive personal information for purposes other than those permitted by law, and have no actual knowledge that we sell or share the personal information of anyone under 16.

14.2 Your state rights

Subject to the applicable law and exemptions, you may have the right to know or access the personal information we hold about you; to correct it; to delete it; to obtain a portable copy; to opt out of sales, sharing, targeted advertising, and certain profiling (we do none of these); to limit the use of sensitive personal information (we use it only to provide the Service); and not to be discriminated against for exercising your rights. Exercise them by emailing hello@snailsy.com. We honor Global Privacy Control signals as opt-out requests. You may appeal a denial under Section 13.5; if unresolved you may contact your state Attorney General.

14.3 California "Shine the Light" and notice of financial incentives

We do not disclose personal information to third parties for their direct-marketing purposes and do not offer financial incentives in exchange for personal information. Points and levels are not an exchange for personal information.

14.4 Nevada

We do not sell covered information as defined by Nevada law.

15. Additional disclosures for other regions

15.1 EEA, UK and Switzerland. You have the rights in Section 13.2 under the GDPR, the UK GDPR, and the Swiss FADP, and the right to lodge a complaint with your supervisory authority (for the UK, the Information Commissioner's Office). We have not appointed a representative in the EU or UK because we do not target those markets; if that changes we will update this Policy. Section 4 sets out our legal bases. Where we rely on legitimate interests you may object; where we rely on consent you may withdraw it.

15.2 Brazil. Residents of Brazil have the rights set out in the Lei Geral de Proteção de Dados, including confirmation, access, correction, anonymization, portability, deletion, information about sharing, and revocation of consent, exercisable through the contact in Section 19.

15.3 Canada. We handle personal information in accordance with PIPEDA and applicable provincial laws. You may request access to or correction of your personal information and may complain to the Office of the Privacy Commissioner of Canada.

15.4 Australia. We handle personal information in accordance with the Australian Privacy Principles to the extent they apply. Information is stored overseas as described in Section 12. You may complain to us and then to the Office of the Australian Information Commissioner.

15.5 Other countries. Where local law gives you rights not listed here, you may exercise them by contacting us and we will respond as the law requires.

16. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13 (or under the higher minimum age that applies where they live). Members under 18 may not buy or sell. If you believe a child has provided us personal information, email hello@snailsy.com and we will delete it and close the account promptly.

17. Third-party sites and services

Creations, profiles, and comments may link to third-party sites, demos, repositories, and files that Snailsy does not control. Private-link deliverables point to third-party services. This Policy does not cover those sites and services; their own policies apply, and we encourage you to read them before providing any information.

18. Changes to this policy

We may update this Policy from time to time. When we do we will post the updated Policy with a new effective date and version. For material changes we will give notice in the Service or by email before they take effect, and where the law requires it we will ask for your consent. Continued use of the Service after the effective date means you accept the updated Policy.

19. Contact

Privacy questions, requests, complaints, and appeals: hello@snailsy.com (subject "Privacy request"). Please include your username and the email on your account so we can verify you.

Version 2026-09-18-1. Previous versions are available on request.