Security
Where your captures live, and who touches them.
Five companies handle anything you upload, and every one of them is named below. Only what you sign in with or deliberately upload ever leaves your machine, with one exception: a bot check runs on the sign-in, sign-up and password-reset pages before you type anything.
The privacy notice is the fuller version, and it is the one a build check holds to the code.
Sub-processors
The five companies, named.
Each one acts on our instructions and none of them is permitted to use your material for anything else.
- Supabase
- Your account, and the records about your captures.
- Vercel
- The site you are reading now.
- Cloudflare
- The captures themselves. Screenshots sit in its R2 storage, recordings are processed and streamed by its Stream service, and the MP4 offered for download is generated there.
- The mail this service sends you, relayed on our instructions. A confirmation, a sign-in link or a password reset carries your address and the link inside the message.
- Anthropic
- Nothing, unless you press one of the buttons the notice names. It then receives only what is listed there, plus the words you typed into a note.
Three more companies are built into this code and switched off. They are named on the privacy notice even though they receive nothing, because that notice is what a build check holds to the code: the day one of them is switched on, the notice has to say so before the key can be set.
Where the bytes rest
Capture files do not all rest in the same place.
Screenshots are stored in a Cloudflare R2 bucket created with a European Union jurisdiction, so those files stay in the EU. Recordings are not: Cloudflare Stream offers no equivalent region control, so a recording is held on a global network and may rest outside the EEA.
We would rather tell you that than round it off. Both are covered by Cloudflare’s data processing agreement, which carries the European Commission’s standard contractual clauses.
The database, which holds your email address and the records about your captures, is in London, United Kingdom, outside the European Economic Area, under the European Commission’s adequacy decision for that country. The privacy notice carries the decision by number and the fallback if it is ever withdrawn.
Putting it on machines
How each of the three installs.
What the extension keeps on a site you switch it on for is enumerated on the privacy notice, item by item.
The desktop app
It installs per machine, into Program Files, rather than into one person’s profile. So the first install and every update raise a UAC prompt, and one copy serves everyone who signs in to that machine.
The browser extension
The Chrome Web Store listing is unlisted today, which means it is not searchable, so this site carries no install link yet. If your browsers are managed by policy, write to us and a person will answer.
What the download page saysThe web app
Nothing to install and nothing to update. It runs at https://app.snapbuddy.ai in a current browser, and it is the same editor and the same library as the other two.
What we do not have
The paperwork we cannot give you.
There is no SOC 2 report, no signed data processing agreement of our own to hand you, and no audit log you can pull yourself. Those are things this product does not have, stated plainly rather than described as arriving.
If you need one of them before you can trial this, say so in the same mail and you get a straight answer either way. Writing to support@snapbuddy.ai reaches a person, and that is the whole escalation path.