Privacy Policy
This document is provided in English, which is the authoritative version. Any translation is for reference only.
The short version
We collect as little as we can. The pages you capture and the images you edit stay on your device and are never uploaded. Server-side we keep what a paid plan requires: your account email address, a random device identifier, and your Pro and order records. Your account is that email address — we use it only to sign you in, activate Pro and reply to your messages. We still never see the pages you capture.
Who is responsible for your data
The data controller is WANG YONGQIANG, an individual business at Room 301, Building C, No. 12 Xiyi Lane, Nanjing, Jiangsu Province, China. Send any privacy question or rights request to ilyych@hotmail.com. We have not appointed a Data Protection Officer; privacy requests are handled directly by the person responsible for the service.
What stays on your device
Your captures, edits, settings and Pro credential are stored in your browser and are not uploaded to us.
- Captures and edits — the full-size images, stored in your browser's local database, never uploaded.
- Your capture library — thumbnails and the metadata used to list your captures, including the page URL and page title of each capture, kept on the same device.
- Settings — capture preferences, watermark configuration and per-site cleanup rules, stored against the site origin (for example https://example.com).
- Your Pro credential — a signed token that lets the extension verify your plan offline.
Page content and cleanup rules
When you start a capture, SnapPage reads the active page in your browser: its DOM structure, text, images, element positions and computed styles. Hide and Keep read the page elements you select. This processing happens entirely inside your browser, on the page you asked to capture; the extension does not read pages in the background and does not continuously monitor the sites you visit. Saved cleanup rules contain only the site origin and CSS selector strings for the elements you chose to hide or keep — not the text or images of those elements — and are matched locally when you capture that site again. We do not upload page content, page URLs, site rules or captures to our servers, and we do not build a browsing history on our servers. Your local capture library does keep the URL and title of each capture, as described above.
What we hold on our servers
We only receive data when you buy or manage Pro, sign in, or choose to send us a message. The list below describes the categories of data we hold; it does not include the page content, captures or site rules that stay on your device.
- Account email address — the address you sign in with and the one your purchase is tied to. It is your account identifier; there is no separate username.
- Account record — a random internal user ID, whether the address is verified, the display name your sign-in provider returns (if any), and the dates you signed up and last signed in.
- Authentication information — you can sign in with Google, with a Microsoft account, or with a one-time email code. From an OAuth provider we store only an opaque account identifier and your email address; the provider access token is used once in memory to read your profile and is never stored. We do not store refresh tokens, Google or Microsoft account passwords, or any password of our own — there is no password login. An email code is kept only as a SHA-256 hash with a 10-minute expiry. To keep you signed in we store a random session token, its expiry time and a hash of your browser user-agent; a session lasts up to 400 days and is extended as you use it. We also keep short-lived records of failed sign-in attempts.
- Pro and order records — plan, activation status, billing period end, the payment provider reference, order and transaction identifiers, subscription identifier, price identifier, currency, amount, the buyer email address, the device identifier the credential is bound to, and the checkout metadata attached to the order.
- Messages you send us — the feedback or support text you write, the contact address you give, the extension version, your browser user-agent and interface language.
Payment event information
When Creem sends a payment notification to our API, we process the event to activate or revoke Pro, reconcile orders and handle refunds and disputes. We store the event type and outcome, transaction and order references, payment status, plan, currency, amount and buyer email address, together with a truncated copy of the raw event payload (the first 8,000 characters) so that a repeated notification can be recognised. The payload contains the order and buyer information supplied by Creem, such as the buyer email address; we do not receive or store full card numbers or card security codes. Card data is handled by Creem under its own privacy policy.
Order and transaction records
We keep order and transaction information to activate Pro, verify purchases, process refunds, resolve payment disputes and meet applicable accounting and legal obligations. These records are not deleted automatically. If you ask us to delete your account, we delete or anonymise the personal account data we no longer need, and keep only the minimum transaction records still required for those purposes. Creem keeps its own transaction and tax records under its own privacy policy; deleting your account with us does not remove those.
Collected automatically
As with any website, when your browser loads a page or the extension calls our API, our hosting provider sees your IP address and standard request metadata (time, path, status and user-agent). We use this to deliver requests, keep the service available and prevent abuse. We do not keep a request-log table in our own database: we store only short-lived records of failed sign-in, activation and checkout attempts, keyed by the email address or by IP, so that automated guessing is blocked. We do not use this information to build a profile of you across other sites.
Legal basis for processing
We process personal data only where the law gives us a basis. Running your account and Pro, delivering the extension you paid for, and answering your messages — performance of a contract (GDPR Art 6(1)(b)). Keeping accounting, tax and transaction records and acting on refund or chargeback decisions — compliance with a legal obligation (Art 6(1)(c)). Keeping the service secure — rate-limiting sign-in, blocking paid-feature abuse and fraud — our legitimate interests (Art 6(1)(f)), balanced against your rights; you may object to that processing (see your rights below). We do not rely on consent for any processing described on this page, so there is no consent to withdraw; if that ever changes, we will ask first and you can withdraw at any time.
International transfers
Our data controller is based in China, and our providers run global infrastructure, so the records listed above may be accessed from and stored outside your country — on the Cloudflare global network, which serves this site and our API; by Creem, our merchant of record, which collects payment and keeps the transaction records tax law requires; and by our email delivery and sign-in providers, Resend and Microsoft, which process the related data in the United States. Where personal data leaves the EU/EEA, the UK or Switzerland, our providers may use transfer safeguards such as the European Commission Standard Contractual Clauses, together with the UK Addendum where it applies. You can ask us for details of the safeguards that apply to a transfer.
Payment data
We never see or store your card number. Payment is collected by Creem, our merchant of record: it is PCI-DSS compliant, stores the card data, issues your receipt and invoice, and remits applicable VAT, GST and sales tax under its own privacy policy. From a payment we receive the plan, currency, amount, the payment provider references, the buyer email address and the device identifier — not the card details themselves.
Cookies
This site sets no analytics, advertising or tracking cookies. Four strictly necessary cookies are used and cannot be switched off: sp_session, which keeps you signed in and is HttpOnly and same-site; sp_oauth_state, which protects the OAuth sign-in redirect against cross-site request forgery; sp_next, which remembers the page to return to after sign-in; and sp_confirm_ticket, which protects an email confirmation step. They are session or short-lived cookies, not tracking cookies; signing out revokes the session and clears the session cookie. We load one third-party script, Cloudflare Web Analytics, for aggregate, cookie-free visit statistics: it sets no cookie and does not identify you, so there is no consent banner to dismiss.
What we do not do
- We do not receive, store or transmit the pages you capture or the images you produce.
- We do not collect a browsing history on our servers, and the extension reads only the page you asked it to capture. Your local capture library does keep the URL and title of each capture; that list never leaves your device.
- We do not sell your personal information — neither in the ordinary sense nor in the sense the CCPA gives "sell" (disclosing it for money or other valuable consideration). We do not share it for cross-context behavioural advertising, and we do not rent it.
- We use no tracking or advertising cookies and no advertising scripts. The only measurement on this site is the cookie-free, aggregate statistics of Cloudflare Web Analytics, which cannot identify you or follow you across websites.
- We do not bypass authentication, paywalls or access controls, and we do not download any page on your behalf — SnapPage only captures what your browser is already showing, using the session you already have.
- We do not send marketing email. The only email we send is service email: sign-in codes, receipts, Pro or security notices, and replies to your own messages. Because there is no marketing, there is no marketing list to unsubscribe from; if that ever changes, every message will carry a one-click opt-out.
Service providers
- Creem — payment processing and merchant of record. Card data, receipts, invoices, transaction taxes and subscription billing are handled by it under its own privacy policy.
- Cloudflare — hosting for this website and the Pro API, the database that holds the records listed above, platform request logs used for security and abuse prevention, and the aggregate visit statistics described below.
- Google — if you choose to sign in with Google, Google authenticates you and returns your email address and an account identifier to us. Google learns that you signed in to SnapPage; beyond that we get no access to your Google account.
- Microsoft — if you choose to sign in with a Microsoft account, Microsoft authenticates you and returns your email address and an account identifier to us. Microsoft learns that you signed in to SnapPage; beyond that we get no access to your Microsoft account.
- Resend — delivers our service email. To send you a sign-in code we pass it your email address, the sender address, the subject and the message body, which contains the code. Resend keeps its own delivery logs under its privacy policy. We use it for no other purpose, and we send no marketing through it.
- Extension stores — if you install SnapPage from the Microsoft Edge Add-ons store or the Chrome Web Store, the store distributes the package and collects install and usage statistics under its own privacy policy, acting as an independent controller for that data. We receive only aggregate install numbers and any review you choose to post publicly — never your browsing history or the pages you capture.
- We share nothing with advertising networks or data brokers. The only visit statistics we collect are the aggregate, cookie-free measurements of Cloudflare Web Analytics: they do not identify you, cannot follow you across websites, and are never used for advertising or profiling. Our processors act on our instructions under contracts that require confidentiality and appropriate security; the extension stores above act as independent controllers for the data they collect themselves. We disclose data to authorities only where legally compelled.
How long we keep it
Account, Pro and order records — kept until you ask us to delete them. We need them to activate Pro, restore a purchase if you come back, verify payments and handle refunds or disputes. Payment and tax records — held by Creem as merchant of record for the period tax and accounting law requires. Messages you send us — kept until you ask us to delete them, so we can recognise a repeat problem. Sign-in, activation and checkout rate-limit records — short-lived, with older entries removed as part of routine limit checks. Captures and edits — never on our servers at all, so there is nothing for us to delete. They stay in your browser until you delete them in the extension, or until the local storage limit removes the oldest captures.
Your rights
Depending on where you live, you may have some or all of these rights over the personal data we hold: to be told what we collect and why (this page); to obtain a copy; to correct it; to have it erased; to restrict or object to processing; to receive it in a portable, machine-readable format; to withdraw any consent you gave; and not to be discriminated against for exercising them. Write to ilyych@hotmail.com and we will answer within 30 days — sooner where the law requires it. We may ask you to confirm that you control the email address on the account, so that we do not hand your records to someone else. Deleting your account does not remove the data stored in your browser: to remove captures, use Delete or Clear all in the extension History page; to remove site rules, use Clear for one site or Clear all in the extension Settings page. Uninstalling the extension also removes its local storage in most browsers. There is no screenshot or page content on our servers for us to produce or delete. If you are not satisfied with our answer you may complain to your local data protection authority — in the EU/EEA the authority where you live or work, in the UK the ICO.
Children
SnapPage is a professional tool and is not directed at children. We do not knowingly collect data from anyone under 16, or under the higher age of digital consent where you live. If you believe a child has given us personal data, email us and we will delete it.
Changes
If we change this policy in a way that affects what we collect or how we use it, we will update this page and the "last updated" date above, and for material changes we will give at least 15 days' notice by email to the address on your account before the change takes effect. Earlier versions are available on request, so you can see what applied at a given date.
Contact
Privacy and data requests: ilyych@hotmail.com. General support and billing go to the same address. Post: WANG YONGQIANG, Room 301, Building C, No. 12 Xiyi Lane, Nanjing, Jiangsu Province, China. We answer within 30 days, usually much sooner.