Privacy Policy

1. Browser extension

Local captures and editable drafts

When you start a capture, the extension processes the selected page's pixels, title, URL, capture time and image dimensions. It stores original screenshots and editable drafts in your browser's local IndexedDB. Drafts include crop coordinates and annotations. Imported images and their filenames are stored locally in the same way; imported images have no source URL. Credentials, query strings and fragments are removed from stored source URLs.

Up to five recent captures and their drafts are kept for 24 hours. Cleanup runs when capture storage is accessed; a closed browser does not run a guaranteed deletion task at an exact time. Saving edits does not extend the original retention period. You can delete recent captures in the extension's Settings.

Redaction and copies

Redaction covers selected areas with opaque pixels in flattened exports and uploads. Original pixels and editable redaction objects remain in local recent captures until deletion or expiry. You can move or remove a redaction while editing. Deleting a local capture does not delete downloaded files, clipboard copies or copies already received by other people.

Browser permissions

• activeTab: temporary access to the tab on which you invoke capture. The extension does not request access to your complete browsing history.
• scripting: packaged scripts measure the page, select regions or scrolling containers, scroll during capture and restore temporary page changes.
• storage: settings, capture status and optional account connection information. Screenshot pixels and drafts use IndexedDB.
• clipboardWrite: copies an edited image or sharing link when you choose Copy. Pasting an image can import the image you provide; the extension does not monitor the clipboard in the background.
• Optional API access: permission to contact api.snapshotflow.com for account features. It is not required for local capture and export.

The extension does not request browser cookies, a browsing-history permission or permanent access to every website. Local capture can include content visible in your signed-in browser session, but it does not send that session's cookies to our API. All executable extension code is included in the extension package.

Connecting an account

If you connect your account, the extension stores your account email, a separate revocable API key and connection details in extension-local storage. The connection uses a one-time handoff from our dashboard. The API key is not exposed to page content scripts. Disconnecting removes the local connection; revoke the key in the dashboard to invalidate it on the server.

Optional online actions

Save to SnapshotFlow uploads the current flattened edited PNG, its dimensions and a sanitized source URL. Share by link uploads the edited image part and creates a public link. Merely installing the extension, taking a screenshot, opening the editor or connecting an account does not upload or publish a capture.

Render URL sends the saved URL and selected rendering options to our server. It uses API rendering quota and does not include browser cookies or the local original screenshot. Opening our website or dashboard from the extension may add campaign parameters to the destination link; website analytics apply on those pages.

2. Website, dashboard and API

Account and support information. We process the email address, account identifier, password hash and profile information you provide, along with verification, sign-in and API-key records needed to operate and protect your account. If you contact support, we receive your message and any attachments you choose to send.

Rendering requests and saved content. The API processes the URLs, HTML, rendering options and other inputs you submit, including cookies or authentication headers if you explicitly supply them for a server-side capture. Results may include screenshots, PDFs, extracted text, metadata or visual comparisons. Hosted rendering visits the destination website from our infrastructure; that website receives the network requests needed to load its content.

Operational data. Our infrastructure processes request and error logs, timestamps, IP addresses, browser or client information, account usage and quota records for service delivery, troubleshooting and abuse prevention. Do not place secrets in URLs or screenshots you intend to share.

Website analytics and browser storage

Our website and dashboard include Google Tag Manager to load configured measurement tags, which may include Google Analytics and Microsoft Clarity. Depending on the enabled tags, these services process page visits, referral and campaign information, device and browser information, interactions such as button clicks, and session interaction data. Dashboard measurement can associate events with an account identifier. Cookies or similar browser storage may be used. These website integrations are separate from the extension, which contains no analytics SDK or advertising code.

The dashboard also uses browser storage for sign-in tokens, your account email, selected settings and theme preferences. Signing out removes the dashboard's stored session credentials. Your browser provides controls for cookies and site storage; disabling storage can affect sign-in and other features.

For provider information, see Google's Privacy Policy and Microsoft's Privacy Statement.

3. How we use and share information

We use information to provide capture, editing, rendering, storage and sharing; authenticate accounts; deliver service emails; respond to support; maintain security; and understand use of our website and dashboard. We do not sell personal data. We do not use extension capture data for advertising, creditworthiness or lending decisions.

Service providers process information as needed for hosting, database and file storage, network delivery, transactional email and configured website analytics. Our email delivery integration uses Brevo. Information may be processed outside your country depending on the infrastructure and providers involved. We may also disclose information when required by law or necessary to protect users, the service or legal rights.

When you configure a webhook, connect an external client or export a result to another service, that destination receives the information needed for the action you requested. Its own privacy practices apply.

Public sharing links

Anyone with a sharing link can view its image without signing in until the link expires or is revoked. Available durations are 1 hour, 24 hours or 7 days, capped by the screenshot's remaining storage retention. Public viewers are not shown your account email, source URL or storage credentials. An image itself can still contain personal or confidential information: inspect the exported result before sharing.

You can revoke a link in the editor or dashboard. Deleting the cloud screenshot also invalidates its links. Deleting a local recent capture or disconnecting the extension does not revoke an existing cloud link. Revocation cannot recall copies someone has already downloaded.

Chrome Web Store Limited Use

SnapshotFlow's use and transfer of information received through Chrome APIs adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. We use extension data only to provide or improve its stated screenshot functions, not for unrelated profiling or advertising. We do not permit routine human review of extension content; access is limited to cases allowed by that policy, such as your explicit consent for support, security investigations or legal obligations.

4. Retention and security

Extension-local capture retention is described above. Cloud screenshots have an expiry recorded by the service, subject to account and service configuration; the backend's default screenshot retention is 30 days. Expired content is subject to cleanup rather than a promise of physical erasure from every system at the exact expiry instant. Sharing links cannot extend the screenshot's retention.

We retain account, support, security and operational records as needed for their purpose, resolving disputes and applicable legal obligations. We do not promise that deleting a screenshot immediately removes all related operational records or any copies in backups. Contact us for account deletion or questions about retained information.

We use HTTPS for production service requests, hashed passwords, authentication and revocable API keys to protect access. No storage or transmission method eliminates every risk. Keep your API keys private and revoke credentials you no longer need.

5. Your choices and privacy requests

• Use local extension capture, editing and export without connecting an account.
• Delete local captures in Settings; disconnect the extension and revoke its API key in the dashboard.
• Delete cloud screenshots or revoke their public sharing links using the available account controls.
• Control cookies, website storage and extension permissions in your browser.
• Request access, correction, a copy or deletion of your personal data by emailing support@snapshotflow.com. Depending on your location, you may also have rights to restrict or object to processing, withdraw consent where applicable, or complain to a data protection authority.

We may need to verify your identity before fulfilling an account-related request. We cannot retrieve or remotely erase extension-local captures that have never been uploaded. Where applicable, processing is based on providing the service you request, legitimate interests in security and service operation, consent, or legal obligations.

6. Children and policy changes

SnapshotFlow is not directed to children under 13, and we do not knowingly collect their account information. If you believe a child has provided personal information, contact us.

We may update this policy as the service changes. The date above identifies the latest version. For questions about this policy or the organization responsible for your data, email support@snapshotflow.com.