Privacy Policy

This Privacy Policy explains how SnapStatic Image Tools at images.snapstatic.io ("the Service") collects, uses, and protects your data. The Service is operated by SnapStatic.

1. Data We Collect

The Service is designed to minimize data collection. We do not require accounts, logins, or personal information to use the free tier. Here is what we collect:

Automatically collected:

• IP address — used for rate limiting and Turnstile bot verification. Not stored in logs or databases. Retained only in-memory during request processing.
• Cloudflare analytics — Cloudflare collects standard web analytics (page views, country, browser type) as part of its CDN service. This data is aggregated and not personally identifiable.

Data you provide:

• Images — uploaded for processing. See Section 2 for how images are handled.
• Pack token — if you purchase a paid pack, you receive a token by email from Lemon Squeezy. The token is stored locally in your browser (localStorage). We store token metadata (credits remaining, expiry date) in Cloudflare KV. Tokens are not linked to your identity.

Data we do NOT collect:

• No email addresses (unless you purchased a pack via Lemon Squeezy, who collects your email for the transaction)
• No names, usernames, or account information
• No cookies for tracking or advertising
• No third-party analytics scripts (no Google Analytics, no tracking pixels)

2. How Images Are Processed

When you upload images for processing:

• Images are transmitted over HTTPS to our processing server
• Processing occurs in temporary RAM-backed storage (tmpfs)
• Processed output is packaged into a ZIP file and uploaded to temporary cloud storage (Cloudflare R2)
• Temporary files on the processing server are deleted immediately after upload
• ZIP files on R2 are automatically deleted after 24 hours
• We do not view, analyze, scan, or retain your images beyond what is necessary for processing
• If you enable "strip metadata", EXIF data (including GPS location, camera info, and copyright) is removed from output files

3. Cloudflare Turnstile

We use Cloudflare Turnstile for bot protection on all processing requests. Turnstile is a privacy-preserving alternative to CAPTCHA. It may set a cookie (cf_clearance) and collects minimal signals to verify you are human. Turnstile does not track you across sites. See Cloudflare's Privacy Policy for details.

4. Payment Data

If you purchase a paid pack, the transaction is processed by Lemon Squeezy (Lemon Squeezy LLC) as Merchant of Record. Lemon Squeezy collects your payment information (card details, email, billing address) directly. SnapStatic never receives or stores your payment details.

See Lemon Squeezy's Privacy Policy for how they handle your payment data.

5. Local Storage

The Service stores the following in your browser's localStorage:

• Pack token — your activation token string, if you purchased a pack

No cookies are set by the Service itself. Cloudflare may set functional cookies for security purposes. You can clear localStorage at any time through your browser settings.

6. Data Processing Location

Images are processed on a server located in Germany (Hetzner, Falkenstein data center). ZIP output files are stored temporarily on Cloudflare R2 (EU jurisdiction). The Cloudflare Worker runs on Cloudflare's global edge network.

7. Data Retention

• Uploaded images: deleted immediately after processing (seconds)
• Output ZIP files: auto-deleted from R2 after 24 hours
• Pack tokens in KV: expire and are deleted according to pack validity (30/60/90 days)
• Rate limit counters: expire after 1 hour
• Server logs: processing metadata (job ID, file count, duration) retained for 30 days. No image content is logged.

8. Your Rights (GDPR)

If you are in the European Economic Area, you have the right to:

• Access — request what data we hold about you (in practice, very little since we don't require accounts)
• Deletion — request deletion of any data associated with you
• Rectification — request correction of inaccurate data
• Portability — request your data in a portable format
• Object — object to data processing
• Complaint — lodge a complaint with your local data protection authority

Since the Service collects minimal data and does not require accounts, most of these rights are satisfied by design. For any requests, contact [email protected].

9. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has used the Service in a way that concerns you, contact us.

10. Changes to This Policy

We may update this Privacy Policy by posting the revised version on this page with an updated date. Material changes will be noted at the top of the page.

11. Contact

Data protection inquiries: [email protected]