Privacy Policy — Snugport

The short version

If you use Snugport without an account — which is the normal way to use it — we hold no personal data about you whatsoever. Your projects, hours, clients and notes are written to your own browser's storage and never leave your device. There is no analytics, no advertising, no tracking pixel and no third-party script on the panel.

We only process personal data if you choose to create an account for Snugport Sync, and then only what is needed to run it — plus our news emails, if and only if you ask for them.

1. Data controller

Controller: Fritz Reif Garcia
Tax identification number: 03152180F
Address: Juan Ramón Jiménez 63, 46026 Valencia, Spain
Contact for privacy matters: support@snugport.app

That applies to the data we hold about you: your account, your billing, your subscription. For the contents of your panel it is the other way round — if you keep personal data about other people in there, you are the controller and we act as your processor. That is governed by the data processing agreement.

2. What we process, and why

a) Using the panel without an account

Nothing. Your data is stored by your browser, on your device, using its local storage. It is not sent to us and we have no way of reading it. Clearing your browser data deletes it, which is why the panel has a one-click export.

b) If you create an account (Snugport Sync)

Email address and password — to identify you and let you sign in. The password is stored hashed; we never see it in readable form. Legal basis: performance of the contract.
Your display name, if you choose to enter one. Legal basis: performance of the contract.
A copy of your panel — the same content that is on your device, stored so your other devices can retrieve it. It is encrypted in your browser, with a key derived from your password, before it leaves your device: we store the result and cannot read it, and neither can the provider that runs our database. Access is also restricted at database level so that only your account can retrieve it at all. Legal basis: performance of the contract.
Subscription status — whether your Sync is active, and until when. Legal basis: performance of the contract.

c) If you subscribe

Billing data — name, billing address, country, tax number if you provide one, and payment details. This is collected and processed by Stripe on their own systems. We never receive your card number. We receive your email address, your subscription status and the invoice records. Legal basis: performance of the contract and compliance with tax obligations.

d) If you write to us

Your email and its content, to answer you. Legal basis: legitimate interest in responding to enquiries.

e) If you ask for our news

Your email address and your language — to send you occasional news: new versions of Snugport and other projects by the same controller. Only if you tick the box for it, when you create your account or later in Settings; it is never pre-ticked and your account does not depend on it. We also keep when you subscribed and unsubscribed and which version of the wording you agreed to, as a record of your choice, and a random code that makes the unsubscribe link in each email work. Legal basis: your consent, which you can withdraw at any time without affecting the emails sent before.

3. What we do not do

No advertising, and no selling or sharing of data with advertisers.
No analytics or tracking of any kind on the panel or on this site.
No tracking in our emails: no tracking pixels, and no counting of opens or clicks.
No profiling and no automated decision-making.
No use of your content to train machine-learning models.
No third-party fonts, scripts or resources loaded from other servers — everything is served from our own domain.

4. Cookies

Snugport sets no cookies for analytics, advertising or tracking, so no cookie banner is needed. The panel uses your browser's local storage to hold your own data and, if you sign in, your session — these are technically necessary for the service to work and are not used to track you across sites. Stripe may set cookies on its own checkout pages, governed by its own policy.

5. Who else handles your data

Providers acting on our behalf

Only where necessary to run the service, and each under a data processing agreement:

Cloudflare — hosting of this website and the panel, and email routing for our addresses.
Supabase — database and authentication for accounts and the cloud copy of your panel. Our project is hosted in the London region (eu-west-2), in the United Kingdom.
Stripe — payment processing, invoicing and tax calculation.
Resend — delivery of email: account messages such as confirmation and password recovery, and our news emails if you asked for them.

Payment providers, which also decide on their own

Stripe and PayPal are not only providers acting on our behalf. For part of what they do with your payment data — detecting fraud, meeting anti-money-laundering and other legal obligations, and keeping their own records — they decide by themselves why and how, and there they act as independent controllers under their own privacy policies rather than on our instructions. If you choose PayPal at checkout, PayPal and Snugport are each independent controllers of that payment data. You can read Stripe's privacy policy and PayPal's privacy statement.

Because our Supabase project is in the United Kingdom, your cloud copy is stored outside the European Economic Area. The United Kingdom is covered by an adequacy decision of the European Commission, which means the transfer is permitted without further conditions and your data keeps an equivalent level of protection. Where any other provider processes data outside the EEA without such a decision, the transfer is covered by the safeguards recognised under the GDPR, such as the European Commission's standard contractual clauses.

6. How long we keep it

Account and cloud copy — for as long as your account exists. Deleting your account from within the panel removes both, without delay.
Earlier versions of your panel — the cloud copy keeps a version history so you can undo a bad day: the last 10 versions, plus one a day for the past 30 days, and never more than one an hour. Each of those versions is encrypted the same way as the current copy. Older ones are deleted automatically. Erasing your cloud data or deleting your account removes the whole history too, without delay.
Billing records — for the period required by tax and commercial law, regardless of whether the account is deleted. In Spain that is four years for tax purposes and six years for accounting records.
News emails — we send them until you unsubscribe or delete your account. The record of when you subscribed and unsubscribed stays with your account and is deleted with it.
Support emails — for as long as needed to deal with the matter, and then deleted.

7. Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. You can exercise most of these directly and immediately from inside the panel: export gives you portability, and account deletion gives you erasure. If you subscribed to our news, you can withdraw your consent at any time with the unsubscribe link in any of the emails, or by unticking the box in Settings › Sync.

For anything else, write to support@snugport.app. You also have the right to lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos.

8. Security

Your panel is encrypted in your browser before it leaves your device, with a key derived from your password, and it is stored and returned in that form. We cannot read it, and neither can the provider that runs our database. Your password itself never reaches our authentication provider: your browser derives one value to sign you in and a different one to encrypt with, and only the first is sent. On top of that, data in transit is encrypted, the cloud copy is protected by row-level access rules so that a given account can only ever retrieve its own, and passwords are stored hashed.

Two things this does not mean, because a security section that only lists the good parts is worth less than none. It does not make your data unreadable to someone who controlled the code your browser downloads from us — no web application can promise that. And it means that if you lose your password and your recovery code, nobody can recover your cloud copy, us included: there is no reset for it, because we hold nothing that could undo it. The strongest protection here is still structural — without an account, there is nothing of yours on our side at all — and the panel's one-click JSON export is the backup that never depends on us.

9. Children

Snugport is a tool for professional work and is not directed at children. An account is a contract: as the Terms of Service set out, you must be at least 18 years old, or an emancipated minor, to create one. The free panel needs no account and sends us nothing, so it is not affected.

10. Changes

If this policy changes substantively, account holders will be notified by email. The date at the top always reflects the current version.