Privacy Policy

Last updated: October 2026

At SnapSend, accessible from https://snapsend.site, one of our main priorities is the privacy of our visitors. This Privacy Policy explains what information is (and is not) collected by SnapSend and how our zero-knowledge architecture protects your shared content.

Zero-Knowledge Architecture & Content Privacy

SnapSend operates on a strict zero-knowledge model for encrypted text shares, files (up to 100 MB), Secure Receive requests, and 6-digit pickup codes. We have designed our system so that:

• Client-Side Encryption: Text secrets and files up to 100 MB are encrypted in your browser using AES-256-GCM before upload. The decryption key lives only in the URL fragment (#key) or is derived client-side from your passphrase via PBKDF2, and is never transmitted to our servers.
• Zero-Knowledge Pickup Codes: When you generate a 6-digit pickup code, your browser hashes the code with SHA-256 for lookup and encrypts the full share link (including the decryption key) using a key derived from the 6-digit code. Our server stores only the ciphertext.
• Automatic Self-Destruction: Encrypted payloads are permanently deleted from our key-value and blob storage as soon as their read/download limit or time-to-live (TTL) expiration is reached, or immediately when the sender clicks "Revoke / Burn".

Information We Collect

Core secret and file sharing requires no account. Depending on how you use SnapSend, we process only the minimum data needed:

• Read Receipts & Witness Notifications: When a share is opened, we record the open timestamp and coarse country code (derived from standard edge request headers, never GPS) so the sender can see that their link was opened. Raw IP addresses are never shown to recipients or stored in share records.
• Optional Accounts & Day Pass Purchases: Core SnapSend tools do not require registration. If you optionally sign in via passwordless magic link (for email read-receipts, dashboard management, or a Day Pass / Pro upgrade), we store your email address, an HTTP-only session cookie, and payment transaction identifiers processed by Razorpay.
• Local Share History: Your "Recent" share list on the homepage is stored exclusively in your browser's localStorage on your own device and is never uploaded to our servers.
• Voluntary Correspondence: If you contact us directly via email, we receive your email address and message solely to respond to your inquiry.
• Aggregate Analytics: On public marketing and landing pages (and only if you have not declined optional cookies), we use Google Analytics to measure aggregate page views.

Strict Third-Party Script Isolation on Secret Links

To guarantee that URL fragments (#key) can never be accessed by third-party scripts, SnapSend completely disables Google Analytics and Google AdSense on all secret-handling routes (including /text/*, /s/*, /file/*, /fill/*, /receive/*, /ask/*, /drop/*, and /p2p). Additionally, our global Referrer-Policy: no-referrer header ensures that links clicked from inside a secret never leak the URL to external sites.

Cookies and Local Storage

SnapSend uses essential browser storage (such as theme preference, local share history, and chunked upload resume state) and an HTTP-only session cookie if you sign in. On non-secret pages, optional analytics and advertising cookies may be used unless you click Decline Optional on our cookie banner.

Advertising

SnapSend keeps its core tools free, supported in part by advertising on public informational pages (and disabled for Day Pass / Pro users and on all secret-viewing pages). Where ads are shown, they are served by Google AdSense.

You can review and control how Google uses advertising cookies at policies.google.com/technologies/ads, manage your ad preferences at myadcenter.google.com, and opt out of personalized advertising via Google Ads Settings.

GDPR Data Protection Rights

Every user is entitled to the following rights regarding any personal data we hold (such as an optional account email):

• The right to access – You have the right to request copies of your personal data.
• The right to rectification – You have the right to request that we correct any information you believe is inaccurate.
• The right to erasure – You have the right to revoke active shares at any time or request deletion of your optional account record.

Children's Information

SnapSend does not knowingly collect any Personal Identifiable Information from children under the age of 13.