Privacy

Last updated 28 October 2026

Snags lets you leave feedback on a website and share it as one link. This page says what Snags collects, where it goes, how long it's kept and how to delete it.

Only on sites you choose

The first time you start an audit, Snags asks for access to websites: Chrome only lets an extension take a screenshot with that access. Snags still reads nothing from a website until you start an audit on it, and while an audit is running it records only on that site's pages. Snags reads the address of your current tab so it can offer to start an audit, and keeps nothing from it otherwise.

What a comment includes

Your comment, the page's address (query strings and fragments removed) and title, and the element you pointed at.
A screenshot of the visible page. Typed values in form fields are hidden, and areas a site marks as private are blanked.
A replay of the moments before the comment: what changed on the page, scrolling, clicks and the pointer. Typed values and private areas are masked, and Snags’ own toolbar is left out.
Console errors and failed network requests from about 30 seconds before the comment. Tokens, keys, passwords and email addresses in them are redacted before they leave your browser.
Device details: browser and version, operating system, screen size, zoom, viewport, language, time zone and colour scheme. No IP address, cookies or browsing history.

Where it's kept

Comments stay in your browser until you publish. Publishing uploads them to Snags, hosted on Cloudflare. Anyone with the link can open it, and, for audits shared on Pro or Team, AI tools can read it through the Snags MCP server when given the link. Pro and Team links can require a password.

Your account is your email address and, on Pro or Team, your branding (name, colour, logo).

Workspaces and discussion

An audit shared into a workspace is seen by its members, and by clients the workspace has given access to that site. They see each other's email addresses. Replies under a comment, who it's assigned to and who checked a fix are seen only by those people and the audit's author, never by others with the link. When you invite someone, Snags emails them an invitation; accepting it signs them in.

Snags emails the people working on an audit when someone replies, mentions or assigns them, or changes a comment's status. Every such email has a link to stop them. Linked issues' status is read back from their tracker every 15 minutes.

Access tokens you make let a coding agent act as you over the MCP server, only on audits you work on. Snags keeps only a hash of each token; revoke them at any time.

Who else handles it

Cloudflare hosts Snags and stores audits. Like any web host it sees IP addresses to serve requests; Snags doesn't store them.
Amazon Web Services (SES) delivers sign-in emails, invitations and notices about comments.
Stripe handles payments for Snags Pro and Team. Snags never sees your card details.
Linear, GitHub and Jira, only if you or your workspace connect them and create an issue: the comment, its screenshot link and a link back are sent to that tracker, and the issue's status is read back.

Snags doesn't sell data, show ads or use what you capture to train AI models.

How long it's kept

Free links last 7 days. Their comments, screenshots and replays are then deleted; a record that the link existed (its title) is kept for 180 days so the link can say it expired.
Pro and Team links, and links in a Team workspace, last until they're deleted, or the account or workspace is.
Unpublished drafts uploaded while you work are deleted after 7 days.
Sign-ins end after 90 days without use.

Your choices

In Snags, Account → Your data lets you export everything as a file or delete your account. Deleting removes your shared audits, screenshots, replays, replies, logo, tracker connections, access tokens and billing record; links stop working. Cancel your plan and delete any workspace you own first.

For anything else, or a request under data protection law, email privacy@snags.com.