Privacy & Data Trust

This policy describes how we handle data across the Snipset desktop application, the Snipset Android application, the Snipset browser extension for Chrome and Firefox, this website and blog, and the company servers that power licensing, support, updates, the extension's sign-in and AI Chat, and crash analysis.

It is written against UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (Indonesia's PDP Law) for users in Indonesia. If you use Snipset in the European Economic Area, the same practices apply, and we handle GDPR access, erasure, and portability requests through the contact at the end of this page.

The short version: your snippet content lives on your devices, not on our servers. The servers hold a small set of operational records (licenses, support tickets, QA reports, blog analytics, extension sign-in and usage records, and opt-in crash reports) described below, with the retention that applies to each. Content leaves your device for AI processing when you use the browser extension's optional AI Chat, or when you turn on Claude for a desktop feature in Settings; both are described below.

Local storage

Snippets, groups, settings, clipboard history, chat history, and embeddings live in a local SQLite database on your machine. The optional activity journal lives in a separate encrypted database, and secrets such as vault payloads use your operating system's credential store. Local backups are plain files on your disk, so treat copies you move to cloud drives the way you would treat any sensitive file.

Clipboard and keyboard

Clipboard history is on by default and stores what you copy, including the source application. A sensitive-content filter rejects passwords, keys, and tokens before they are written, per-application exclusions are honored, and retention caps prune old entries. The global keyboard hook exists only to match snippet triggers: keystrokes are evaluated in memory and discarded immediately, never logged or stored, and password fields are suppressed by default.

Local AI

By default, text generation and semantic embeddings run against your own local Ollama daemon, so prompts and vectors stay on your hardware. The desktop app sends a request to a cloud AI service only when you turn on Claude for that feature in Settings, and each feature is off by default; the browser extension's AI Chat is a separate feature, described under Browser Extension below. Web-search grounding is off by default; when you enable it, only your query is sent to the provider you choose.

Voice and speech

Speech-to-text runs on your device by default through the bundled local Whisper model, so dictation audio never leaves your computer. One provider is opt-in: if you choose Gemini Cloud and add your own Google API key, dictation audio is sent to Google for transcription and the local polishing step is skipped by default. Your key is stored in the operating system credential store, you can return to the offline engine at any time, and the app shows which engine produced each transcript. Recorded audio and voice history stay in your local app data with a configurable auto-purge, and read-aloud playback uses your system voices.

AI features in the app

Snipset includes optional AI features: generation through the {ai:...} text variable, the AI chat panel, semantic search and embeddings, smart shorthand, snippet generation, and the AI companion. You can use the snippet engine without enabling any of them. In the desktop app, each feature runs only when you turn it on and select a local model.

Where processing happens

In the desktop app, inference runs by default on your own machine through a local Ollama daemon, and nothing leaves your device. In Settings you can turn on Claude for a specific feature; each feature is off by default. When a feature is on, the text of that request (and, for the daily journal only, up to 5 downscaled screenshots) goes to Anthropic's Claude through our own server, a Cloudflare Worker, and daily limits apply. The API key stays on our server and is never in the app. Anthropic deletes API inputs and outputs within 30 days and does not use them to train models by default. AI-generated text is stored in your local database like any other snippet. The browser extension's AI Chat also uses Claude first and switches to Cloudflare Workers AI after the daily Claude limit, as described under Browser Extension below.

What needs the network

In the desktop app, two AI-related paths use the internet. Model files are downloaded through your local Ollama installation, and the optional web-search grounding sends only your query to the search provider you choose. Optional integrations such as Telegram, Todoist, and the video and search proxies are third-party services governed by their own terms. We do not control Ollama or the publishers of the models you download.

Accuracy and human oversight

AI output can be incomplete, outdated, or wrong. Review generated text before you rely on it or publish it. Snipset does not use AI to make automated decisions that produce legal or similarly significant effects about you, and you remain responsible for the content you choose to use.

Transparency and contact

We describe the AI features, data flows, and local-first architecture on this page and on the AI and Benchmark page. This follows the transparency expectations of the EU AI Act and Indonesia's AI ethics guidance. For any AI-related question, use the privacy contact at the end of this page.

Snippets, clipboard entries, preferences, and usage history live in a local on-device database. Text expansion works through the Android Accessibility service, which reads only the currently focused editable field to detect triggers; it does not intercept hardware key events.

The app contacts our servers in exactly two situations: it sends your license code once during onboarding to verify it, and it checks the signed update manifest to offer new releases. The microphone permission is declared for future voice features; no recording code path ships in the current app, so nothing is recorded.

Stays in your browser

Snippets, groups, clipboard history, usage events, and saved AI Chat conversations live in your browser's local database. The extension does not use browser sync storage. Text you type in web pages is matched against your snippets inside your browser and is never sent to us. The extension asks for access to all sites so it can expand snippets wherever you type.

Sign-in

The extension needs a Google sign-in, which happens on this website. The website keeps the profile it receives from Google (email, display name, and avatar address), the same record the community forum uses, and adds an extension account record with an account id and your first and last connection times.

Sign-in token

The extension receives a random token. We store only its SHA-256 hash, together with your account id, the creation time, the expiry (30 days), the revocation time, and the first 200 characters of your browser's user agent. While you are signed in, the extension sends the token to our API every 6 hours to check your account and your daily AI Chat limit, even if you never use AI Chat. Signing out in the extension revokes the token on our server. Expired and revoked records are not purged automatically.

AI Chat

AI Chat is optional. When you send a message, the extension sends the conversation (at most 20 messages and 16,000 characters) and your token to our API Worker, which passes the text to Anthropic's Claude first and streams the reply back. After the daily Claude limit, the Worker sends it to Cloudflare Workers AI instead. Nothing from the page you are on is attached. Anthropic deletes API inputs and outputs within 30 days and does not use them to train models by default, and Cloudflare processes the text under its own terms. In Firefox, the extension asks for your permission before the first message.

What our Worker records about AI Chat

The Worker does not log tokens, prompts, or replies, and it stores no message text. To enforce daily limits it keeps counters per day: messages and model usage per account, per hashed IP address (SHA-256) for free accounts, and one shared free-tier counter. These counters have no automatic expiry; we erase them on a verified request made through the contact at the end of this page.

Your choices

Sign out in the extension to revoke the token. Removing the extension deletes the data kept in your browser. To have your account and usage records erased, use the privacy contact at the end of this page. In Firefox's built-in data collection consent, the sign-in token is declared as required data (authentication information) and AI Chat messages as optional data (personal communications).

Analytics

Analytics and conversion measurement on this site (Cloudflare Web Analytics, Google Analytics 4, and Meta Pixel) run only after you choose Accept All in the cookie banner. Until you grant consent, no analytics or marketing scripts load. Choosing Essential Only ensures no tracking scripts or advertising cookies are loaded.

Cookies and browser storage

We set three first-party cookies: language preference (30 days) and your cookie and analytics choices (1 year). Your theme lives in local storage, marketing attribution parameters live in session storage for the active visit only, and the QA self-assessment tool keeps its session token in your browser. Clearing cookies resets every choice.

Forms

The contact form collects your name, email, and message so we can reply; a copy is forwarded to our inbox through our email provider. The support flow verifies your license code first and then stores your ticket. Live-demo registration collects your name, email, and phone number and forwards them to our automation; it is not stored in our database. The download gate collects only your license code. There is no newsletter and no marketing use of form data.

License registry

When you activate, we store your license key, the owner name and email supplied at purchase, and one hashed machine identifier per activated computer. The identifier is derived from a one-way hash, so raw hardware details never reach us. These records support license recovery after a reinstall and stay for the life of the license; owner email and name are erased on a verified data-subject request.

Support tickets

Tickets contain whatever you write, plus an optional name and email. Contact-form submissions are also forwarded to our inbox by email. Tickets are deleted automatically after 730 days.

QA reports

Tester reports contain the identity you type (name, role, email, phone), your checklist answers, and your browser user agent. Drafts are deleted after 90 days and submitted reports after 365 days.

Blog analytics

Each blog view records the article, timestamp, and technical request details. Raw addresses and user agents are anonymized after 30 days, keeping only aggregate counts and dates.

Crash reports

Crash reports exist only if you opt in inside the app. Each report carries a random device identifier, app and OS version, and a sanitized message with a stack trace. Reports and any stored full traces are deleted after 90 days.

What we never log

Our servers do not log request bodies. Short-lived rate-limit records keyed by address expire within about a minute and are never used for profiling.