How we protect your data
No vague claims. Here's exactly how we handle sign-in, storage, encryption, and access. We tell you what's protected and what isn't.
How sign-in works
Google OAuth 2.0 with PKCE. No passwords stored. No credentials managed.
Authentication flow
- OAuth 2.0 with PKCE You sign in via Google. We use PKCE (Proof Key for Code Exchange), the same standard used by banking apps.
- JWT token issued After authentication, we issue a signed JWT that validates your identity for 30 days.
- User-scoped data access All data is isolated by user ID from the JWT. Your receipts are only accessible to your account.
- No password storage We never store passwords. Google handles credential verification entirely.
Technical specs
| Authentication | Google OAuth 2.0 with PKCE (S256) |
| Sessions | JWT tokens, 30-day expiration |
| Token encryption | AES-256-GCM for stored OAuth tokens |
| Transport | TLS 1.3 for all API calls |
| Access control | User-scoped data isolation |
How your data flows
From browser to permanent storage, every step secured.
What we store and what we don't
No ambiguity. Here's the complete list.
What we store
- Tweet snapshots as PNG images (Cloudflare R2)
- Metadata: tweet ID, URL, author, text, timestamp, tags
- Account info: email, name, avatar (from Google)
- Billing data: plan, quota usage, history (via Stripe)
- OAuth tokens: encrypted with AES-256-GCM
All records isolated by user ID. Database queries are scoped at the row level.
What we don't store
- Passwords: Google handles all credential storage
- Browsing history or activity outside x.com
- Location data or device fingerprints
- Tracking cookies or analytics pixels
- IP addresses (beyond temporary rate limiting)
No advertising. No tracking. No data mining. We collect only what the service requires.
Where your data lives
Application
Fastify backend on Fly.io with automatic scaling and health monitoring. PostgreSQL database with automated backups.
Uptime: 99.9% SLA | Monitoring: 24/7 alerts
Database
PostgreSQL 15 with SSL/TLS. Automated backups every 6 hours, 30-day retention. Point-in-time recovery for disaster scenarios.
RPO: < 6 hours | RTO: < 4 hours
Object Storage
Cloudflare R2 for snapshot images. Multi-region replication. Immutable storage. Snapshots can't be altered after upload.
Durability: 99.999999999% (11 nines)
Privacy and standards
Privacy compliance
- Right to access: view all data via account dashboard
- Data portability: export everything to JSON
- Right to erasure: contact dpo@snapshot.so for manual processing of deletion requests
- Data minimization: only what's necessary
- Lawful basis: consent for preservation of public discourse
We are building toward full GDPR compliance. Privacy Policy
Security standards
- TLS 1.3 for all data in transit
- OAuth 2.0 + PKCE for authentication
- AES-256-GCM for stored tokens
- PCI DSS: payment via Stripe (Level 1)
- Regular audits of extension and backend
- Responsible disclosure program
Who can see your data
Four levels of access. Clearly defined, no ambiguity.
You
- View all your snapshots
- Search by keyword, author, date
- Export to JSON / CSV
- Delete any snapshot anytime
No other user can see your data. Strict user-scoped isolation.
SnapShot Team
- Database records for debugging
- Logged, time-limited sessions
- Requires two-factor auth
- Only for support or legal reasons
Snapshot images and text are not encrypted at rest. Team can technically access but only does so for valid reasons.
Law Enforcement
- Valid court orders / subpoenas only
- All requests reviewed for legality
- Users notified when permitted
- Public discourse only, no DMs
We never proactively share data. Every request is scrutinized.
Third Parties
- Google: OAuth only (email, name)
- Stripe: Payments (PCI DSS Level 1)
- Fly.io: Hosting & PostgreSQL
- Cloudflare R2: Image storage
No advertising, analytics, or tracking partners. Zero.
Report a vulnerability
We take responsible disclosure seriously. If you find a security issue:
Email: security@snapshot.so (PGP key on request)
Response: Acknowledged within 24 hours
Scope: Extension, backend API, web application, infrastructure
Recognition: Credited in our public hall of fame
Transparent by design.
We document exactly what we store, what we don't, and who can access it. No vague promises. Just verifiable facts.