Privacy

Last updated 21 August 2026

SnapBuddy records your screen and takes screenshots, so it can see whatever you point it at. This page says exactly what it captures, where that ends up, and what leaves your machine. The short version: by default, nothing leaves your machine except a check for a new version.

What the desktop app captures

• Screenshots. “Capture screen” takes the entire monitor — not just the window you were looking at. Anything else on that screen at that moment is in the picture. “Region” briefly reads every connected display so it can show you a frozen image to drag on, then keeps only the rectangle you selected.
• Screen recordings of a monitor, a single window, or a region. There is no time limit and no size limit.
• Your microphone, only if you switch it on for that recording. Off by default.
• System audio — everything your computer is playing — only if you switch it on for that recording. Off by default. On a call this records everyone else on it, and their meeting app will not show its own recording indicator, because the capture happens outside it. In many countries and US states, recording someone without telling them is a criminal offence. Tell them first.
• Your camera, only while you open the webcam bubble for a recording. Off by default.
• An interaction track alongside every recording, in a file ending .events.jsonl. This is always written and cannot be switched off. It contains mouse positions, clicks and the outlines of windows that came to the front. It deliberately contains no keystrokes — not the characters, not the key codes — and no window titles, so nothing in it can reconstruct what you typed or what you had open.
• Basic machine details attached to saved notes: your operating system and its version, the app version, your screen resolutions, your language and your time zone.
• What you type into it — your own notes, card names, and the text on annotations.

Where it goes

Everything stays on your computer. Screenshots and notes live in the app’s own storage in your user profile; recordings are ordinary files in a folder you choose. Saving a card writes three files to a folder you pick: the picture, a Markdown file you can read, and a small .capture.json holding the same thing as data. That third file is what lets a coding assistant read the capture without you pasting it in, and it is described under Reading captures from a coding assistant below.

How long we keep things

Nothing you keep expires on a timer. A bug report from last year is still evidence, so we do not quietly delete it. Nor is there any limit today on how many captures you can hold — that is bounded by your own disk. Per-plan limits are planned and none is in force, so nothing of yours is being counted against one.

When you delete something it goes to the Trash, where it stays for 90 days before it is removed for good. Nothing is deleted from your disk while it is in there — the recording file waits with the card, so restoring one actually gives it back. Filter the board to Trash to restore something, or to delete it immediately and skip the wait. Anything past its 90 days is removed the next time the app starts, and after that it is gone: not by us, not by you, not from a backup you did not take. This applies to all three: the desktop app, the web library and the browser extension. Until August 2026 the extension was the exception and this paragraph said so — deleting a card there was immediate and final. It is not any more: its board has the same Trash filter, the same 90 days and the same Restore, and because a browser extension has no moment it “starts”, it clears what is past the window each time you open the board or the popup. One honest difference, and it is in your favour: the extension never deletes a file from your disk, at any point, not even when the 90 days are up. Everything it writes goes to the folder you chose or to your Downloads, and those are yours — so emptying its Trash removes the card and leaves your files exactly where they are.

The web library works the same way, with one addition: the share page stops working the moment you delete what it points at. Something shared by mistake is out of reach at that address immediately, even though the file itself waits out the same 90 days in case you restore it, and restoring brings the link back with it. One honest edge, and it is wider than a share page: every file you store with us also has its own direct address at Cloudflare — each screenshot, each recording, and any downloadable MP4 generated from one — and those addresses do not expire on their own. Anyone who saved one before you deleted can still open that file until it is removed for good. Anything past the 90-day window is removed the next time someone in your workspace opens the library, and the stored files, the streaming copy and any generated MP4 are removed with it.

Use Delete shown on the desktop board to move cards to the Trash in bulk — it acts on exactly what the filter and the search box are currently listing. Nothing is taken off your disk at that point; the files go when the Trash empties. If you have already saved files to your own folder, those are yours and stay where they are, because they were never ours to delete.

The app also keeps a small rolling log — the current run and the one before it — in its own settings folder, to make a crash diagnosable. It records what the app did, not what you captured.

What leaves your machine

By default, one thing: a check for a new version. A few seconds after the desktop app starts, it downloads a small file from GitHub that says what the newest release is, and compares it with your copy on your machine. That request tells GitHub your IP address, the same as visiting any web page — your version number is not sent. If there is a newer release the app offers it; nothing is installed without you saying yes.

Uploading and sharing are off until you switch them on. Settings has a checkbox for it and two fields underneath — a server address and an API key — all three empty by default, and nothing leaves your machine until all three are set. Once they are, every finished recording is registered with the address you typed — a server you choose, which need not be ours — and then the video file is sent to whatever upload address that server returns, which may be a third-party video host rather than the server itself. A share link comes back and goes to your clipboard. Anyone with that link can watch the recording. Clearing the checkbox or either field stops it.

Turning a recording into a walkthrough sends pictures, not a video. It is a separate press, on the same Sharing switch, and it is worth reading on its own because what it sends is not what the paragraph above sends. From the interaction track already beside your recording, the app cuts one full-resolution screenshot of your screen for each click, and sends them with the position and the time of every one of those clicks. The list of steps goes to the address you typed; each picture then goes to the storage address that server hands back, one at a time, exactly as the video file does. A screenshot of a screen can hold anything that was on it, and is easier to read at a glance than a frame of video. Nothing is sent unless you ask for it, and the same checkbox and fields that stop the recording upload stop this too.

Signing in on the desktop app is optional, and new. You never needed an account to capture, annotate or save, and you still do not — that has not changed. If you press Sign in, the app opens your browser at the server address in Settings and you sign in there, with whatever method you already use. Your password, and a second factor if you have one, are typed into the browser and never reach the app. The browser then hands the app a one-time code, which it swaps with that server for a session. That exchange tells the server your IP address, as any web request does.

What is then kept on your machine, and where. The app stores a refresh token — the thing that keeps you signed in — together with your email address and which plan you are on, in the Windows Credential Manager, not in a file you could open by accident. Your API key, if you use one, moved there too. The short-lived token the app actually makes requests with is held in memory only and is never written down at all. Pressing Sign out deletes the stored entry, not just the session in the running app.

The browser extension

The extension makes no network requests at all. Its security policy contains no remote address, so it cannot send your captures anywhere even by mistake.

It captures the visible area of the tab you are on, and it can record that same tab with its audio — which on a call means everyone on it, with the same warning as above. Recording here is the tab and only the tab. Unlike the desktop app there is no picker and no way to reach another window or a whole screen; the browser hands the extension that one tab and nothing else. What it captures is stored in your browser profile, on your machine.

Developer capture, which is off until you switch it on for one site. When you turn it on for the site you are testing, your browser asks whether to give the extension access to that one site. Nothing is requested when you install it, and turning capture off hands the access back. While it is on for a site, the extension reads that site’s console messages and the addresses, methods, status codes and timings of its network requests, and keeps up to four screenshots taken automatically at moments something failed — only ever of the tab the problem happened in, while that tab is the one you are looking at.

Credentials are removed from the log before it is stored: authorization headers, cookies, and anything shaped like an API key or a token. The screenshots are pictures and nothing can be stripped out of them. All of it is held in memory and cleared when you close your browser, unless you save it onto a card — and none of it is sent anywhere, because this extension sends nothing.

On every site you have not switched it on for, and on every site if you never switch it on at all, the extension runs no code inside the page: the page text, your cookies and anything you type stay out of its reach.

Reading captures from a coding assistant

SnapBuddy ships an MCP server: a small program you can connect to Claude Code, Claude Desktop, Cursor or anything else that speaks the same protocol, so an assistant can read the captures you have already saved to a folder instead of you pasting them in by hand. It is read-only and it makes no network requests of its own — it opens files on your disk and hands back what it finds. It is not running at all unless you have added it to that client’s configuration yourself.

What it changes is who reads your captures, not where they are kept. The moment an assistant asks it something, what it answers with — your note, the page you were testing, and the console messages and request addresses captured from that page — goes to that assistant, and most of them run in the cloud. The file never leaves your disk; the contents do. That is the same trade as pasting a bug report into a chat window, and it is worth knowing that it is the trade. Which assistant, and what that company does with the text, is between you and them.

It can only read what you have saved to a folder — the picture, the notes and the small data file written beside them. Cards that are still only in the app or in the extension are not on your disk, so it cannot see them, and neither can anything you connect it to.

The web app

If you sign in on the web, we store your email address so you can sign in again, and anything you deliberately upload. Sharing is done by an unguessable link; anyone who has the link can open it, so treat one like a password. Who holds it, and where, is below.

What guards that account is held here too. If you set a password, our database provider stores a hash of it and not the password itself. If you turn on a second factor, the secret your authenticator app is set up with is held there as well, and your recovery codes are kept only as digests: each code is shown once, when it is generated, and after that nothing here can print it back. None of it is used for anything but letting you in.

Captions are opt-in, one recording at a time. When you ask for them, Cloudflare, which is already storing that recording, transcribes its audio and attaches the text to the player. You are asked to agree first, and if the recording captured system audio the request says so before you do, because the speech being turned into text may be other people on a call. No searchable copy of the words is kept here: the captions live with the video at Cloudflare, and what this app stores is the language and whether the track is ready.

Three things here can be sent to Anthropic, and each one is a button you press. Asking for one on a capture sends what this app already holds about that capture to Anthropic: its title, type, status and triage state, how long it runs and how large it is, the labels on the marks you drew, and whether the recording had a camera or system audio switched on. The picture, the video and the audio are not sent, and neither is your email address, a share link, or the address of a stored file. What comes back is a draft for you to check, on a page only your own workspace can open.

The three are the bug draft, which writes up a capture as something an engineer can act on; the title and summary, which names what a capture shows; and help with a note, which takes a rough note you have written and turns it into what happened, what you expected, and how to see it again. The first two send only what is described above, which is what this app already holds. The third also sends the words you typed, because rewriting them is the whole point of asking. Nothing goes for any of the three unless you press the button that asks, once, each time. Declining leaves the capture exactly as it was, and none of the three runs on a timer, as you type, or when a page opens.

Why we are allowed to do this

Almost nothing here needs a legal basis, because almost nothing reaches us: what the desktop app captures stays on your machine, and we never see it.

• Your email address, if you sign in on the web — so the account can exist at all. That is performance of a contract: without it there is no account to log in to.
• Anything you deliberately upload or share — same basis. You asked for a link; making one requires holding the thing it points at.
• Captions, and a bug draft, if you ask for one: your consent, given for that capture. Nothing is sent for either unless you ask, and declining leaves the capture exactly as it was.
• The update check — our legitimate interest in your copy being the fixed one. It downloads a file and sends nothing about you but the IP address any download reveals, and it is the only thing the desktop app sends anywhere by default.

No decision about you is made automatically, and there is no profiling. Nothing here is used to score, rank or judge anyone.

Where cloud data is held

Only what you sign in with or deliberately upload ever leaves your machine. When it does, four companies handle it, each acting on our instructions and none permitted to use it for anything else. Your account and the records about your captures are held by Supabase and the site is served by Vercel. The captures themselves are stored and delivered by Cloudflare: screenshots live in its R2 storage, recordings are processed and streamed by its Stream service, and the MP4 offered for download is generated there. When you, or anyone holding a share link, views a capture, the browser fetches the picture or the video from Cloudflare directly, which sends Cloudflare what any web request carries: an IP address, a user agent, and the address of the page doing the asking. The fourth is Anthropic, which holds nothing of yours and receives nothing unless you press one of the three buttons that ask it for something: a bug draft, a title and summary, or help with a note. It then receives only the details listed under The web app above, plus, for the note, the words you typed into it.

The database, including your email address and the records about your captures, is stored in London, United Kingdom (eu-west-2), which is outside the European Economic Area. That is allowed because the European Commission has decided the United Kingdom protects personal data adequately: Implementing Decision (EU) 2025/2574 of 19 December 2025, which runs until 27 December 2031. No further paperwork is needed from you or from us while that stands. If it is ever withdrawn, the fallback is already in place: our database provider’s data processing agreement carries the European Commission’s standard contractual clauses and the UK addendum.

Capture files do not all rest in the same place. Screenshots are stored in a Cloudflare R2 bucket created with a European Union jurisdiction, so those files stay in the EU. Recordings are not: Cloudflare Stream offers no equivalent region control, so a recording is held on Cloudflare’s global network and may rest outside the EEA. We would rather tell you that than round it off. Both are covered by Cloudflare’s data processing agreement, which carries the European Commission’s standard contractual clauses.

Your rights, and how to use them

Because we are established in the Czech Republic, the GDPR applies to everything above. You can ask us to:

• Show you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete it.
• Restrict what we do with it while a dispute is sorted out.
• Hand it over in a portable form — or to someone else, if that is technically possible.
• Object to anything we do on the basis of legitimate interest, which today means the update check.

Write to the address at the bottom of this page and we will do it within 30 days. There is no charge and you do not have to give a reason.

If we get it wrong, you can complain to a regulator, and you do not need our permission or involvement. Ours is the Czech data protection authority, the Úřad pro ochranu osobních údajů (Pplk. Sochora 27, 170 00 Prague 7). You may also complain to the authority in the country you live or work in.

What we do not do

• We do not sell or share your captures, notes or personal information.
• We do not use your captures to train any model.
• We do not track you across other websites.
• There are no ads and no advertising identifiers.

Your choices

• Microphone, system audio and camera are all off unless you turn them on for a particular recording.
• You choose the folder your files are written to, and whether they are written automatically at all.
• You can delete any card, or use Delete shown to delete many at once. Backup exports everything you have as a single file you keep.
• To remove everything, delete your cards, then delete the files in your save and recordings folders. A deleted card waits in the Trash for 90 days, so use Delete forever there if you want it gone now. Two things sit outside those folders and are easy to miss: the rolling log and your settings are in the app’s own settings folder, and the refresh token, your email address and your plan are in the Windows Credential Manager, which Sign out clears.

If you have a web account and want it and its contents removed, contact us at the address below and we will do it.

Children

SnapBuddy is a tool for software teams and is not intended for children under 16. We do not knowingly collect anything from them, and the app has no age or date-of-birth field.

Changes

If this notice changes in a way that affects what is captured or where it goes, the date at the top changes.

Who we are, and how to reach us

SnapBuddy is operated by Cognitively Group s.r.o., the data controller for the processing described here, registered in the Czech Republic under company number 21384754.

Questions about this notice, or a request to see or delete your data: legal@snapbuddy.ai. We will respond within 30 days.