Privacy Policy

snapgrid lets you build a personal page out of cards and share it at snapgrid.me/yourname. This policy explains, in plain language, what information we handle when you use snapgrid, why we need it, who helps us run the service and what you can ask us to do with your data. It applies to snapgrid.me and to custom domains that point to a snapgrid page.

Questions or requests: privacy@snapgrid.me.

Who is responsible

snapgrid is a small independent service run from Türkiye. For the personal data described here, the data controller under the Turkish Personal Data Protection Law (KVKK, Law No. 6698) and, for people in the European Economic Area and the United Kingdom, under the GDPR is Hüseyin Sezer Yıldırım, Akfırat Mahallesi, 34959 Tuzla / İstanbul, Türkiye. Write to privacy@snapgrid.me; the Turkish notice under KVKK is at /kvkk.

What we collect

Your account

• Email address, to sign you in, confirm that the address is yours, reset your password and send messages about your account (never marketing unless you opt in).
• Password, stored only as a salted one-way hash (scrypt). We cannot see or recover your password.
• Your page name (the handle in snapgrid.me/yourname) and, if you add one, a custom domain.

What you put on your page

• Your display name, bio, profile picture, the cards you add (links, notes, maps, sections) and their layout.
• Images and videos you upload. Before upload, the editor may resize images in your browser; we store the result.
• Your page's visibility setting and, for a private page, a hash of its password. A public page is visible to everyone and may appear in search engines; an unlisted page is visible to anyone with the link but asks search engines not to index it; a private page is visible only to you or to people with its password.

Anything you publish on a public or unlisted page is, by design, visible to the people who open it. Please don't publish personal details about others without their permission.

Link previews

When you add a link, our servers fetch publicly available information about it (title, description, image, icon and, for some platforms, public counts such as followers or stars) so the card can show a preview. For some platforms we use their official APIs, for example GitHub and YouTube. We don't send them anything about you beyond the link itself.

Technical data

• IP address and request details (time, page requested, browser user agent) are processed by our hosting provider to deliver the site, protect it from abuse and enforce rate limits (for example, on login attempts). We keep no long-term analytics profile of visitors.
• Bot protection. Sign-up and password reset forms use Cloudflare Turnstile to check that a human is filling them in. Turnstile looks at signals from your browser for this check only; Cloudflare describes it in its own privacy policy.

Payments

The paid plan (a custom domain for your page) is sold through Paddle.com, which acts as the Merchant of Record: Paddle is the seller you pay, handles the checkout, taxes, invoices and refunds, and processes your card or other payment details under its own privacy policy. We never see or store your full card number. Paddle shares with us what we need to run your subscription: a customer and subscription ID, your plan, its status and renewal dates, and the email address and country you used at checkout.

Cookies

We only use cookies that are needed for the site to work. There are no advertising or tracking cookies.

• sg_session keeps you logged in. It is set when you log in or sign up and removed when you log out.
• sg_pw_… remembers that you entered the password of a private page, so you don't have to type it again.
• Cloudflare may set strictly necessary security cookies (for example for bot protection), and Paddle sets cookies on its checkout.

Some cards embed content from other services (for example a YouTube video, a Spotify player or a map). When a visitor views or plays that content, the other service may receive the visitor's IP address and set its own cookies under its own policy. Map tiles come from OpenFreeMap and place search from Photon (komoot).

Why we use your data

• To provide the service you signed up for (your account, your page, your subscription): this is necessary to perform our contract with you.
• To keep snapgrid secure and working (rate limits, bot protection, preventing abuse and fixing bugs): our legitimate interest in running a safe service.
• To meet legal obligations, for example answering lawful requests from authorities. Paddle keeps the tax and accounting records for purchases.
• With your consent, for anything optional we may add later, such as product news. You can withdraw consent at any time.

We don't sell your personal data, and we don't use it for advertising.

Who processes data for us

We use a small number of providers who process data on our behalf and only on our instructions:

• Cloudflare: hosting (Cloudflare Workers), content delivery, DNS, storage of uploaded files (R2), custom domain certificates and bot protection (Turnstile).
• Neon: our Postgres database, which stores your account and page.
• Paddle: payments, as Merchant of Record (an independent controller for the payment data it collects).
• Our email delivery provider: sends account emails such as address confirmation and password resets.

These providers may process data outside Türkiye and the EEA, including in the United States. Where the law requires it, transfers are covered by safeguards such as the European Commission's Standard Contractual Clauses and the notifications or undertakings the KVKK requires.

How long we keep it

• Your account and page: for as long as your account exists.
• When you delete your account, we delete your account, page and uploads from the live systems. Copies in backups are overwritten within about 30 days.
• Login sessions and one-time links (email confirmation, password reset) expire automatically.
• Security logs at our hosting provider are kept for a short period, typically a few days to a few weeks.
• Paddle keeps transaction records for as long as tax law requires.

Your rights

Depending on where you live, the KVKK (Article 11) and the GDPR give you the right to:

• know whether we process your data and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• receive your data in a portable format;
• object to, or ask us to restrict, processing based on our legitimate interests;
• withdraw consent at any time, where we rely on it;
• learn who your data was shared with, including abroad, and ask for compensation for unlawful processing.

You can change most of your data yourself in the editor. For anything else, email privacy@snapgrid.me from the address on your account. We answer within 30 days, free of charge. You may also complain to a supervisory authority: in Türkiye the Personal Data Protection Authority (KVKK), in the EEA the data protection authority of your country.

Security

Traffic is encrypted with HTTPS, passwords are hashed, sessions are stored as hashes, and access to production systems is limited. No service is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Children

snapgrid is not meant for children under 16, and we don't knowingly collect their data. If you think a child has an account, tell us.

Changes to this policy

If we change this policy, we update the date at the top. If a change matters for how we use your data, we will also tell you by email or in the app before it takes effect. See also our Terms of Service.