Snitch

Privacy Policy

This Privacy Policy explains what data Snitch (the "Service") collects and how we handle it. It covers two very different kinds of data: your account data, for which we are the controller, and callback data you capture from targets, for which you are the controller and we act as a processor on your behalf.

1. Account data we collect

• Email registration: email address, optional display name, and a securely hashed password (scrypt — we never store your password in plaintext). Email registration requires a verification code. Unconfirmed registrations expire after 30 minutes and are periodically purged; protected backup copies follow the backup retention cycle. A short-lived, strictly necessary browser cookie binds the code to your registration. We store the verification time when registration succeeds.
• Telegram sign-in: if you choose Telegram, we store your numeric Telegram account identifier, optional username and the association with your Snitch account. Telegram registration does not require an email address or a password. A separate, short-lived browser cookie and explicit approval in the bot confirm each login or account link. Telegram sign-in does not disable an existing second factor.
• Password recovery: reset codes expire after ten minutes. We retain hashed, one-time verification data and temporary abuse-prevention counters. Successful password recovery or change revokes existing sessions and replaces the API key while retaining configured second factors.
• Security: two-factor secrets/recovery hashes and passkey public keys, if you enable them.
• Usage: session cookies (strictly for authentication), your plan and access period, and basic request metadata such as IP address for security and abuse prevention.
• Payments: we do not receive or store your card or wallet details. Crypto payments are processed by Heleket, which sends us only the payment status and order reference needed to activate your access.

2. Callback ("hit") data

When a payload you planted executes, the Service records data from the page it fired on. This may include the page URL, referrer, non-HttpOnly cookies, local/session storage, form fields, page DOM, a screenshot, and the visitor's IP and user-agent. You choose where to plant payloads and are the controller of this data. We store it to display it in your authenticated account and send notifications. Captured contents are not included in email notifications or website analytics. You must only capture such data from systems you are authorised to test, and handle it lawfully.

3. How we use data

We use account data to operate the Service, authenticate you, provide support, process subscriptions, and keep the platform secure. We use callback data only to present your captures to you. We do not sell any data or use it for advertising.

4. Optional website analytics

We run Matomo on our own infrastructure to understand page visits, referring website origins, browser/device categories, approximate geography, and use of features such as registration, subscriptions and reports. Signed-in activity uses a pseudonymous account identifier. Successful server actions are measured separately from interface clicks.

We do not send passwords, API keys, authentication cookies, form values, search text, URL queries/fragments, target addresses, captured cookies, report DOM or screenshots to Matomo. Tracking scripts are not embedded in the callback collector. Analytics cookies, heatmaps and session recordings are disabled. IP addresses are masked before storage, and detailed analytics logs are retained for 180 days; aggregated reports may be retained longer.

You can opt out below. The preference is stored in this browser and, when signed in, in your account. We respect Do Not Track; for authenticated website use, this also records an account opt-out for subsequent server events.

Loading analytics preference…

Change analytics preference

5. Sub-processors

• Heleket — crypto payment processing.
• Telegram — optional bot sign-in and report notifications. Telegram processes your bot interactions and the notifications you choose to receive.
• Our hosting/infrastructure provider also runs our own mail and analytics services; recipient email providers receive notification emails.

6. Retention and deletion

Account data is kept while your account is active. Removing a hit from your dashboard hides it from your view; the underlying record is retained on our servers for a limited period for abuse-handling and dispute purposes and is then purged. You may request full erasure of your account and associated captured data at any time by emailing support@snitch.lc.

7. Security

Passwords are hashed, second factors (TOTP/passkeys) are supported, transport is encrypted with TLS, and access to captured reports is protected by per-hit tokens and account authentication. No system is perfectly secure, but we take reasonable measures to protect your data.

8. Your rights

You may access, correct, export, or delete your account data. If you are a data subject who believes a Snitch user has captured your data without authorisation, contact us at support@snitch.lc and we will investigate and, where appropriate, remove the data and act on the reporting account.

9. Changes and contact

We may update this policy; the "Last updated" date reflects the latest version. Questions or requests: support@snitch.lc.

← Back to Snitch