Privacy policy

Snip is a product name of, and is operated by, Elowin Labs LLC. References to "Snip", "we" and "us" mean Elowin Labs LLC doing business as Snip. This policy explains what we collect when you use the website, the API, the MCP server and the dashboard, why we collect it, and how long we keep it.

1. Information we collect

Without an account. A link you shorten on the home page is stored (its destination and its short code) so that it can redirect; your browser keeps a claim code so you can add it to an account later. QR codes from the free generator are made in your browser and are not sent to us. To enforce the daily free limits, we keep daily counters keyed by a one-way hash of your IP address (never the address itself), which reset every day.

Account information. Sign-in is provided by Clerk, which holds your email address and sign-in methods. We store your email address, the Clerk account identifier, your plan, and the timestamps of account creation and last activity.

Your links. For each link in your account we store its destination, its short code, an optional title, the QR style you saved, whether it is enabled, and when it was created and last changed.

People who open a short link. When someone opens or scans a short link, we record the time, the country, the site they came from (the host name only, never the full address), the kind of device (phone, tablet or computer), and whether they came through the QR code. We do not store their IP address or browser identifier, and we do not set cookies on a redirect. The link's owner sees these as totals.

Your history. When you are signed in, each run on the website is kept so you can come back to it: a short preview of what you entered (the first few hundred characters), its size, the result and the credits it cost, for 30 days or your latest 200 runs, whichever is shorter. You can delete any run, or all of them, from your dashboard.

API keys. Keys are generated from 32 random bytes. We store a SHA-256 hash of the key plus the first twelve characters so you can tell keys apart in the dashboard. We cannot recover a key after it is shown to you once.

API and MCP requests. For each request we record the hour it happened, which key made it, whether it errored, and how many credits it cost. What you send is processed to produce the response and is not stored against your account. A sampled subset of requests (about one in ten, plus every error) is kept for seven days with the path, status, latency and request id, so we can investigate faults.

Billing information. Payments are processed by Stripe. We store the Stripe customer and subscription identifiers, the plan, the period end and a record of each webhook event. We never receive or store full card numbers.

Session and security data. A session record with its creation time, last-seen time, the IP address and the browser user agent, so you can review and revoke sessions. Rate-limit counters keyed by IP address, kept for minutes.

2. How we use it

• To operate the service: run the tools, authenticate keys, apply the free-run and rate limits, count credits and bill correctly.
• To send transactional email: confirmation, sign-in links, password resets and account notices.
• To detect and prevent abuse, fraud and denial-of-service against the service.
• To meet legal, accounting and tax obligations.

We do not sell personal information, and we do not use your links, their click records or your account data to train AI models.

3. Service providers

Running the service involves a small set of processors, each under contract:

• Cloudflare: hosting, edge compute, the database.
• Clerk: sign-in and account security.
• Stripe: payment processing, subscriptions and the billing portal.
• Resend: delivery of transactional email.

4. Analytics

We use Plausible Analytics: privacy-first, cookieless, EU-hosted, aggregate page counts only. It sets no cookies, collects no personal data and does no cross-site tracking, so no consent banner is required.

5. Retention

• Account records: for as long as the account exists.
• Hourly usage totals and the credit ledger: for as long as the account exists, for billing history.
• Your history of website runs: 30 days, or your latest 200 runs.
• Links: until you delete them or close the account.
• Click and scan records: 400 days.
• Free-run counters: one day.
• Sampled request records: seven days.
• Sessions: until they expire or you revoke them.
• Email tokens: minutes to hours, then deleted.
• Billing records: as long as tax and accounting rules require.

Deleting your account removes your profile, keys, history, sessions, credit ledger and usage rows, and your sign-in account at Clerk. Subscriptions are cancelled at Stripe. This cannot be undone.

6. Your rights and choices

Depending on where you live you may have rights to access, correct, export or delete your personal data, to object to or restrict processing, and to withdraw consent. You can change your email, change your password, revoke sessions and delete your account yourself from the dashboard. For anything else write to hello@elowinlabs.com.

If you are in the European Economic Area or the United Kingdom you may also lodge a complaint with your local supervisory authority.

7. Security

Passwords are hashed, never stored in the clear. API keys and session tokens are stored only as SHA-256 hashes. Sessions use HttpOnly, Secure, SameSite cookies. All traffic is HTTPS with HSTS. Administrative access is limited to named accounts and every administrative change is written to an audit log.

8. International transfers

The service runs on a global edge network, so data may be processed in countries other than your own. Where required we rely on standard contractual clauses with our processors.

9. Children

The service is not directed to children. You must be at least 13 years old to hold an account, or older where your jurisdiction requires it. We do not knowingly collect data from children.

10. Changes

We will update this page when the service changes. Material changes are announced by email to account holders. The date at the top always reflects the last substantive change.

11. Contact

Elowin Labs LLC, hello@elowinlabs.com.