Legal

Privacy Policy

Last updated: September 13, 2026

SnapEnv ("SnapEnv", "we", "us") provides a secure environment-variable management service (the "Service") at snapenv.io, dash.snapenv.io, and related subdomains. This policy explains what data we collect, how we use it, and how it's protected — including the encryption model for the variable values you store.

1. What we collect

Account & workspace data — name, email address, password (hashed, never stored in plaintext), workspace and project names, team member roles, and invite records.

Environment variables — the keys and values you store. Values are encrypted before they ever reach our database (see §4); we do not read or use their contents for any purpose other than serving them back to you or your authorized CLI/operator.

Access tokens — CLI/CI/Kubernetes-operator tokens are stored as a salted, hashed digest. We cannot recover a token's plaintext after it's issued.

Audit & usage data — an append-only log of actions taken in your workspace (who changed what, when, from where), used for security review and account activity you can see yourself in the dashboard.

Billing data — if you subscribe to a paid plan, payment is handled entirely by Stripe. We store your plan, subscription status, and Stripe customer/subscription IDs — never your card number.

Technical data — IP address, browser/user-agent, and basic page-view analytics (via Google Analytics) on the marketing site at snapenv.io, and request metadata (timestamps, endpoint, status code) logged by the API for reliability and abuse prevention.

2. How we use it

  • To operate the Service: authenticate you, sync your variables to the CLI/operator, enforce your workspace's permissions.
  • To bill you, if you're on a paid plan, and to enforce plan limits.
  • To send you account, security, and (if you opt in) product-update emails.
  • To detect abuse, debug incidents, and keep the Service secure and available.
  • To understand aggregate usage of the marketing site, via privacy-respecting analytics.

We do not sell your data, and we do not use the contents of your environment variables for advertising, model training, or any purpose beyond delivering the Service to you.

3. Who we share it with

We use a small number of subprocessors to run the Service. Each only receives the data it needs to do its job:

  • Stripe — payment processing for paid plans.
  • Cloudflare — hosting/CDN for the dashboard, admin panel, marketing site, and docs.
  • Our infrastructure provider — hosts the API and encrypted database.
  • Email delivery provider (SMTP) — transactional email (verification, invites, security notices).
  • Google Analytics — aggregate, anonymized traffic analytics on the marketing site only (not the dashboard).

We disclose data to law enforcement only when legally compelled to do so, and will notify affected customers unless prohibited by law.

4. How variable values are encrypted

Every variable value is encrypted with AES-256-GCM before it is written to disk, using a per-project key derived via HKDF-SHA256 from a master key that exists only as an environment variable on the API server — never in the database, never in the CLI, never in a backup of application data. Decryption happens exclusively on the server, only in response to an authorized, permission-checked request. Losing database access alone does not expose your variable values.

5. Data retention

We retain your account and workspace data for as long as your account is active. Audit log entries are append-only and retained for the security and compliance value of an unbroken history. If you delete a project, environment, or your workspace, the corresponding variable values are deleted from active storage; residual copies in encrypted backups age out on our standard backup rotation.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can access and export most of your data directly from the dashboard. To request account deletion or exercise any other right, email us at privacy@snapenv.io.

7. Cookies & local storage

The dashboard stores your session token in your browser's local storage to keep you signed in — it is not a tracking cookie and is not shared with third parties. The marketing site uses Google Analytics, which sets standard analytics cookies; you can opt out using your browser's Do Not Track setting or an ad-blocking extension.

8. Children's privacy

The Service is intended for business and professional use and is not directed at children under 16. We do not knowingly collect personal data from children.

9. Changes to this policy

We'll update the "Last updated" date above when this policy changes, and for material changes we'll notify workspace owners by email.

10. Contact

Questions about this policy or your data: privacy@snapenv.io.