Privacy policy
Last updated: 9 November 2026
The short version
- Snap2Link has no tracking, no analytics and no advertising.
- An account is optional, and only asks for your email address.
- The app runs on your computer or your Android phone. Your settings stay there.
- With Google Drive, captures go to your own Drive and never pass through us.
- With Snap2Link hosting, a capture is kept for 24 hours at most, or 48 hours with a free account.
- We never store your IP address, and we collect nothing about your device.
Who is responsible
The controller of the data described here is Steven Abittan, an individual based in Israel. For any question, write to contact@snap2link.app.
The website
snap2link.app has no analytics and sets no cookies of its own. If you sign in to your account page, at snap2link.app/account/, our server i.snap2link.app sets one cookie that keeps you signed in. It is needed for the page to work, holds nothing else, and lasts 30 days or until you sign out. The page keeps the language you choose in your browser. Cloudflare delivers the site and processes your IP address to do so and to protect it. On the home page, your browser asks GitHub for the number of stars and downloads, so GitHub sees your IP address.
The app on your computer
Settings, shortcuts and tokens are stored on your computer. The app sends us no telemetry. It checks GitHub for updates, so GitHub sees your IP address. Captures are temporary files, removed after they are sent or the next time the app starts.
The Android app
The Android app only reads the image you share with it or pick in it. It keeps its tokens and your email address on your phone, outside Android's backups, and sends us no telemetry. If you choose Google Drive, Google Play services keep the Google token on your phone. If you ask it to delete a screenshot from your gallery, Android asks you to confirm first. The app doesn't check for updates: you download new versions from GitHub, which then sees your IP address.
Google Drive
If you choose Google Drive, the app connects directly to your Google account. It asks for two
permissions: access to the files it creates (drive.file), and your email address,
shown in the settings. Your Google token stays on your computer or phone. Captures go to your Drive
with a public link, and we never receive them. Google's privacy policy applies.
Snap2Link's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Snap2Link hosting
If you choose Snap2Link hosting, with or without an account, we keep the following.
| Data | Why | How long |
|---|---|---|
| The capture, its link, size and dates | To give you a link (performance of the service) | The link stops at 24 hours (48 hours at most with a free account), or when you press Delete. The data is erased at the next cleanup, which runs every 30 minutes. |
| A code that lets you delete the capture, stored as a hash | So that only you can delete it (performance of the service) | Same as the capture |
| A random guest token, stored as a hash | To apply daily limits and stop abuse (legitimate interest) | 90 days. Your copy stays on your computer or phone. |
| Which guest sent a capture | To act on a report (legitimate interest) | Same as the capture |
| Daily counters, tied to a secret hash of your address block | To apply daily limits (legitimate interest) | Until the next cleanup after midnight UTC. The hash changes every day. |
Anyone who has the link can see the capture. We don't look at captures, unless one is reported to us or the law requires it.
Some apps, such as WhatsApp, show a thumbnail of the capture next to the link. They keep it on their side: it can stay visible in the chat after the link ends, and we can't remove it.
The Snap2Link account
A free account raises the limits of Snap2Link hosting. It is optional. If you create one, we also keep the following.
| Data | Why | How long |
|---|---|---|
| Your email address, your plan and the date the account was created, and the display name and language you choose, if you do | To provide the account and write to you about it (performing the service) | Until you delete the account. A free account with no active session is deleted a year after it was created. A banned account is kept so that it can't come back (legitimate interest). |
| A sign-in code and a secret hash of your address | To check that the address is yours (performing the service) | The code works for 10 minutes. It is erased at the next cleanup. |
| A session token, stored as a hash | To keep you signed in (performing the service) | One year in the app, 30 days on the website, or until you sign out. We also keep where and when each session was opened, so that you can see it and close it. |
| Which account sent a capture | To limit its active links and handle a report (legitimate interest) | Same as the capture |
We only record your address once the code is used. To send it, we give your address and the code to Resend, which keeps its sending logs for up to 30 days. We use your address for sign-in codes and to write to you about the service, for example if these terms change or if there is a problem with your account. We don't use it for advertising.
You can also sign in with Google, in the app or on your account page. Google then gives your email address, with no access to your Drive, and our server receives signed proof of that address. We don't keep that proof, and we use the address as for an account created with a code. On the account page, Google's button is loaded from Google, which sees your IP address.
You can sign out or delete your account from the app or from your account page. On that page, you can also change your address, once a code confirms the new one, and download your data. Deleting the account erases it, its sessions and its captures. The day's counters stay until the next cleanup after midnight UTC.
The security check
Before your first upload to Snap2Link hosting or your first request for a sign-in code, and when your guest token expires, a window runs Cloudflare Turnstile to tell people from bots. It usually needs no click. Turnstile processes signals such as your IP address, TLS fingerprint and browser user agent, not to identify you but to detect bots. Our legitimate interest is to protect the service from abuse.
Cloudflare acts as our processor for this check, and as a controller when it uses these signals to improve Turnstile. See the Turnstile Privacy Addendum.
Reports
If you report content, we keep your message and contact details to handle it and to keep proof of what we did, for up to one year.
The Claude Code plugin
The plugin from the Claude directory sends the link to our server, which fetches the capture from our hosting or from Google Drive, reduces it if it is large and returns it to Claude. We keep neither the link nor the image, and we don't log the address that connects. The version you install by hand runs on your machine: it downloads the capture itself, so the host sees your IP address, and a capture over 3.5 MB stays in your temporary folder, readable only by you. What you do with a capture in an AI tool is covered by that tool's own policy.
Who else handles data
- Cloudflare: website, Snap2Link hosting, security check.
- Google: only if you choose Drive or sign in with Google.
- GitHub: downloads, updates, and the counters on the home page.
- Resend: sending sign-in codes, only if you create an account.
These companies are based in the United States and may process data outside the European Union, under the safeguards described in their policies. We sell no data.
Your rights
You can ask to access, correct or delete your data, to restrict its use, to object to it, and to receive it in a portable format. Write to contact@snap2link.app. If you have an account, write from its address. Without one, we usually can't connect data to you unless you give us the link concerned. You can also complain to Israel's Privacy Protection Authority, or the data protection authority of the country where you live.
Changes
If this policy changes, the date at the top changes too. See also the terms and the legal notice.