SnapStash AI Privacy Policy

Published: October 31, 2026 Effective date: December 1, 2026 Version: 2.1

1. Overview

Nomad Lab (노마드랩, the "Company") operates the SnapStash AI mobile app and web inbox (the "Service") and complies with the Personal Information Protection Act of Korea and other applicable laws. This Privacy Policy explains what personal information we process, why, how long we keep it, how it is outsourced and transferred overseas, and the rights you have and how to exercise them.

2. Information We Process

2.1 Sign-up and Authentication

Social sign-in: When you sign in with a Google or Apple account, the basic profile information that service provides (email, name, profile photo) may be collected.

2.2 Service Usage

2.3 Device and Technical Information

2.4 When You Use the Web Inbox

2.5 Payment Information

Subscription payments are processed by the Apple App Store or Google Play Store, and subscription status is managed through RevenueCat. We do not directly collect or store payment information such as card numbers or payment passwords.

3. Why We Process Your Information

We use the information we collect only for the following purposes:

3.1 Providing the Service

• Sign-up and authentication
• Saving screenshots, extracting text (OCR), and AI analysis
• Saving links and PDFs and extracting their content, and Discover (web recommendations based on your interests)
• RAG-based search and chat
• Cloud backup, restore, the web inbox, and multi-device continuity for Premium users

3.2 Improving the Service

• Improving quality and developing new features
• Analyzing errors and fixing bugs
• Improving the experience through usage pattern analysis

3.3 Customer Support

• Answering inquiries and providing technical support
• Announcements and notices about changes to the Service

3.4 Marketing (optional)

• Announcing new features (if you agree to push notifications)
• Promotions and discounts (with consent)

4. Disclosure to Third Parties and Outsourcing

4.1 Disclosure to Third Parties

We do not provide your personal information to third parties, except:

• With your prior consent
• When the law specifically requires it, or when requested for an investigation following the procedures and methods set by law

4.2 Outsourcing of Processing

We outsource the processing of personal information to the following providers to run the Service. They process it only as far as the outsourced work requires.

Use for AI training: Anthropic's and OpenAI's API policies, and the Google Gemini API terms for paid services, state that data sent through their APIs is not used by default to train their models (or improve their products). Mistral AI is used under Mistral's API terms, and the only things sent to Mistral are screenshot images from earlier app versions. We do not use your data to train AI models.

4.3 Overseas Transfer of Personal Information

To provide the Service, we transfer personal information overseas to the providers in 4.2 (for processing and storage) as follows.

• When and how: Each time you use the relevant feature, sent over an encrypted network connection (TLS)
• Retention: Until the outsourced work is done, or for the period set by each provider's policy. Data kept in the cloud follows the retention periods in Section 5.
• Recipients' contact: The privacy contact listed in each provider's privacy policy (linked in the table in 4.2)

If you do not want your information transferred overseas, you can stop using the relevant features (AI analysis, saving links, Discover, chat, etc.) or delete your account. In that case, the core features of the Service will not be available.

5. Retention and Deletion

5.1 Retention Periods

5.2 Deletion Procedure

• When you delete your account: Your saved items, chat history, search index, images and PDFs stored on our servers, and account information are deleted immediately. Account-related records such as interests, notification tokens, and Discover recommendations are deleted within 30 days of account deletion. Data left on your device is removed when you delete the app.
• If the Service shuts down: We will give notice 90 days in advance and delete all data within 30 days of the shutdown date.
• Information we must keep by law is stored separately from other data, only for the required period, and then deleted.

5.3 Deletion Methods

• Electronic files: permanently deleted in a way that cannot be recovered
• Printed material: shredded or incinerated

6. Data Location and Security Measures

6.1 Where Data Is Stored

6.2 Security Measures

We take the following technical and administrative measures to protect personal information:

• Encryption in transit: All data is encrypted in transit over TLS/HTTPS.
• Encryption at rest: Data stored in the cloud is encrypted with AES-256.
• Access control: Security rules allow only authenticated users to access their own data.
• Data isolation: Each user's data is isolated and managed by a unique identifier (UID).
• Secret management: API keys for outside services are kept in a dedicated secret store, never in the app or web code.
• Least privilege: Access to systems that process personal information is limited to the Privacy Officer.

7. Your Rights and How to Exercise Them

You can exercise the following rights over your personal information:

7.1 Right of Access

• You can review the personal information we process.
• You can view your saved stash and chat history in the app.

7.2 Right to Rectification

• You can request correction of inaccurate personal information, and you can edit the title and note of a saved item yourself in the app.

7.3 Right to Erasure

• You can delete individual stash items or chat sessions yourself.
• You can delete your account in the app's settings to remove your data.

7.4 Right to Suspend Processing

• You can request that processing of your personal information be suspended.

7.5 Right to Data Portability

• You can move your saved items to other apps with the app's Markdown export. For other formats or all of your data, please send a request by email.

7.6 Right to Withdraw Consent

• You can withdraw consent to processing for marketing purposes at any time.
• You can turn off push notifications in your device settings.

7.7 How to Exercise Your Rights

• Email: jojorang89@gmail.com
• Response time: within 10 days of receipt
• You can also exercise your rights through a legal representative or someone you have authorized.

8. Children's Privacy

SnapStash AI is not intended for children under 14. If we learn that a child under 14 is using the Service, we will delete that child's personal information immediately.

If you are a parent or guardian and learn that your child's personal information has been collected, please contact us right away to request deletion.

9. Automatic Collection Tools

9.1 Mobile App

The SnapStash AI mobile app does not use web cookies. Instead, it uses:

• Local storage: A local database (Hive) on your device to store app data. SQLite data from earlier versions is read only to move it to the new storage.
• SharedPreferences: To store your settings and app state.

9.2 Website and Web Inbox

• Language cookie (NEXT_LOCALE): Remembers your chosen language for one year. You can block cookies in your browser settings; pages then show in the default language.
• Sign-in state: Browser storage keeps you signed in.
• Vercel Web Analytics: Counts anonymous visits without cookies.

9.3 App Analytics

We use Firebase Analytics to improve the Service. It collects:

• App usage patterns (screen views, feature use)
• Device and OS information

If you do not want analytics data collected, please turn on your device's limit ad tracking setting.

10. Automated Decisions

We do not make decisions that significantly affect your rights or obligations using fully automated systems such as AI alone. AI is used only to organize your saved items (titles, summaries, tags) and for search and recommendations, and you can review, edit, or delete the results yourself.

11. Changes to This Policy

This Privacy Policy may change in line with laws, policies, or changes to the Service.

• Significant changes: We will notify you at least 30 days in advance in the app or by email.
• Minor changes: We will notify you at least 7 days in advance in the app or by updating this document.

If you do not agree with the revised policy, you can stop using the Service and delete your account.

12. Privacy Officer

For questions, complaints, or remedies about how your personal information is handled, please contact:

13. Remedies for Infringement

If you need to report or get advice about an infringement of your personal information, you can contact the following Korean agencies.

14. Business Information

Revision History