Privacy policy

This policy explains what personal information Snaglist handles, why, who processes it on our behalf, who else can see it, and how to delete it. It covers the Snaglist app, the Snaglist portal (the web browser version for companies), Contractor links, this website and demo enquiries.

The account, sharing and online storage services described here are part of Snaglist 2.0 and later.

1. Who we are and our role

Snaglist is provided by Reeve Technologies Ltd (“Snaglist”, “we”, “us”, “our”), a company registered in England and Wales with company number 17150847, whose registered office is 66 Paul Street, London, EC2A 4NA, United Kingdom. Snaglist is a trading name of Reeve Technologies Ltd.

The Snaglist app is distributed on the App Store under the individual Apple developer account of Daniel McCann, so the App Store shows him as its seller. The service described here, including your account, is provided by Reeve Technologies Ltd.

For anything about this policy or your information, email support@usesnaglist.com. Please send all correspondence to this email address.

Snaglist is responsible for how we use your account information, subscription administration, security records, support correspondence and demo enquiries. For that information we act as a data controller. When a business uses Snaglist to manage its projects, that business normally decides why project records and people’s details are used; we process those records on its instructions to provide the service. Your employer or the business running the project may therefore be responsible for some information about you. Contact us if you are unsure who to approach.

2. In short

• You can use the Snaglist app on your device without an account. A project set to “On this device only” is not uploaded to Snaglist.
• When you sign in and save a project to a workspace, the project and its snags, photographs and drawings are stored on our service, so that you and the people you give access to can use them on other devices and in the Snaglist portal.
• For project records a business keeps in Snaglist, that business normally decides how they are used, and we act on its instructions (section 1).
• A Contractor link shows the snags you choose to anyone who holds the link, without an account. Section 4 sets out exactly what it shows.
• The site location you pick on a map is stored and uploaded at full precision. Snaglist never reads your device’s location.
• You can sign in with Apple, with Google, or with a sign-in link sent to your email address. If you choose Google, Google shares your name, email address and Google account identifier with us (section 3).
• We do not sell personal information, show advertising inside Snaglist, or track you across other companies’ apps and websites. We advertise Snaglist on other services; if you request a demo through LinkedIn, section 3 explains how we use that enquiry. Snaglist 2.0 uses no analytics services to study how you use Snaglist. Versions of the app before 2.0 record some usage events (section 3, “App versions before 2.0”).
• You can delete your account in the app or the portal (section 11).

3. What we collect and why

Using Snaglist without an account

Projects, snags, photographs and drawings you keep only on your device stay on your device; Snaglist does not receive them. Map searches, dictation and subscriptions work as described below whether or not you have an account.

Your account

When you create an account we collect:

• your name and email address;
• the identifier from the way you sign in, in the app or in the Snaglist portal: Sign in with Apple, Sign in with Google, or a sign-in link sent to your email address. If you use Hide My Email with Apple, we receive Apple’s relay address rather than your own;
• for Sign in with Apple, a token from Apple that we store encrypted, so that we can revoke Snaglist’s access to your Apple sign-in when you delete your account;
• the sessions that keep you signed in to the app and the portal;
• the companies you belong to and your role in each;
• whether you have Snaglist Pro, and when we last checked.

We use this to run your account, keep it secure and give you the features you are entitled to.

Sign in with Google

The first time you choose Sign in with Google, in the app or in the portal, Google shows you what it will share with Snaglist and asks you to agree. We ask only for Google’s basic sign-in permissions (openid, email and profile). With them Google shares your name, your email address and whether Google has verified it, and your Google account identifier. Google may also include your profile picture and language setting, which we do not use or keep. We do not ask for access to your Gmail, contacts, calendar, files or any other Google data.

We use this information to create your Snaglist account or sign you in to it, to fill in your account’s name and email address, and to let you accept a company invitation sent to that verified address. You can also connect Google to an account you already have, in its account settings. We keep your Google account identifier with your account so that we can recognise you next time. We never receive your Google password, and we keep no token that would let us act in your Google account. Information from Google is not used for advertising and is not sold; your name is used like any other account name, for example it is shown to colleagues in a company you belong to.

When you delete your Snaglist account, your Google account identifier is deleted with it. Google keeps its own record that you have signed in to Snaglist, which you can remove in your Google Account settings. Snaglist’s use of information received from Google adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Projects you save to a workspace

A project stays on your device unless you save it to a workspace, either your own or a company’s. When you do, we store the following so that it is available on your other devices, to the people with access to that workspace, and in the portal:

• the project’s name, reference, address, site location, type, dates, status and notes, and the client’s name, email address and phone number if you enter them;
• its snags: reference, title, description, location, trade, priority, due date, cost estimate and actual cost, tags, status, assigned contractor and history;
• photographs, drawings and the pins placed on them;
• comments, review decisions and a record of who did what and when;
• the contractors in your directory: company name, contact name, email address, phone number, trade and notes;
• a random identifier for the copy of the app on each of your devices, sent with every change so that our service can keep your devices in step and never apply the same change twice. The app creates it; it is not read from your device. Snaglist does not collect your device’s advertising identifier, and Snaglist 2.0 does not register your device for push notifications (for earlier versions, see “App versions before 2.0” in this section).

A project’s cover photo, folders and tags stay on your device.

Photographs

Photographs you take or attach in the app are re-encoded on your device before they are saved, so the location and other details recorded by the camera are not kept. Photographs uploaded through a web browser, whether in the portal or by a contractor through a Contractor link, can contain information such as when they were taken, details of the device and the location. We keep the original privately with the project. Normal photo views use a processed copy with that embedded information removed; people with the required project access can also download the original, which may still contain that information. A Contractor link shows only processed copies, never an original.

Site location

When you set a project’s location you choose a point on a map, either by moving the map or by searching for an address. Snaglist stores that point’s coordinates at full precision, and uploads them unchanged when you save the project to a workspace. They are available to everyone with access to the project, and they are not included in Contractor links. To show the map, search for addresses and turn the point into an address, the app uses Apple Maps, which receives your search text and the point you chose. Snaglist never reads your device’s location and does not take locations from your photographs. The site point is stored separately from any location that a photograph’s own file may contain.

Dictation and Face ID

If you dictate a snag description, Apple’s speech recognition turns your speech into text and may send the audio to Apple to do so. Snaglist receives only the text. If you use Face ID to unlock the app, your device handles it and Snaglist receives no biometric information.

Subscriptions

Snaglist Pro is bought through the App Store. Apple takes the payment; we never see your card details. RevenueCat manages subscriptions for us. Its software in the app contacts RevenueCat whenever the app checks whether you have Snaglist Pro, including when the app opens, whether or not you have an account. RevenueCat receives the purchase and renewal details from Apple and an identifier for you (a random one until you sign in, and your Snaglist account identifier after that) so that your subscription follows your account. With each request the app also sends basic details of the device and the app, such as the app and system versions, the device model, your App Store country, your preferred languages and the identifier Apple gives Snaglist for your device (not the advertising identifier). RevenueCat gives us reports of subscription numbers and revenue. Our service checks your subscription with RevenueCat.

Emails

We send sign-in links, company invitations and other service emails through Resend, which receives the recipient’s address and the message and sends them from its Ireland (EU) region. If you use Hide My Email with Apple, Apple’s private email relay forwards them to you.

Support

If you email support@usesnaglist.com, your message and our replies are held in our Google Workspace mailbox.

Demo requests and business enquiries

If you request a walkthrough through our LinkedIn lead form, we receive the first name, last name, email address and company name you submit, together with the date and source of your enquiry. We use them to contact you about the walkthrough and answer your questions. You do not need a Snaglist account. Our founder handles these enquiries in LinkedIn Campaign Manager and our Google Workspace mailbox.

Requesting a walkthrough does not add you to a newsletter or automated outreach sequence. We do not upload these details to advertising audiences or use them to track you across other apps and websites. To ask us to stop contacting you or delete your enquiry, email support@usesnaglist.com. Our legal basis and retention periods are in sections 9 and 10.

LinkedIn collects the form submission before making it available to us and also handles information for its own purposes under its privacy policy, including processing in the United States and other countries. That policy explains LinkedIn’s transfer safeguards and how to exercise your rights with LinkedIn.

Connecting to Snaglist

When your device or browser connects to this website, the portal or our service, the connection’s IP address, browser and device details and the time are processed to deliver and protect the service. We use IP addresses briefly to limit repeated requests, and some security records that include an IP address and browser details are kept for up to 90 days. This website sets no cookies and contains no advertising or analytics software.

App versions before 2.0

Versions of the Snaglist app before 2.0 record usage events such as onboarding, project-creation milestones and purchase outcomes, together with a random app-installation identifier, app version and time. They also save Apple performance and crash diagnostics. They may attempt to send these to Snaglist’s service; failed event requests can remain queued on the device.

Older sign-in and online controls in those versions may attempt network requests when used, including the details you enter or an identity token from Apple. They do not establish that an account or shared project is available. If you grant notification permission, those versions register with Apple and may try to send a device push token to Snaglist. This does not mean online notifications are operating.

Our hosting provider can process connection information even when a request fails. We use operational information that reaches us for the legitimate interests of finding faults and protecting the service, not advertising profiles. For information you previously sent to Snaglist, or if an older in-app account-deletion control fails, contact support@usesnaglist.com. We will identify what we hold and handle your request under your rights (section 14).

4. Contractor links: who can see what

A Contractor link lets you send selected snags to a contractor, who opens them in a web browser. Because a link shows project information to someone outside your account, this section sets out exactly who can see what.

Who can open a Contractor link

Anyone who has the link. The person who opens it does not need a Snaglist account or the app, and a link can be forwarded, so anyone it is passed to can open it too. If you add a PIN of 4 to 8 digits, the PIN is needed as well; send it separately from the link. After five wrong attempts the link is locked for 15 minutes. We store the PIN only in hashed form, never as written.

What it shows

• the project’s name and address;
• the name of the contractor company the link is for;
• for each snag you include, up to 100: its reference, title, description, location, priority, due date and status;
• the photographs of those snags that the link includes;
• the work submitted through that link: notes, photographs, the date and its status, and any reason given when work was sent back.

What it does not show

Other snags in the project, other contractors’ work, internal comments, client contact details, the site’s map location, drawings, or the names and contact details of you and your colleagues.

What the contractor can do

Mark work as started, and submit it with notes and photographs. A submission never closes a snag: it waits for you or a colleague to review it, and only a manager’s decision closes the snag.

What you see about the contractor

You and your colleagues with access to the project see the notes and photographs submitted, and when. We do not ask the person using a link for their name or email address, and we do not store their IP address with the link or with their submission.

How long it works

You choose an expiry of 1 to 90 days, and you can revoke a link at any time. A link also stops working if the person who created it loses permission to share the project or deletes their account, or if the contractor is archived in your directory. A snag drops out of a link if it is reassigned or archived. Once a link has expired or been revoked it shows nothing further, but anything the recipient has already saved or screenshotted stays with them.

How the page protects it

A Contractor link page asks search engines not to index it, loads nothing from other companies, and shows no project details until the link, and any PIN, has been checked. No photograph appears in the preview when the link is pasted into a messaging app. After the correct PIN is entered, a cookie keeps the link unlocked for up to two hours (section 12).

Terms for the person using a link

Someone who uses a Contractor link without an account can read the terms that apply to them, without signing in, in the Contractor link section of our terms.

5. Company workspaces and the Snaglist portal

You can create a company, or be invited to join one. People who manage a company invite others by email address and choose which projects each person can access. An invitation can only be accepted by an account that has confirmed the invited address.

Members see the projects they have access to, including photographs, drawings, contractor details and client details, in the app and in the Snaglist portal, the web browser version at app.usesnaglist.com. Work in a company is shown with the name of the member who did it: snags raised, comments, review decisions and changes.

If a member leaves a company, their account continues and their name stays on the work they did. If a member deletes their account, their work stays in the company’s records with their name replaced by “Former member” (section 11).

A company normally decides how its projects and records are used, and we process them on its instructions to provide the service (section 1). If you want to see, correct or remove information in a company’s records, ask the company first. If you contact us instead, we will pass your request to the company promptly and help it respond, and we will deal directly with anything we are responsible for, such as your account.

6. People whose details our customers enter

Snaglist customers record details about people who do not use Snaglist themselves: contractors (company name, contact name, email address, phone number and notes) and clients (name, email address and phone number). These details are visible to the people with access to the project, and a contractor’s company name also appears on a Contractor link for that contractor. The customer who entered them can correct them in Snaglist. Earlier versions of a record can remain in the change history our service keeps so that every device stays in step, until the workspace the record belongs to is deleted.

The customer who entered these details normally decides how they are used, and we process them on its instructions (section 1). If your details have been entered and you want to see, correct or remove them, ask the customer who entered them. You can also email support@usesnaglist.com; you do not need a Snaglist account. We will pass your request to the customer promptly, help it respond, and act on anything we are responsible for ourselves.

7. Who processes information for us, and who else sees it

We use these providers to run Snaglist:

• Cloudflare hosts this website, our service and the portal, and holds photographs, drawings and other files in private storage.
• Neon hosts the database that holds account and project records, in Amazon Web Services’ London region.
• Apple provides Sign in with Apple and its private email relay for Hide My Email addresses, App Store payments, Apple Maps for the map and address search, and speech recognition for dictation.
• Google provides Sign in with Google in the app and in the Snaglist portal (section 3). In the app, Google’s sign-in software runs only when you choose it, and it then sends Google basic details of your device, such as its system version, which Google handles under its own privacy policy. The portal’s sign-in page loads Google’s sign-in button from Google, which then receives your browser’s details under Google’s own privacy policy.
• RevenueCat manages subscriptions. It is based in the United States.
• Resend delivers our emails.
• Google Workspace holds our support and demo-enquiry correspondence.

When Cloudflare, Neon, RevenueCat, Resend and Google Workspace handle personal information to provide their services to us, they act on our instructions, under written terms that require them to protect it at least as well as this policy does. Each of them also handles some information for its own purposes, such as billing, security and running its own service, as its own privacy notice explains. Apple and Google provide sign-in, and Apple provides Apple Maps, speech recognition and App Store payments, under their own terms and privacy policies.

We also share information:

• with the people you share with: colleagues in a company, and whoever holds a Contractor link you send;
• with the recipients of reports and photographs you export and send, who keep their copy;
• where the law requires it.

We do not sell personal information or share it for advertising.

8. Where information is held, and transfers

Our production database is hosted by Neon in Amazon Web Services’ London region (eu-west-2). Photographs and other files are held in Cloudflare R2 storage. Cloudflare reports Western Europe as the location of our storage buckets. These buckets have no jurisdiction restriction, so this is not a guarantee that all processing stays in the UK or Europe. The backend service is configured to run in Western Europe. Requests reach Cloudflare’s network first, usually at a location near the person connecting, and Cloudflare may process information in other locations to deliver and protect the service. Resend sends our emails from its Ireland (EU) region. RevenueCat is based in the United States.

Our providers may also process information in other countries, including the United States, to operate and support their services. Apple and Google provide sign-in and their other services from their own infrastructure. For transfers that need safeguards under UK law, we rely on these safeguards, set out in each provider’s published terms:

• Cloudflare: its data processing addendum, which forms part of our agreement with Cloudflare, applies the EU standard contractual clauses as amended by the UK International Data Transfer Addendum.
• Neon: Neon is part of Databricks, whose certification under the EU-U.S. Data Privacy Framework and its UK Extension covers Neon.
• Resend: its data processing addendum incorporates standard contractual clauses as amended by the UK International Data Transfer Addendum.
• RevenueCat: its data processing addendum incorporates the UK International Data Transfer Addendum to the EU standard contractual clauses.
• Google Workspace: Google is certified under the EU-U.S. Data Privacy Framework and its UK Extension, and its data processing terms include standard contractual clauses.

Contact support@usesnaglist.com for information about those safeguards.

9. Our legal bases

For the information we are responsible for (section 1), we rely on these legal bases:

• Providing your account and a service you have asked for or bought, such as Snaglist Pro: contract, where the processing is necessary for our contract with you or for steps you ask us to take before entering into one.
• Providing and administering accounts for people who use Snaglist for a business customer: our legitimate interests in providing and running the service that business uses. A business’s contract with us is not a contract with each of its people.
• Keeping accounts secure, investigating misuse and keeping the service reliable: our legitimate interests. We keep security records only as long as section 10 says.
• Administering subscriptions and answering support requests: contract, where you are our customer; otherwise our legitimate interests in dealing with the business or person who contacts us. Records the law requires us to keep, such as accounting records, are kept to meet that duty.
• Meeting a specific legal duty that applies to us, such as answering a valid legal demand or keeping required records: legal obligation.
• Answering a demo request or business enquiry you send us: our legitimate interests in responding to your request and arranging the walkthrough. We limit our contact to that enquiry, and you can object at any time by emailing support@usesnaglist.com.

For project records we process on a business’s instructions, that business decides the legal basis for using them. We do not rely on consent for anything this policy describes, and we do not send unsolicited marketing email through our demo-enquiry process. Where we rely on legitimate interests, you can object (section 14) and ask us for more information.

10. How long we keep information

• Your account: until you delete it (section 11).
• Project records, their photographs and files, and the change history that keeps devices in step: until they are deleted, by you, by your company, or when the account or company they belong to is deleted.
• Earlier copies of records: correcting or removing a record takes it out of the live project, but earlier copies can remain. The change history that keeps devices in step keeps them until the workspace, account or company it belongs to is deleted. Short-lived copies made while a device downloads a project stop working after 30 minutes, but are cleared only when that person next downloads a project or when the project or their account is deleted. For links in the format used before Snaglist 2.0, the report copies made for a link stay until the link, or the account or company it belongs to, is deleted. Archiving a contractor or removing a snag does not by itself remove these copies.
• Sign-in: a sign-in link stops working after 15 minutes, and a portal session after 7 days. A sign-in link requested in the app, with the email address and IP address it was requested from, is deleted within 24 hours. Records of your sign-ins are kept with your account and deleted when you delete it, if not before.
• A sign-in link requested in the portal, or a company invitation, that is never used keeps the email address it was sent to until our next scheduled clean-up, which we are adding in the first maintenance release after launch; it is used for nothing else. Write to support@usesnaglist.com to have it removed sooner.
• Copies of the answers we gave your device when it made a change are kept so that a repeated request is recognised rather than applied twice. From the first maintenance release these copies are reduced after 30 days to an identifier and a fingerprint.
• Security records that include an IP address and browser details: 90 days.
• Records of visits to links in the format used before Snaglist 2.0, which include the visitor’s IP address and browser details: until the account or company the link belongs to is deleted.
• Records of account deletions: the deletion reference and the progress of each step, linked to the former account’s identifier but not to its name or email address, kept for 24 months after the deletion is completed so that we can show it was carried out. The former account’s identifier itself stays for as long as a company’s records still refer to it as “Former member” (section 11).
• Support emails: kept for 12 months after your request is closed, then deleted, unless we need them for longer to deal with a complaint or legal claim. Ask us if you want yours deleted earlier.
• Demo enquiries: we delete our downloaded copies and related correspondence within 90 days of closing the enquiry or your last meaningful reply, unless you become a customer and a record is needed for that relationship, or a complaint or legal claim requires it. LinkedIn separately retains sponsored lead-form submissions for 365 days under its published retention policy. Deleting our copy does not by itself delete LinkedIn’s record; you can request removal from LinkedIn too.
• Emails we send: Resend keeps its record of each email, including the recipient’s address and the message, for about 30 days under its terms. A sign-in link in a kept message no longer works.
• Backups: our database provider keeps a 7-day history of the database so that it can be recovered after a fault, and copies of the database that we make before each release are kept for no more than 30 days. Information deleted from our live database, including a deleted account, can still be restored from that history for up to 7 days after it was deleted. Information deleted after one of those copies was made stays in that copy until the copy is deleted.
• Purchases: when you delete your Snaglist account, our background cleanup requests removal of the RevenueCat customer record associated with it. Apple retains its own purchase records. Deleting your Snaglist account does not cancel your subscription.

11. Deleting your account

You can delete your account in the app’s settings (Delete account) or in the Snaglist portal. You confirm once; there is no waiting period, and the account cannot be restored.

When your deletion request is accepted, your Snaglist account stops accepting sign-ins and your active account profile is removed. Cleanup of your personal workspace and stored files continues in the background. If you used Sign in with Apple, we retain an encrypted credential only while it is needed to revoke Snaglist’s access, and erase that credential when revocation succeeds. Your deletion reference lets you check progress.

In more detail:

• In the same step, access is revoked on every device and any Contractor links you created stop working. A device without a connection loses access when it next connects. Copies already downloaded to a device can remain on it until the app removes them or you delete the app.
• As part of the background cleanup, we ask Apple to revoke Snaglist’s access to your Apple sign-in.
• If you used Sign in with Google, your Google account identifier is deleted with your account. We hold no Google token to revoke; Google keeps its own record that you signed in to Snaglist, which you can remove in your Google Account settings.
• We also ask RevenueCat to remove the customer record associated with your Snaglist account. This is a background step; accepting your deletion request does not mean the provider has already completed it.
• Your own workspace is deleted with its projects, snags, photographs and drawings. Photographs are made permanently unreadable in storage, and drawings and other files are deleted.
• Work you did in a company that stays open stays in that company’s records: the snags you raised, the photographs and drawings you added, your comments and your review decisions. Your name is replaced with “Former member” and your contact details are removed. The decision, the date and a reference remain, so this is not anonymous: the company can still see what was done and when.
• If you are the only owner of a company, you are asked to hand it to another member or to close it before your account can be deleted. Closing a company deletes its projects and records.
• Deleting your account does not cancel an App Store subscription. Cancel it in your Apple account’s subscription settings.
• Copies already sent to other people, such as reports, photographs, or anything a Contractor link recipient saved, stay with them.

12. Cookies and browser storage

This website sets no cookies. The portal and Contractor links use only the cookies they need to work:

• __Host-snaglist_session keeps you signed in to the portal, for up to 7 days;
• __Host-snaglist_login holds a sign-in by emailed link while it is in progress, for up to 15 minutes, and cookies whose names begin __Host-snaglist_google_ or __Host-snaglist_apple_ hold a Google or Apple sign-in while it is in progress, for up to 10 minutes;
• cookies whose names begin __Host-snaglist_link_ keep a PIN-protected Contractor link unlocked after the correct PIN, for up to two hours and never beyond the link’s expiry. Links in the format used before Snaglist 2.0 use a cookie named snaglist_pin in the same way.

All of them are secure cookies that scripts on the page cannot read, and none is used for advertising or analytics. The portal also keeps a small amount of working information in your browser’s storage, such as the reference for an account deletion.

13. Security

Information travels encrypted between your device or browser and our service. Photographs and files are held in private storage and shown only to people with access. Portal session tokens and Contractor link PINs are stored only in hashed form, and Apple sign-in tokens are stored encrypted.

14. Your rights

Under UK data protection law you have the right, in some circumstances, to:

• see the personal information we hold about you and get a copy;
• have inaccurate information corrected;
• have information deleted;
• receive information you gave us in a portable format;
• object to processing based on our legitimate interests, or ask us to restrict processing.

You can delete your account yourself (section 11). For anything else, contact us at support@usesnaglist.com. You do not need a Snaglist account to make a request, for example if a customer has entered your details. We may ask for information to confirm your identity, in proportion to the request.

We reply without undue delay and within one calendar month of receiving your request. If we need information to confirm your identity, the month starts when we receive it. If a request is complex, or you have made several, we may take up to two further months; if so, we will tell you within the first month and explain why. Deleting your account in the app does not wait for this period: it starts when you confirm it.

If a request concerns records that a business keeps in Snaglist (section 1), we will pass it to that business promptly and help it respond, and we will deal directly with anything we are responsible for.

If you are unhappy with how we have handled your information, please tell us so that we can try to put it right. You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, or to the data protection authority where you live.

15. Children’s privacy

Snaglist is not intended for anyone under 16. We do not knowingly collect personal information from children under 16.

16. Changes to this policy

We may update this policy. If we make a change that significantly affects you, we will tell you by email or in Snaglist before it takes effect, where we can. The date at the top shows when this version was published. Changes to this policy do not remove your data protection rights.

17. Contact us

If you have questions about this policy or our data practices, contact us at: