Privacy Policy

• Account information: email, name, password hash
• Billing information: handled by Stripe (we do not store card data)
• Server credentials: encrypted with AES-256-GCM
• Backup metadata: job names, run status, timestamps, file sizes
• Usage data: backup runs, API calls for plan enforcement

• The contents of your backup files (they go directly to your storage)
• Your database records or application data
• Raw credentials in any unencrypted form

We use your data to:

• Provide the backup service
• Send backup alerts and notifications
• Enforce plan limits
• Improve the service
• Comply with legal obligations

All sensitive credentials are encrypted with AES-256-GCM. Passwords are hashed with bcrypt. We use TLS for all data in transit. We do not log sensitive values.

• Stripe: payment processing
• Resend: transactional email
• Sentry: error tracking (no PII in error context)
• Google Analytics: website analytics, and only on our public marketing pages. It runs unless you opt out, and there is a one-click opt-out on our Cookie Policy page — use it and no Google script runs and no Google cookie is written. Analytics never runs inside the application, so how you use VPS Snaps once signed in is not measured or shared. See our Cookie Policy for the cookies involved, and Google's Privacy Policy for how they process it.
• Reddit: advertising measurement, on exactly the same terms as Meta below. On our public marketing pages the Reddit pixel tells Reddit that this browser visited this site, that it viewed the pricing page, and that an account was created if you sign up. Those are bare facts with nothing attached: no email address, no name, and nothing about your account or what you back up. It runs unless you opt out, and the one-click opt-out on our Cookie Policy page stops it. Separately, and regardless of that choice, when a payment succeeds we report the purchase to Reddit from our servers if you arrived by clicking one of our advertisements; that report carries your email address in hashed form and the amount. If you did not arrive from one of our advertisements, nothing is sent. See our Cookie Policy for the cookies involved, and Reddit's Privacy Policy for how they process it.
• Meta: advertising measurement, in two separate ways. On our public marketing pages the Meta pixel tells Meta that this browser visited this site, that it viewed the pricing page, and that an account was created if you sign up — which lets us tell whether our advertising works and show a follow-up advertisement to someone who has already read a page here. Those are bare facts with nothing attached: no email address, no name, and nothing about your account or what you back up. It runs unless you opt out, and the one-click opt-out on our Cookie Policy page stops it — use it and no Meta script runs and no Meta cookie is written. Separately, and regardless of that choice, when a payment succeeds we report the purchase to Meta from our servers if you arrived by clicking one of our advertisements; that report carries your email address in hashed form and the amount, and nothing about your account or what you back up. If you did not arrive from one of our advertisements, nothing is sent. See our Cookie Policy for the cookies involved, and Meta's Privacy Policy for how they process it.
• Cloudflare Turnstile: we use Cloudflare Turnstile to verify visitors on our sign-up form and protect against bots and abuse, without requiring visible challenges. Turnstile may collect certain visitor data (such as IP address, device and browser characteristics, and timezone) to perform this verification. See Cloudflare's Turnstile Privacy Policy for details on what is collected and how it is processed.

We retain your account data for as long as your account is active. Upon account deletion, we remove your personal data within 30 days. Backup metadata is deleted with your account.

You may request a copy of your data, correction of inaccuracies, or deletion of your account by emailing [email protected].

For privacy questions, contact [email protected].