Privacy Policy

• Account information: email, name, password hash
• Billing information: handled by Stripe (we do not store card data). Stripe also receives your card's country and postal code and your IP address, to work out any sales tax or VAT
• Server credentials: encrypted with AES-256-GCM
• Access to the cloud, DNS and storage accounts you connect: OAuth tokens or API keys, encrypted with AES-256-GCM (see Data From Your Cloud Accounts below)
• Backup metadata: job names, run status, timestamps, file sizes
• Usage data: backup runs, API calls for plan enforcement
• One-way hashes of your email address, signup IP address and network, and of the servers, cloud accounts, storage accounts and sites you add, to keep the free plan to one account per person (see One Free Account per Person below)

• A copy of your backups, your database records or your application data. Backups are kept in your own storage. Some backups and restores stream through our worker on the way — a Railway database connected without admin access, a Railway or Render dump the platform will not run in your account, and an SSH backup whose server cannot upload it itself — and while they do, the data is held in memory only: never written to our disks and never retained. Section 4 of the Data Processing Agreement sets out which paths do.
• Raw credentials in any unencrypted form

We use your data to:

• Provide the backup service
• Send backup alerts and notifications
• Enforce plan limits, including one free account per person or organisation
• Improve the service
• Comply with legal obligations

All sensitive credentials are encrypted with AES-256-GCM. Passwords are hashed with bcrypt. We use TLS for all data in transit. We do not log sensitive values.

When you connect a cloud provider, a DNS provider or a storage account, we keep the access it grants — an OAuth token, or the API key you paste — encrypted with AES-256-GCM, and use it only to do what you set up: list the servers, databases or domains you choose from; create backups and snapshots in your own account on your schedule, and delete the ones past the retention you set; and, when you ask, build a recovery server or move traffic to it. From those accounts we keep what running your jobs needs: the names and IDs of the resources you choose, and the names, sizes and status of the backups made. Disconnecting deletes the stored token or key, and you can revoke our access at any time in the provider's own account settings.

How we handle data from Google Cloud and Google Drive is set out in full under Google User Data below.

Box

VPS Snaps asks for access to your Box account only when you add Box as a storage destination, by signing in with Box.

• What we access: your Box account's login email address, to show which account a destination belongs to; the largest file your Box plan accepts, so a backup too big for it is refused before it is uploaded (Box's answer also says how much storage the account has and uses, which we do not keep); and your files and folders. Box grants access to all files and folders, read and write (root_readwrite), because Box has no narrower permission for an app, like Google Drive's access to only the files an app creates.
• How we use it: only inside the folder you name for the destination, and our code keeps to that folder. We make it and a folder per backup job inside it; store your backups there; read a backup back to check it against the SHA-1 Box records for it, or to restore it when you ask; and delete backups older than the retention you set, purging them from Box's trash so the space is freed.
• What leaves VPS Snaps: to upload a backup, your server, agent, WordPress site or dump container gets a token that Box limits to that job's folder, valid for about an hour. To download one, it gets only Box's own pre-authorised download link, which lasts about 15 minutes, and no token.
• How we protect it: Box access and refresh tokens are encrypted with AES-256-GCM before they are stored, and travel only over TLS.
• How long we keep it: the tokens and the account's email address are kept while the destination exists. Deleting the destination in VPS Snaps deletes them and revokes our access at Box. The backups already in your Box stay there, and are yours.

Dropbox

VPS Snaps asks for access to your Dropbox only when you add Dropbox as a storage destination, by signing in with Dropbox. Our Dropbox app has “App folder” access only: it can see and write only its own folder, Apps/<app name>, in your Dropbox, never the rest of it.

• What we access: your Dropbox account's email address, to tell your destinations apart (account_info.read); and the files and folders in our app folder, with the names, sizes and content hashes Dropbox records for them (files.metadata.read, files.content.read, files.content.write). Nothing outside the app folder can be reached with the access Dropbox grants us.
• How we use it: only to store your backups in a folder you name inside the app folder; to check each backup against Dropbox's content hash, computed as it uploads; to read a backup back to restore it when you ask; and to delete backups older than the retention you set.
• What leaves VPS Snaps: to upload a backup, your server, agent, WordPress site or dump container gets the destination's own short-lived access token, which reaches only the app folder and lasts at most 4 hours, or, for a file up to 150 MB from an agent or WordPress site, a one-time upload link with no token. To download one, it gets only Dropbox's temporary link, which lasts 4 hours, and no token.
• How we protect it: Dropbox access and refresh tokens are encrypted with AES-256-GCM before they are stored.
• How long we keep it: the tokens and the account's email address are kept while the destination exists. Deleting the destination in VPS Snaps deletes them and revokes our access at Dropbox. The backups already in your Dropbox stay there, and are yours. Backups that retention deletes are subject to Dropbox's own deleted-files history: depending on your Dropbox plan, you can restore them for 30 to 365 days, and they do not count against your space.

Microsoft OneDrive

VPS Snaps asks for access to your OneDrive only when you add OneDrive as a storage destination, by signing in with Microsoft, with a personal account or a work or school one. Our Microsoft app asks for “App folder” access only: it can see and write only its own folder, Apps/VPS Snaps, in your OneDrive, never the rest of it.

• What we access: your Microsoft account's email address, to show which account a destination belongs to, and whether the OneDrive is a personal or a work one (User.Read); and the files and folders in our app folder, with the names, sizes and checksums OneDrive records for them (Files.ReadWrite.AppFolder). offline_access lets backups run while you are not signed in. Nothing outside the app folder can be reached with the access Microsoft grants us.
• How we use it: only to store your backups in a folder you name inside the app folder; to check each backup against the checksum OneDrive keeps for it (its quickXorHash); to read a backup back to restore it when you ask; and to delete backups older than the retention you set.
• What leaves VPS Snaps: to upload a backup, your server, agent, WordPress site or dump container gets only an upload session VPS Snaps opens for that one file: its address is the only credential it carries, and it can write that file and nothing else. To download one, it gets only OneDrive's own short-lived download link, made just before it is used. No Microsoft token ever leaves VPS Snaps.
• How we protect it: Microsoft access and refresh tokens are encrypted with AES-256-GCM before they are stored, and travel only over TLS. Microsoft replaces the refresh token each time it is used; only the newest is kept.
• How long we keep it: the tokens and the account's email address are kept while the destination exists. Deleting the destination in VPS Snaps deletes them. Microsoft gives apps no way to withdraw a sign-in themselves, so to remove VPS Snaps from your account as well, use account.live.com/consent/Manage for a personal account, or myapps.microsoft.com for a work or school one; the storage page links you there when you delete the destination. The backups already in your OneDrive stay there, and are yours. Backups that retention deletes are deleted permanently where your account allows it; where it does not, as some organisations set, they go to OneDrive's recycle bin and follow its rules, including counting against your space until it is emptied.

VPS Snaps asks for access to your Google account only when you connect Google Cloud or add Google Drive as a storage destination, and only for the features listed here. This section covers all Google user data we receive through Google APIs.

What we access

• Your Google Account's email address (openid, email), and for a Google Workspace account its domain, to show which account a connection belongs to and to warn you if your Workspace limits how long sign-ins last.
• Compute Engine (https://www.googleapis.com/auth/compute), when you connect Google Cloud with an ordinary Google sign-in: the virtual machines, disks, machine images, firewall rules and external IP addresses in the one project you name.
• Google Cloud (https://www.googleapis.com/auth/cloud-platform), when you choose the one-click keyless setup: used once, during setup, in the one project you name.
• Google Drive, only the files VPS Snaps creates (https://www.googleapis.com/auth/drive.file), when you add Drive as a storage destination. We cannot see or change anything else in your Drive.

We do not ask for your contacts, Gmail, calendar, files we did not create, or anything else in your Google account.

How we use it

• Compute Engine: list the virtual machines in your project so you can choose which to back up; create machine images of the ones you choose on the schedule you set, and check until each is ready; delete machine images older than the retention you set. Only if you turn them on: test restores, which build a temporary machine from your newest image, check it and delete it; and recovery servers, which build a machine from your images with the firewall rules it needs, move your static external IP to it when you switch traffic, and may start a short-lived check machine in the same region during a suspected outage. Everything is created in your own project and stays there.
• Keyless setup: turn on the Compute Engine, IAM, IAM Credentials and Security Token Service APIs in your project; create a service account named vpssnaps with the Compute Instance Admin (v1), Compute Security Admin and Compute Network Viewer roles; and create a workload identity pool that lets only your VPS Snaps workspace act as that service account. We then list your virtual machines once to check it works, and discard your sign-in: it is held in memory for the setup only, never saved, and no refresh token is requested. From then on VPS Snaps uses short-lived tokens for that service account, which last about an hour, for the Compute Engine uses above.
• Google Drive: make the folder you name and a folder per backup job inside it; store your backups there, uploaded straight to your Drive by your servers, agents and WordPress sites through a link that can write that one file and nothing else; read a backup back to check it, or to restore it when you ask, when the server restoring it gets a token that lasts under an hour and reaches only these files; and permanently delete backups older than the retention you set, so the space is freed.

We use Google user data only to provide these features to you. We do not use it for advertising of any kind, including targeted, personalized, retargeted or interest-based advertising; we do not sell it, or pass it to data brokers or information resellers; we do not use it to decide credit-worthiness or for lending; and we do not use it to build databases or profiles of people. We do not use Google user data, including data from Google Workspace APIs, to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models.

Who it is shared with

We do not share, transfer or disclose Google user data to third parties, except: to the service providers that run VPS Snaps for us, only to provide the features above (DigitalOcean, which hosts the service and its database; Google, which keeps encrypted copies of our database for disaster recovery that it cannot read; and Sentry, which receives reports of errors so we can fix them, with credentials removed before they are sent, though a report may name a machine, image or file the error involved); when the law requires it; or with your explicit consent. Google user data is never sent to our analytics or advertising providers. No one at VPS Snaps reads it, except when you ask us for help with something that needs it, when it is needed for security, such as investigating abuse, or when the law requires it.

How we protect it

Google access and refresh tokens are encrypted with AES-256-GCM before they are stored, and are never written to logs. Everything travels over TLS. A keyless connection stores no Google credential at all, only the names of the service account and the identity pool in your project. Access to our production systems is limited to the people who run the service: server logins use SSH keys, never passwords, and our admin account requires two-factor authentication.

How long we keep it, and how to delete it

• Tokens, your Google Account's email address and its Workspace domain are kept while the connection or destination exists. Disconnecting Google Cloud, or removing a Google Drive destination, deletes them straight away.
• The names and IDs of the machines, images and files your jobs use, and the record of each backup, are kept while your account is open so you can see your backup history, and deleted within 30 days of your account being deleted.
• If a Google Account signs in a storage destination, a keyed one-way hash of that account (not its email address) is kept after your account is deleted, only to keep the free plan to one account per person (see One Free Account per Person).
• The keyless setup sign-in is never stored. The service account and identity pool it creates are in your project, and you can delete them there at any time.
• Your backups are in your own Google Cloud project or Drive, and are yours: disconnecting stops new ones and leaves those already there in place.

You can revoke our access at any time at myaccount.google.com/permissions, disconnect in VPS Snaps, or ask us to delete your Google user data by emailing [email protected]. We act on a deletion request within 30 days.

Limited Use

VPS Snaps' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If we change how we handle Google user data, we will update this section and tell the people affected by email before the change applies.

You can connect an AI app, such as ChatGPT or claude.ai, to your workspace by signing in to VPS Snaps from the app and approving it. This works like an API key, without one to copy.

• What the app can reach: the access you choose when you approve it. Read and run lets it see your plan, servers, storage destinations, backup jobs and runs, and start a backup. Full access also lets it create agents and backup jobs. No app can delete or restore anything, and storage keys, cloud tokens, SSH keys and database passwords are never given to it or taken from it: you add a database password on the job's page.
• What the app's company receives: what its assistant asks for through those tools, for example the names of your jobs and the results of your backup runs. From then on that information is handled under the app company's own privacy policy, such as OpenAI's for ChatGPT, not this one.
• What we keep: the app's name as it gave it, the address it asked us to send you back to, who approved it, which workspace, the access chosen, and when it was approved and last used. The app's tokens are stored only as one-way hashes; we cannot read them back. Each access token lasts an hour, and each refresh token 30 days and is replaced every time it is used.
• How to stop it: disconnect the app in Settings → API keys → Connected apps, and it loses access at once. It also stops if the workspace moves to a plan without API access, or the person who approved it is no longer an owner or admin there. Approving and disconnecting are both recorded in your workspace's audit log.

• Stripe: payment processing, and working out sales tax or VAT
• DigitalOcean: hosting for the service, its database and our support desk
• Amazon Web Services: transactional email (verification, password resets, backup alerts)
• Loops: marketing email, which you can unsubscribe from at any time
• Google: encrypted copies of our database for disaster recovery; we hold the key, and Google cannot read them. And our support chat: when you use Help in the dashboard, your messages, with your account's email, workspace name, plan, signup date, how many servers, jobs and storage destinations it has and its latest failed backup (with any IP addresses removed), go to our Google Chat space so we can answer. Server addresses and credentials are never sent. Chats are kept for a year after the last message, and deleted with your account
• Sentry: error tracking (no PII in error context)
• Google Analytics: website analytics, and only on our public marketing pages. It runs unless you opt out, and there is a one-click opt-out on our Cookie Policy page — use it and no Google script runs and no Google cookie is written. Analytics never runs inside the application, so how you use VPS Snaps once signed in is not measured or shared. See our Cookie Policy for the cookies involved, and Google's Privacy Policy for how they process it.
• Reddit: advertising measurement, on exactly the same terms as Meta below. On our public marketing pages the Reddit pixel tells Reddit that this browser visited this site, that it viewed the pricing page, and that an account was created if you sign up. Those are bare facts with nothing attached: no email address, no name, and nothing about your account or what you back up. It runs unless you opt out, and the one-click opt-out on our Cookie Policy page stops it. Separately, and regardless of that choice, when a payment succeeds we report the purchase to Reddit from our servers if you arrived by clicking one of our advertisements; that report carries your email address in hashed form and the amount. If you did not arrive from one of our advertisements, nothing is sent. See our Cookie Policy for the cookies involved, and Reddit's Privacy Policy for how they process it.
• TikTok: advertising measurement. On our public marketing pages the TikTok pixel tells TikTok that this browser visited this site, that it viewed the pricing page, and that an account was created if you sign up — which lets us show an advertisement on TikTok to someone who has already read a page here. Those are bare facts with nothing attached: no email address, no name, and nothing about your account or what you back up. It runs unless you opt out, and the one-click opt-out on our Cookie Policy page stops it. Nothing is reported to TikTok from our servers, payments included. See our Cookie Policy for the cookies involved, and TikTok's Privacy Policy for how they process it.
• Meta: advertising measurement, in two separate ways. On our public marketing pages the Meta pixel tells Meta that this browser visited this site, that it viewed the pricing page, and that an account was created if you sign up — which lets us tell whether our advertising works and show a follow-up advertisement to someone who has already read a page here. Those are bare facts with nothing attached: no email address, no name, and nothing about your account or what you back up. It runs unless you opt out, and the one-click opt-out on our Cookie Policy page stops it — use it and no Meta script runs and no Meta cookie is written. Separately, and regardless of that choice, when a payment succeeds we report the purchase to Meta from our servers if you arrived by clicking one of our advertisements; that report carries your email address in hashed form and the amount, and nothing about your account or what you back up. If you did not arrive from one of our advertisements, nothing is sent. See our Cookie Policy for the cookies involved, and Meta's Privacy Policy for how they process it.
• Cloudflare Turnstile: we use Cloudflare Turnstile to verify visitors on our sign-up form and protect against bots and abuse, without requiring visible challenges. Turnstile may collect certain visitor data (such as IP address, device and browser characteristics, and timezone) to perform this verification. See Cloudflare's Turnstile Privacy Policy for details on what is collected and how it is processed.

The free plan is for one account per person or organisation. To keep it that way, we record keyed one-way hashes, not the identifiers themselves, of: the email address you sign up with, normalised (lower case, without a "+tag", and for Gmail without dots); the IP address you sign up from and its network; and the identifiers of the servers (SSH host key and address), cloud accounts, storage accounts and sites you add.

A hash cannot be turned back into the address it came from, and because it is made with a secret key of ours, it cannot be checked against a list of guesses either. We compare hashes between free accounts. A matching email address or IP address is only flagged for a person at VPS Snaps to look at. A server, cloud account, storage account or site that another free account already uses is refused on the second free account. Paid accounts are never refused.

Our lawful basis for this is legitimate interest: offering a free plan that is not used to make accounts in bulk. You can object to it by emailing [email protected].

VPS Snaps is run from the United States and stores your account data there, so if you use it from another country, that data is transferred to the US. Where it is transferred out of the EEA or the UK, the transfer relies on the European Commission's Standard Contractual Clauses, with the UK Addendum where the UK GDPR applies, as set out in our Data Processing Addendum. Your backups themselves never come to us: they go to the storage you choose, wherever it is.

We retain your account data for as long as your account is active. You can delete your account yourself at any time, under Settings → Delete account in the dashboard.

A free account with no sign-in and no successful backup for 60 days is deleted. We email the account owner at 14, 30 and 45 days first, and signing in or a successful backup keeps the account. Paid accounts are never deleted for inactivity.

Upon account deletion, we remove your personal data within 30 days. Backup metadata is deleted with your account. What we keep is a record of the deleted account with no name, email address, IP address, credential or backup data in it: its dates (created, last used, deleted), counts of its servers, jobs, backups and members, its plan and whether it ever paid, where its signup came from (a campaign name or referring website), why it was deleted, and the one-way hashes described in One Free Account per Person, so that a returning account can be recognised.

You can delete your account yourself under Settings → Delete account. You may also request a copy of your data, correction of inaccuracies, or deletion of your account by emailing [email protected]. If you are in the EEA or the UK, you may also object to or restrict how we process your data, and complain to your local data protection authority.

For privacy questions, contact [email protected].