Privacy Policy
Last updated: 25 September 2026
Ember AI (“SnapDev”, “we”, “us”, or “our”) operates the SnapDev Marketplace, where customers work directly with senior software engineers. This policy explains what personal and technical data we collect when you use the Marketplace, how we use it, who we share it with, and what you can do about it.
It covers both sides of the Marketplace: customers who come here for help, and engineers who take that work.
What we collect
We collect three kinds of data: what you tell us, what you and an engineer say to each other, and what your use of the product generates on its own.
1. Account information
- Identity: Your first and last name, email address, and profile picture if you upload one.
- Sign-in data: A password, held as a hash by our authentication provider and never visible to us; or, if you use Google sign-in, the name, email address and profile picture Google returns.
- Billing details: Your plan, subscription status, engineering-hours balance, and invoice history. Card numbers are handled by Stripe and never reach our servers.
- Engineer profiles: For engineers: your biography, skills, specialities, working hours, timezone, and the ratings and reviews customers leave you.
2. Session content
- Messages: Everything sent in a conversation between you and an engineer, in both directions.
- Attachments: Files, images and code you or an engineer attach to a message.
- What you are stuck on: The description you write when you request help, and the intent you pick for it.
- Project information: Repository URLs, site URLs, or archives you connect to a project, and the summary produced from them.
- Bookings: The calls you schedule: who with, when, for how long, and whether they were attended or cancelled.
- Call recordings: Where a scheduled call is recorded, Fathom records, transcribes and summarises it: the audio and video of the call, the transcript of what was said, and the summary and action items produced from it. All of that is held by Fathom on our behalf rather than in our own database: what we store is a link to the recording, which the engineer may attach to the internal work log for your session. Recording is started by the engineer on the call, so not every call is recorded.
3. Technical and usage data
- Device data: IP address, browser type, operating system, and screen size.
- Usage data: Pages viewed, features used, session duration, and errors encountered.
- Interface replays: Replays of how the interface is used, captured by our analytics provider. While you are signed in, a replay and the usage data around it are linked to your account — your name and email address — so that we can follow up on a problem you ran into. Conversation content is masked out of these replays and is never included. These are replays of the product’s own screens, not recordings of a call with an engineer; those are covered above.
How we collect it
- Directly from you: When you create an account, fill in a form, write a message, upload a file, or connect a project.
- From your activity: Automatically, as you use the product: page views, feature usage, and errors.
- From services you connect: From Google when you sign in with it, from Stripe when you pay, and from a repository host when you connect a public repository.
How we use it
To run the Marketplace
- Create and secure your account, and keep you signed in.
- Match you with an available engineer whose experience fits what you described.
- Deliver your messages and attachments to that engineer, and keep the conversation readable afterwards.
- Analyse a repository, URL or archive you connect so that an engineer arrives already briefed on your project.
- Schedule and confirm calls, and send reminders.
- Meter engineering hours, take payment, and issue invoices.
To improve and protect it
- Understand which features are used, so we can improve them.
- Diagnose errors and monitor performance.
- Detect and prevent fraud, abuse, and unauthorised access.
- Meet our legal, tax and accounting obligations.
Who can read your conversations
A conversation is private correspondence between you and the engineer you are working with. It is not shown to other customers or to other engineers.
Our staff can access conversations only where it is necessary to run the service (investigating a support report, a billing dispute, or a safety concern), and that access is restricted to authorised employees on a need-to-know basis.
Conversation content is deliberately excluded from our product analytics and from the interface replays our analytics provider captures.
A recorded call is treated as the same private correspondence: it is not shown to other customers or to other engineers.
We do not train models on your data
We do not train any machine-learning model on your messages, your code, or your project data, and we do not sell your data to anyone.
One feature does send data to an AI provider: when you connect a repository, a URL, or an archive to a project, its contents are passed to Anthropic’s API to produce a short summary of the project for the engineer helping you. Anthropic processes that data to return the summary and does not use it to train its models. If you would rather not use it, enter your project details manually instead.
Who we share it with
We use the following sub-processors to run the Marketplace. Each processes data on our behalf, under contract, and we review them for security and privacy standards.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Authentication, user accounts, and file storage | USA |
| MongoDB | Application database | USA |
| Render | Application and infrastructure hosting | USA |
| Chatwoot | Messaging between customers and engineers (self-hosted by us) | USA |
| Stripe | Payment processing and invoicing | USA |
| Cal.com | Scheduling, calendar availability, and hosting a call on Cal Video | USA |
| Sign-in with Google | USA | |
| Anthropic | Summarising a project you connect | USA |
| PostHog | Product analytics and interface replays | USA |
| Meta Platforms | Advertising measurement (Meta Pixel and Conversions API) | USA |
| Google Meet | Hosting a scheduled call where the engineer has connected it | USA |
| Fathom | Recording, transcribing and summarising a call that is recorded | USA |
| Resend | Sending the emails we send you: billing and hours notices, product updates | USA |
Other disclosures
- Engineers: The engineer helping you sees your name, your request, your messages and attachments, and your project summary. They do not see your billing details.
- Legal requirements: We may disclose data where we are required to by law, or where it is necessary to protect our rights, safety, or property.
- Business transfers: If we are involved in a merger, acquisition, or sale of assets, your data may transfer as part of it. We will tell you before it becomes subject to a different privacy policy.
International transfers
Our sub-processors are located in the United States, so data about users outside the US is transferred there. Where that transfer is from the EU or the UK, we rely on the providers’ standard contractual clauses or their certification under the EU–US Data Privacy Framework.
Security
- Encryption: Data is encrypted in transit (TLS 1.2 or above) and at rest.
- Session handling: Your session is held in a cookie the browser cannot read from JavaScript, which limits what a cross-site scripting bug could take.
- Access control: Internal access to customer data is restricted to authorised employees on a strictly need-to-know basis, and administrative credentials never reach the browser.
- Vulnerability management: We run dependency scanning and code review on every change before it ships.
- Certified infrastructure: We build on providers that hold SOC 2 and ISO 27001 certifications. SnapDev is not itself certified today.
Data breach notification
If a breach affecting your personal data is confirmed, we will notify you without undue delay after becoming aware of it. The notification will describe the nature of the breach, the data potentially affected, and the steps we recommend you take.
How long we keep it
- Conversations and attachments: Kept for as long as your account is open, so that you and the engineer can read them back. Deleted when you delete your account.
- Account and profile data: Kept while your account is open, and deleted within 30 days of you closing it.
- Billing records: Kept for 7 years, as tax and accounting law requires, even after an account closes.
- Analytics data: Held by our analytics provider: linked to your account once you sign in, in aggregate otherwise. Interface replays expire on our analytics provider’s standard schedule.
- Backups: Deleted data can persist in encrypted backups for a short period before those backups rotate out.
Your rights
Under the GDPR, the CCPA, and comparable laws elsewhere, you have the right to:
- Access: Request a copy of the personal data we hold about you.
- Correction: Correct inaccurate account details, most of which you can edit yourself in Settings.
- Erasure: Ask us to delete your account and the data associated with it.
- Portability: Receive your conversations and account data in a structured, machine-readable format.
- Objection and restriction: Object to, or ask us to restrict, certain processing, including analytics.
- Withdraw consent: Withdraw consent where our processing relies on it, without affecting what we did before you withdrew it.
Exercising them
Email tools@snapdev.ai and we will respond within the period the applicable law requires: 30 days under the GDPR, 45 days under the CCPA. We never sell personal data, so there is nothing to opt out of on that front.
Cookies and tracking
We use cookies and similar technologies for:
- Authentication: Keeping you signed in. These are essential; the product cannot work without them.
- Guest sessions: Recognising a visitor who started a chat before creating an account, so their conversation is not lost.
- Analytics: Understanding which features are used, through PostHog. Once you sign in, this usage data is linked to your account.
- Advertising: Measuring how our own ads perform, through the Meta Pixel. It reports which page you are on and, if you sign up, buy hours or a plan, or book a session, that the step happened — never your name, your messages, or your project data. When you buy hours or a plan, our server also tells Meta that the purchase happened and what it cost, together with Meta’s own cookie identifiers and your browser type so it can be matched to an ad — never your email address or payment details.
Your choices
You can manage or block cookies in your browser settings; blocking the essential ones will sign you out. We honour the Global Privacy Control and “Do Not Track” signals for analytics and advertising measurement alike, including what our server reports to Meta.
Marketing
We use your email address to send service messages you cannot opt out of while you have an account (booking confirmations, password resets, billing notices), and, separately, product updates you can unsubscribe from at any time using the link in the email. Our email is delivered by Resend, except for two kinds that come from the service they belong to: account and password emails from our authentication provider, and booking confirmations and reminders from Cal.com. We never sell your personal data for advertising.
Children’s privacy
The Marketplace is a professional tool intended for adults and businesses. It is not directed to anyone under 18, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it promptly.
Other websites
The Marketplace links to and integrates with third-party services, including Stripe, Google, Cal.com and repository hosts. What you do on those services is governed by their own privacy policies, not this one.
Changes to this policy
We may update this policy. When we make a material change we will update the date at the top of this page and, where it materially affects your rights, notify you by email or in the product before it takes effect.
Contact us
For privacy questions, data requests, or security reports, email us at tools@snapdev.ai.