Snowtrail Security

Version 2026-10-01-connected-v3 · Effective October 1, 2026

This page describes how Snowtrail protects your recordings today, and what isn't in place yet. We would rather be exact than reassuring.

On your computer

• Recordings stay on your computer until they upload, for up to 7 days while the app runs. They are not cleaned or anonymized there.
• Snowtrail doesn't encrypt recordings itself. Your computer's own protections guard them: your login password, and disk encryption (FileVault on a Mac) if it is turned on.
• Snowtrail hides the apps on your Never record list and ignores what you type in them. Common password managers start on that list. Their browser extensions run inside your browser, so they aren't hidden.
• What you type into password fields that your computer marks as secure isn't recorded as text. Notification banners are never recorded.
• These protections depend on the operating system and on each app. They are not a guarantee: visible passwords and other sensitive information can still appear in recordings.
• The app keeps your sign-in session in your computer's secure keychain.
• Recordings are never written to the app's logs.
• Recordings made before the app added sign-in stay on your computer until you delete them. They never upload.

What leaves your computer

• A list of your recordings, under your current sending consent.
• Only finished recordings that Snowtrail staff select upload, at least 24 hours after they end. They reach us without automatic anonymization and can contain sensitive information.
• While you're signed in, a status report every few minutes: whether the app is recording, paused or stopped, which versions of the app and your operating system it runs, and crash and error reports. Status reports contain nothing from your recordings.
• About once an hour, an update check to download.snowtrail.app, which carries your IP address and the app version. Updates download and install by themselves. The app checks each update's signature before installing it.
• Recordings and the list of them aren't sent while recording is paused or sending is off. Sign-in, result updates, deletion requests, status reports and update checks still use the network.
• This version of Snowtrail doesn't use your microphone or camera, so there is no microphone audio or camera video to send.

On the way to us

• You sign in with a one-time code sent to your email, or with Google. Supabase runs sign-in. Each computer is enrolled to your account. Contributor sign-in doesn't grant staff access.
• With Google sign-in, Google checks your password and Snowtrail never sees it. Snowtrail gets your name, email address and profile picture, and no access to your Gmail, files or other Google data.
• Recordings travel to our servers over HTTPS.
• Before we accept an upload, we check its SHA-256 fingerprint against the one your app calculated. If they don't match, we reject it. A failed transfer is retried a limited number of times, then shown as unsuccessful. The app marks an upload received only after our server confirms its size and fingerprint.

On our servers

• Stored recordings are private. They are never public.
• We store recordings and account information in the United States, with Google Cloud, Cloudflare and Supabase. These providers encrypt the data they store. Encryption doesn't clean recordings or make them anonymous.
• Only Snowtrail staff who need access for review, cleaning or support can reach recordings. We log staff access to recordings.
• Recordings reach us uncleaned. We haven't cleaned any yet, because we haven't shared any with a buyer. Until a recording is cleaned, it contains everything you recorded. Cleaning can miss things.
• AI model providers that help us label and clean recordings process them for us, as the Privacy Policy describes. We only use AI model providers under terms that don't let them train their own models on your recordings.
• Uploaded originals are deleted 90 days after upload. An hourly cleanup job removes expired recordings and retries any that fail. The Privacy Policy lists how long we keep everything else.
• Our server logs keep IP addresses for 30 days.

If something goes wrong

If a security incident affects your information, we will tell you and the relevant authorities as the law requires.

Reporting a vulnerability

If you find a security problem in Snowtrail, email support@snowtrail.app. Please include what you found, the steps to reproduce it, and the app version if it involves the app.

While you look into it, please:

• test only with your own device and recordings
• don't access, change or keep other people's data. If you come across any, stop, tell us, and delete it.
• don't disrupt our service, for example with load or denial-of-service testing
• give us a reasonable time to fix the problem before you tell anyone else

We will tell you when the problem is fixed.

What you can do

• Turn on disk encryption (FileVault on a Mac) and keep your system up to date.
• Add apps you never want recorded to Never record.
• Pause anytime you'd rather something not be recorded.
• Delete anything you don't want uploaded within 24 hours after you record it.
• Don't let other people use your computer account while Snowtrail is recording.