Privacy Policy

1. Overview

This Privacy Policy describes how SNcode ("we", "us"), handles information in connection with SNcode (the "App"). SNcode is designed with a local-first architecture: the vast majority of your data never leaves your device.

2. What we collect on our servers

When you sign in with Google, Google shares the following profile information with us. We store only the minimum required to operate your account and track usage:

• Email address — used to identify your account and send essential service communications
• Full name — used to personalise your in-app profile display
• Profile photo — used to display your avatar within the App
• User ID — a unique identifier linked to your account
• Token usage counts — aggregate totals used for quota tracking and billing purposes
• Subscription plan, seat count, and billing status — received from Paddle for paid plans

We do not collect, store, or have access to your ServiceNow credentials, conversation content, attached files, or any other data you process through the App.

3. Sign-in provider — Google

SNcode uses Google OAuth 2.0 for authentication. When you sign in, Google authenticates your identity and shares your email address, full name, and profile photo with us. We do not receive your Google password or any other Google account data.

Google processes your authentication data under their own privacy policy. We strongly recommend reviewing the Google Privacy Policy to understand how Google handles your data during the sign-in process.

4. Data stored locally on your device

The following data is stored only on your device — in a local, encrypted database — and is never stored on our servers:

• ServiceNow instance URLs and API credentials
• Conversation and chat history
• Attached files and documents
• Script execution history and outputs
• Application settings and preferences

5. Data sent to Anthropic (AI requests)

How your message reaches Anthropic depends on which engine you use. On SNcode API plans (Pro, Max, Business), the content of your message — including any ServiceNow query results or attached file excerpts the conversation contains — is sent over TLS to the SNcode API, which authenticates you, meters token usage, and relays the request to the Anthropic Claude API. We record token counts for billing; we do not store your conversation content.

On the Local plan, SNcode sends the conversation to its API only to assemble the prompt, then your locally installed Claude CLI calls Anthropic directly under your own Claude subscription — that usage is metered by Anthropic, not by us.

Anthropic processes this data under their own privacy policy and terms of service. We strongly recommend reviewing the Anthropic Privacy Policy before sending sensitive data. Avoid pasting credentials, personally identifiable information, or confidential business data into chat messages unless you are comfortable with those appearing in an Anthropic API request.

6. Payment data — Paddle

For paid plans (Pro, Max, Business), payments are handled by Paddle.com Market Limited ("Paddle"), our payment provider and merchant of record. When you subscribe, Paddle collects your payment details (card or other payment method), billing name, billing address, and country directly — this information is never sent to or stored on our servers, and we do not have access to your full card number.

Paddle uses this information to process your payment, calculate and collect applicable VAT or sales tax, detect and prevent fraud, and meet its own legal obligations. Paddle acts as an independent controller of this data under its own policy, which we recommend reviewing: Paddle Privacy Policy. We receive and store only your subscription plan, seat count, billing status, and billing period dates from Paddle.

7. How we use your data

We use the data we collect solely to:

• Authenticate your account and maintain your session
• Track token usage for quota enforcement and billing
• Provision plan and seat entitlements based on your subscription status
• Send essential service communications (e.g., account or billing notices)
• Notify you in advance of subscription plan or price changes, by email and via banners in the admin panel and desktop app
• Comply with applicable legal obligations

We do not sell your data to third parties. We do not use it for advertising.

Legal basis for EU/EEA users (GDPR): We process your account data (email address, full name, profile photo, user ID) on the basis of contract performance — this information is necessary to create and operate your account. We process token usage counts and subscription/billing status on the basis of contract performance and legitimate interests in enforcing usage quotas and operating a sustainable service. Where required by law, processing rests on a legal obligation.

8. Data sharing

We do not share your personal data with third parties except in the following limited circumstances:

• Paddle.com Market Limited — our payment processor and merchant of record for paid subscriptions, bound by its own privacy obligations
• Service providers who help us operate our infrastructure (e.g., authentication), bound by confidentiality obligations
• When required by law, court order, or a valid government request
• In connection with a merger, acquisition, or sale of assets, where your data would transfer subject to the same privacy protections

International transfers: Our service providers — including Google (authentication) and Paddle (payment processing) — may be located in the United States or other countries outside the European Economic Area. Where required, these transfers are conducted under appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

9. Data retention

We retain your account data (email, user ID, token usage, subscription and billing status) for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within a reasonable period, unless retention is required by law. Paddle retains payment records under its own retention policy, independent of our systems.

10. Your rights

EU / EEA residents (GDPR)

Under the General Data Protection Regulation you have the right to:

• Access — obtain a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data where no overriding legal reason exists to retain it
• Restriction — ask us to pause processing while a dispute is resolved
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests
• Lodge a complaint — contact your local data protection supervisory authority if you believe we are processing your data unlawfully

California residents (CCPA)

Under the California Consumer Privacy Act you have the right to:

• Know — request disclosure of the categories and specific pieces of personal information we have collected about you
• Delete — request deletion of your personal information, subject to certain exceptions
• Correct — request correction of inaccurate personal information
• Opt out of sale or sharing — we do not sell or share your personal information for cross-context behavioral advertising
• Non-discrimination — we will not deny you services, charge you different prices, or provide a different quality of service because you exercised any of these rights

To exercise any of these rights, email support@sncode.dev. We will respond within 30 days, or sooner where required by applicable law.

11. Children

SNcode is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of this page indicates when the latest revision was made. We will notify users of material changes through the App or email.

13. Cookies and website analytics

Our website (sncode.dev) uses Google Tag Manager to load Google Analytics, which sets analytics cookies and processes usage data — pages visited, approximate (IP-based) location, and device/browser type — to help us understand traffic and improve the site.

These tools load under Google Consent Mode in a denied state by default: no analytics cookies are set and no analytics data is collected until you accept the "Analytics" category in our cookie banner. You can change or withdraw your choice at any time via "Manage preferences". We do not use advertising cookies. Google processes this data under the Google Privacy Policy.

This applies to our website only. The SNcode desktop app does not include Google Tag Manager, Google Analytics, or any third-party analytics or tracking SDKs.

14. Contact

For privacy questions or data requests, email support@sncode.dev.