Privacy
Snag helps you find free games and optionally receive notifications. No advertising trackers or analytics are installed by the application.
What we store
Your provider IDs (Steam ID and, when enabled, Epic account ID), display name, timezone, claims you mark, and push subscriptions (device endpoint, encryption keys and store preferences). We also store hashed session identifiers, session creation and expiry times, and account creation time.
What we do not store
Snag does not store your Steam or Epic passwords. Steam sign-in is verified with Steam. Epic access and refresh tokens are used temporarily during sign-in, revoked after use and never saved in the database. Optional self-hosted tools are separate software and may store their own credentials and sessions on your machine.
Retention and technical records
Account data stays until you delete your account. Sessions expire after 30 days. Login flows expire after 10 minutes. Steam replay-protection nonces have a 24 hours retention window; rate-limit windows have a 1 hour retention window. Expiry prevents use immediately; expired technical rows are cleaned during subsequent relevant requests, not by a guaranteed wall-clock purge.
Rate limits use hashed IP-based keys and, for signed-in actions, your user ID. Operational logs redact sensitive fields; the hosting operator controls log retention. Public game data and source polling records are not deleted with an account. The application uses a necessary secure, HttpOnly session cookie and a short-lived login-flow cookie, not advertising cookies.
Services involved
The hosting operator and configured libSQL database provider process application data. Local installations can use a file database instead. Apple, Google or Mozilla push services process delivery to your browser. Steam and Epic handle their own sign-in and store pages; GamerPower handles key-giveaway pages. Following a store link subjects you to that service’s policies.
This installation is in development; no production hosting or remote database provider is selected. Self-host operators must identify their host, database provider, contact and backup-retention policy before accepting public accounts.
Delete your data
Open Account settings, choose Delete account and type "DELETE" to confirm. This removes your account, linked identities, sessions, push subscriptions, claims and associated delivery records from the active database. It signs you out. It does not delete your Steam or Epic account or games already claimed. Removing a single device is available in notification settings.
Backups managed by a hosting operator may retain older copies until that operator’s backup rotation completes. Ask the operator about retention; deletion from backups is not automated by Snag.
Contact
For privacy questions, contact Made Pranajaya Dibyacita. Do not post provider IDs, push endpoints, credentials or other private data in public issues. For a self-hosted installation, contact that installation’s operator.