A practical guide to using Snags on websites that hold real people's data: what Snags records, the choices that are yours, and the controls Snags gives you.

This guide is informational, not legal advice. For what Snags collects and keeps, see the privacy policy.

1. What Snags records, and whose

Snags records only your own browser, and only while you run an audit on a site. It is not a tool that watches a website's visitors: nothing is added to the site, and nobody else's session is ever recorded.

What can end up in an audit is what was on your screen: the page, the element you commented on, the console errors and failed requests your browser saw, and a replay of the moments before. If that page showed someone's personal data, such as a customer record in an admin panel, the audit can contain it.

2. Who is responsible for what

You decide which sites to audit, what to comment on and who to send the link to. If an audit captures other people's personal data, that makes you, or the organisation you audit for, responsible for it under laws such as the GDPR.

Snags stores and serves the audit on your behalf, and gives you the controls below to keep personal data out and to remove it.

3. Prefer staging and test data

Most audits don't need real people's data. Staging, preview and local builds usually hold test data, give Snags fuller source context, and keep your compliance surface small.

When you must audit a live site, prefer a test account over a real customer's.

4. What is always masked

Typed values are never captured. Screenshots and replays hide what's typed into inputs, text areas, dropdowns and editable regions. Steps record which field you typed into, never what.
Secrets are swept from console messages, errors and request details before they leave your browser: passwords, tokens, API keys, JWTs, card numbers and email addresses are replaced with [redacted].
Credential headers are redacted: Authorization, Cookie and any header named like a token, session or API key.
Addresses are cleaned: query strings and fragments are removed, and path segments that look like secrets are replaced.

5. Mark sensitive regions

Snags respects the privacy markers many sites already use for session-recording tools, so a site that has marked its sensitive regions is covered on day one:

Mask (text becomes asterisks, screenshots cover it): data-snags-mask, data-rebase-mask, data-private, .rr-mask, data-sentry-mask, .fs-mask
Block (the element becomes an empty box): data-snags-block, data-rebase-block, .rr-block, data-sentry-block, .fs-exclude, .lr-hide

If you build the site, add data-snags-block to any region that renders personal data you'd never want in an audit.

Masking can't recognise every kind of private content. Before sharing an audit of a page with real data, open a comment's screenshot and replay and check them.

6. Avoid special-category data

Snags isn't meant for special-category data, such as health or biometric data. Don't audit pages that show it, or block those regions first.

An audit link opens for anyone who has it. Before you send one:

On Pro and Team, set a password on the link.
On Team, publish into a workspace, and give clients only the sites they need.
Remember that an issue created in Linear, GitHub or Jira carries the comment, screenshot, steps and errors into that tracker, where its own permissions and retention apply.
Coding agents read audits over MCP when given the link. Agents act on the audit's content, so share links with agents as you would with a person.

8. Retention and erasure

How long audits are kept

Free links last 7 days, then their comments, screenshots and replays are deleted. A record that the link existed, its title, is kept for 180 days so the link can say it expired.
Pro and Team links last until they're deleted, or the account or workspace is.
Drafts that are never published are deleted after 7 days.

Deleting

Delete a comment, or a whole audit, in the extension. A workspace's owner and admins can delete any audit in it.
Account → Your data in the extension exports everything you've shared as a file, or deletes your account with its audits, screenshots, replays, replies, tracker connections and access tokens. Links stop working.
Issues already sent to a tracker stay there, so delete those in the tracker too.

9. Who else handles it

Snags is hosted on Cloudflare, which stores audits. Amazon SES delivers sign-in emails and notifications, and Stripe handles payments. Trackers you connect receive the comments you send them. Snags doesn't sell data, show ads or use what you capture to train AI models.

10. Contact

Questions about using Snags responsibly, or a request under data protection law? Email privacy@snags.com.

Privacy & compliance guide