privacy

What we store.

We use necessary cookies for signing in and for the cookie notice, but no optional analytics or advertising cookies. Details on technical delivery, your entries and connected accounts can be found below. (English translation; the German version is legally binding.)

1 · controller

Gilbert Rohde
c/o Impressumservice Dein-Impressum, Stettiner Str. 41, 35410 Hungen, Germany
Email: hello@snooffle.com

2 · visiting the website

Cloudflare delivers the website for us and processes technically necessary connection data such as IP address, time, page visited and browser and device information. The legal basis is Art. 6(1)(f) GDPR: our interest in a secure, working website. Cloudflare acts on our behalf; standard contractual clauses apply to any necessary transfers to third countries.

The protected operator access can display personal studio data read-only for support purposes. Each opening is logged with account and time; the logs are cleaned up after 30 days the next time the view is opened. A shared operator key does not identify an individual person.

Cookies and cookie settings

We use cookies for your sign-in, the secure connection with Instagram and the confirmation of the cookie notice. We currently do not use optional analytics or advertising cookies.

Sign-in and Instagram connection

These technically necessary cookies are used when you use the respective feature:

With the older direct login, __Host-snooffle_creator for the session (7 days) and __Host-snooffle_login to secure the login (10 minutes) may also be used. They are removed when you sign out or after the connection attempt.

For the read-only operator view we use __Host-snooffle_owner_view. This cookie is valid for at most 10 minutes and is removed when you sign out. A view link that has already been issued remains valid until it expires. None of the sign-in and access cookies mentioned here can be read by JavaScript.

Your confirmation of the cookie notice

If you confirm the notice, snooffle_consent stores this confirmation for 180 days. The cookie contains the version of the notice, the category "necessary", timestamps and a random identifier. We do not use this identifier for tracking and do not keep a separate consent log on the server.

Language choice: snooffle_lang stores the language you chose with the language switch (German or English) for 12 months. Without a choice, we only use the country of your connection and your browser language setting to pick the language; this is not stored.

For the notice we use CookieConsent. The software is loaded directly from Snooffle; no connection to the library's provider is made. By confirming, you do not consent to any optional services. You can reopen the information at any time via "Cookie settings" in the footer. If you delete or block cookies, the notice may appear again.

Legal bases

For these necessary storage operations, § 25 (2) no. 2 TDDDG applies. We process personal data for the sign-in you requested under Art. 6(1)(b) GDPR. For securing and managing the cookie notice, the legal basis is Art. 6(1)(f) GDPR.

Should we use optional analytics or advertising services in the future, we will inform you separately and, where required, obtain your consent beforehand.

3 · waiting list

For the preview, we store your email address, optionally your Instagram handle, the time and version of your consent as well as confirmation and unsubscription in Supabase (Frankfurt). You first receive a confirmation email; only after you confirm will we inform you about the preview launch. The legal basis is Art. 6(1)(a) GDPR. The confirmation email is sent by Resend (Plus Five Five, Inc.) on our behalf. Resend processes the email address, email content and sending data in the USA. This is based on the data processing agreement and the EU standard contractual clauses agreed therein. More information: Resend privacy.

You can withdraw your consent at any time via the unsubscribe link or by email to hello@snooffle.com . Unsubscribing stops further preview emails. We delete your waiting list data on request, after the waiting list ends or at the latest twelve months after launch. To protect against abusive sign-ups, we briefly use a daily changing IP check value that is not stored in plain text and limit confirmation emails per address. The legal basis for this is Art. 6(1)(f) GDPR, our interest in protection against abuse.

4 · connected instagram accounts

When you connect via Meta, we process the access token and your Instagram metrics to provide you with analyses and niche comparisons. We do not receive a password and do not publish anything in your name. The legal bases are your consent and your use of Snooffle, Art. 6(1)(a) and (b) GDPR. If you disconnect in Instagram, we no longer fetch new data; we delete existing data on request.

Anonymous benchmarks

From the metrics of connected accounts we create combined, anonymised benchmarks, for example typical save or share rates in a niche. We show these to creators in the studio so they can put their own results into context, and use them to improve Snooffle. Benchmarks are only created from a sufficient number of accounts and contain no names, handles, content or individual values, so no individual creator can be identified from them.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to offer all users meaningful benchmarks. You can object to this use at any time by email to hello@snooffle.com ; your account will then no longer be included in new benchmarks. Anonymised values already created contain no personal data and remain in place.

Your saved studio views

When you save a view, we store its name, the selected tab, period and supported filters in your creator account at Supabase (Frankfurt). That way you can open your selection on another device too. These settings contain no copies of your posts. You can rename or delete views in the studio; they are also included in your data export. When your creator account is deleted, they are removed with it. Disconnecting Instagram alone does not delete them.

Confirm an Instagram profile by DM

You can request profile confirmation. During the pilot, Snooffle manually sends a confirmation link from its official Instagram account to the Instagram username you provided. You click the link; you do not need to copy a code or write a message to Snooffle. Instagram processes the message under its own privacy terms. The application does not send messages automatically.

The operator records which username the current link was sent to. The link confirms the profile only together with sign-in to the associated Snooffle account. It does not sign anyone in as someone else. In Cloudflare and Supabase, we store usernames, delivery and confirmation timestamps, status and only a hash of the secret link. The full link is shown to the operator only immediately after creation and is not stored in the Snooffle database. Message contents and screenshots are not copied.

The link is valid for 24 hours and can only be used once. If you open it without an active Snooffle sign-in, a necessary cookie named __Host-snooffle_dm_pending that cannot be read by JavaScript holds the link hash for up to 30 minutes. The check continues after you sign in with the matching account. The cookie is removed after completion or sign-out. The link is in the URL fragment, is removed from the address bar when opened, and is not sent to the server as a URL parameter.

Confirmation is valid for up to 90 days and does not grant access to private insights or a paid subscription. A new check is needed if the username changes. Cleanup runs every twelve hours: expired link hashes are removed, and expired or unsuccessful proofs after a further 30 days. Deleting the brief removes the proof; status and review data can be exported with the brief. Instagram messages are separate and must be managed there.

Your brief without Meta

When you start without connecting Meta, we save your Instagram username, profile type, offer, target audience, website, goals, topics, formats, language, market and reference profiles under your Snooffle login. We use them to prepare your pilot. Entering a profile name does not verify control of the Instagram account or grant access to private Instagram data.

Processing uses Cloudflare and Supabase in Frankfurt. When you make changes, we keep earlier saved versions to track how your goals develop. In the onboarding area, you can export all your brief versions or delete the entire brief after confirmation. This does not delete other account data. We do not retrieve private Instagram insights without your Meta authorisation.

Your comparison profiles

After profile confirmation, we suggest public profiles using your offering, topics and optional reference profiles. We store your decisions, optional reasons and profile suggestions with the corresponding brief version. Your confirmed selection is separate from approval for regular data collection and does not grant access to private insights. Your selection and decisions are included in your brief export and are removed when you delete the brief.

Your own public posts without a Meta connection

After profile confirmation and separate collection approval, public posts can be collected for your own account: post link, date, caption, preview image and available public metrics. Other people’s comments and private insights are excluded. Preview images may load directly from Instagram’s CDN. Your data export includes these snapshots; deleting the brief removes its associated stored post snapshots. Unmodified operator source files are separate source collections and are not automatically deleted by this action.

Your content review and experiments

For your confirmed comparison group, we can review public posts, measurements and observable content features. Your personal review is tied to the brief version and confirmed group. We store source references, review limitations, the report and experiments you save. Saving an experiment does not publish content or grant access to private insights. Reports and saved experiments are included in your own brief export and are removed when the brief is deleted. Raw text, comments and media are not included in your report; reviewed public examples may be linked.

Contact requests

If you write to us via the contact form or by email, we process your email address, your message and your name, if you provide it, to handle your request and reply to you. No newsletter sign-up is required for this. For requests relating to a contract or its preparation, the legal basis is Art. 6(1)(b) GDPR; for other requests Art. 6(1)(f) GDPR, our legitimate interest in handling incoming messages.

The form is operated via Cloudflare. To forward messages to our inbox we use Resend (Plus Five Five, Inc.) as a processor. The contact details provided and the message content are processed in the USA. The data processing and standard contractual clauses described in the waiting list section apply to this transfer. The form does not create an additional contact database. Your request and our reply are handled by email. The storage period depends on the necessary handling and any statutory retention obligations.

To protect against automated requests we use short-term sending limits at Cloudflare. For this the application creates daily changing check values from IP and email address, protected with a secret key; the counters do not receive these addresses in plain text. The legal basis is Art. 6(1)(f) GDPR, our interest in a reachable contact channel protected against abuse.

5 · your rights

In particular, you have the right to access, rectification, erasure, restriction, data portability and objection. Write to hello@snooffle.com or use our notes on data deletion. You also have the right to lodge a complaint with a data protection supervisory authority.

Privacy notice: 25.10.2026 · version datenschutz-2026-10-25. The unchanged waiting list consent is kept separately as preview-v2-2026-09-11 .