Privacy Policy

Last updated: 4 October 2026

This policy explains what data the SnapBot mobile app (published on Google Play as SnapBot: Sell Clothes with AI), the SnapBot browser extension and this website (together, the “App”) collect, why, and your choices. The App turns photos of clothing into draft listings for second-hand marketplaces such as Vinted. By using the App you agree to this policy.

The short version. We store your account email (or an anonymous guest ID), your credit balance and basic in-app usage events. Your photos are sent to Google Gemini to write the listing and are not kept (batch photos wait on our server only while they are sorted, and are deleted as soon as that's done, within 24 hours at most). Your marketplace login stays on your device - we never see it. Purchases go through Google Play; we never see your card. No ads, and we don’t sell your data. You can delete everything from inside the App.

1. Who we are

The App is operated by the SnapBot team (“we”, “us”). For any privacy question, contact support@vintedbot.org.

2. What we collect

Account details. If you create an account we store your email address (and, with Google or Facebook sign-in, the basic profile that provider returns - typically your name and email). If you continue as a guest, we create an anonymous account with a random ID and no email. Authentication is handled by Supabase on our behalf.
Item photos & listing text. Photos you choose are sent to Google Gemini, through our server, to write the listing (title, description, price suggestion) and, if you use Studio, to clean up the background and lighting. They are processed only to return the result and are not stored on our servers. The one exception is a batch sorted in the cloud (so you can close the App while it works): smaller copies of those photos are kept in private storage that only our server can read, until sorting is done. They are deleted as soon as the batch is finished, failed or cancelled, and never kept longer than 24 hours. The finished listings (text only) are kept for 7 days so the App can collect them, then deleted. If you instead enter your own AI key, photos go directly from your device to the provider you pick (Anthropic, Google, OpenAI or OpenRouter) under that provider’s terms.
Credits & subscriptions. We store your credit balance, plan and a record of credit purchases and use. In the Android app, purchases are made through Google Play Billing, and on iPhone through Apple’s App Store; both are managed by RevenueCat, which receives your purchase records and your SnapBot account ID. On the web, payments are handled by Lemon Squeezy. We never receive or store your card details.
App usage events. To understand which features work and fix problems, the App records events such as “listing generated” or “signed in”, together with a random app-install ID, your account ID (if signed in), the platform and the app version. These are stored in our own database, are not shared with advertisers, and are deleted with your account.
On-device data. Your settings, any AI key you enter, your sign-in token and any cost figures you enter for profit tracking are stored locally on your device, not on our servers.
Marketplace session. When you connect Vinted, the App works inside your own logged-in session on your device to do what you ask - create drafts, relist, adjust prices, reply to messages or follow accounts. We never collect, transmit or store your marketplace username, password or session cookies.
Other selling sites you connect (eBay, OLX, Wallapop, Depop, Vestiaire Collective). When you connect one, that site gives our server an access token, which we keep encrypted so the App can post your listings there and take them down when an item sells. Your password for those sites is never sent to us (Vestiaire’s goes from your device straight to Vestiaire). To take a sold item down everywhere even while the App is closed, we keep a short list of which of your items is up on which site: the item title and each site’s listing ID, never photos or prices. Our server checks your connected sites’ orders for those IDs every few minutes. If you connect eBay, eBay also tells our server the moment one of your eBay items is paid for (your eBay user ID and the sold listing IDs); we use it only to take that item down elsewhere and don’t keep the order. Sold items are removed from that list after 60 days and the “sold and taken down” notes after 30 days. On Android, the App also gets a random device key so its background check can ask our server what to take off Vinted; it can do nothing else. Disconnecting a site deletes its token; deleting your account deletes all of it.
Buyer messages (auto-reply only). If you turn on auto-reply, the latest message from a buyer and the item title are sent to Google Gemini, through our server, to draft a reply. They are processed only to return the draft and are not stored.

3. What we do NOT collect

Your marketplace password, session cookies or payment card details.
Your location, contacts or messages.
Advertising IDs - the App shows no ads and does no cross-app tracking.
We don’t sell or rent your personal data to anyone.

4. How we use data

To let you sign in (or use the App as a guest) and keep you signed in.
To generate listings and Studio edits from your photos, and draft replies to buyers.
To keep track of your credits and plan, and to prevent abuse (for example, rate limits).
To measure and improve the App using the usage events above.
When you choose a password, the App checks it against known data breaches using a privacy-preserving lookup (only the first five characters of a one-way hash leave your device; your password is never sent).

5. Service providers we share with

Data is shared only with providers that run parts of the App for us:

Supabase - hosts our database, sign-in and server functions.
Google (Gemini API) - receives photos and prompts to write listings and Studio edits, and buyer messages when you use auto-reply.
Google Play, Apple App Store & RevenueCat - process and manage in-app purchases.
Lemon Squeezy - processes payments made on our website.
Google Fonts - serves the App’s typeface, which means your device’s IP address is visible to Google when fonts load.
Marketplaces you use (such as Vinted, eBay, OLX, Wallapop, Depop and Vestiaire Collective) - receive only the listing content you choose to post there, and the take-down of an item that sold elsewhere.

6. Data retention & deletion

We keep your account data while your account exists. You can delete your account at any time inside the App (Me → Delete account) or by following the steps at vintedbot.org/delete-account. Deleting your account permanently removes your email, profile, credit balance and history, and your usage events from our database. Purchase records held by Google Play, Apple or RevenueCat for tax and accounting are kept under their own policies. Because we never keep your photos (batch photos are deleted within 24 hours) or your marketplace login, there is nothing further to erase; deleting your account also removes any batch still waiting, your selling-site connections and your cross-listing list. On-device data is removed when you sign out or uninstall the App.

7. Your rights & international transfers

If you are in the UK or EU you have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent at any time. The lawful bases for the data we hold are the performance of the service you asked for, and our legitimate interest in keeping the App working and secure (usage events and abuse prevention). To exercise any right, use in-app Delete account or email support@vintedbot.org. You may also complain to your data protection authority - in the UK, the Information Commissioner’s Office (ico.org.uk).

Some providers (Google, Supabase, RevenueCat) may process data on servers outside your country. Where personal data is transferred internationally it is protected by appropriate safeguards such as those providers’ standard contractual clauses.

8. Security

All network requests use HTTPS. Sign-in tokens and any AI keys are kept on your device. No method of storage or transmission is 100% secure, but we take reasonable measures to protect your data.

9. Children

The App is intended for adults (18+), in line with the marketplaces it works with. We do not knowingly collect data from anyone under 18.

10. Changes to this policy

We may update this policy; the “Last updated” date will change. Continued use after an update means you accept the revised policy.

11. Contact

Questions? Email support@vintedbot.org.