Skip to content
SnagDeals

Privacy Policy

Last updated: June 2026

1. Overview

SnagDeals collects the minimum data needed to operate. We do not sell, rent, or share your personal information with third parties for marketing purposes.

2. Information we collect

Google OAuth sign-in

When you sign in with Google we receive your Google account email address, display name, and profile picture URL. We store these in our database to identify your account and display your avatar in the interface. We do not receive or store your Google password, phone number, or any other Google account data beyond what the OAuth flow provides.

We use this information solely to authenticate you, to apply the invite-allowlist check (matching your email against the list of authorised users), and to personalise your in-app experience (saved deals, alert preferences).

Email magic-link sign-in

If you request a magic-link sign-in, we store your email address in our Auth.js verification token table long enough to validate the one-time link and sign you in. The sign-in email is delivered through Resend and expires automatically after a short window.

Location preference

If you set a location preference (postal code / forward sortation area) to surface nearby store deals, we store that coarse location string in your account preferences. We do not collect GPS coordinates, precise addresses, or device location signals. You can clear or change this preference at any time from your account settings.

Alert email address

If you enable deal alerts, we store the email address you specify in your account preferences. This address is used exclusively to send you deal alert emails via Resend. You can disable alerts or change the address at any time from your account settings.

Saved deals and searches

Products you save and searches you save are stored in our database and linked to your account. This data is used to power deal alerts and to restore your saved deals across sessions.

Analytics and session recording

We use self-hosted Umami for cookieless, privacy-friendly analytics. Umami collects anonymous page-view counts and aggregate event data (e.g. how often a filter is used). It does not use cookies, does not fingerprint devices, and does not collect any personally identifiable information.

We also use Umami’s session-replay feature to record visitor interactions (mouse movements, clicks, scrolls) as you browse the site, so we can see where the experience is confusing or broken. The recording captures the structure of the page and your interactions with it — not your account data. The following safeguards apply:

  • Sensitive fields are masked. All text inputs — and email and password fields in particular — are replaced with ████ in recordings; we never see what you type. The masking level is set to “moderate” by default.
  • Sign-in and account forms are blocked. Password and email inputs and sign-in/authentication forms are fully blocked from capture, so credentials are never recorded even visually.
  • Do Not Track is honoured. If your browser sends a Do Not Track signal, no recording takes place.
  • Recordings are deleted on a rolling basis. Raw recordings are automatically purged after a limited retention window (currently 60 days).

All analytics and replay data are stored on our self-hosted Umami instance (in Canada) and are never shared with third-party analytics services.

Rate-limiting and abuse prevention

To protect the service, we apply per-IP rate limiting in our web application layer. Request counts per IP are tracked in Redis with a short rolling window (typically minutes). We do not permanently store IP addresses or build profiles from them.

Server logs

Standard HTTP access logs (IP address, URL, response code, timestamp) may be retained for a short period for debugging and operational purposes.

3. How we use your information

  • Authenticate your account and enforce the invite allowlist.
  • Personalise your browsing experience (preferred location, saved searches).
  • Send deal alert emails you have opted into.
  • Detect and mitigate abuse via rate limiting.

We do not use your data for advertising, analytics profiling, or any purpose beyond operating the service.

4. Third-party services

We use a small number of third-party services to operate SnagDeals:

  • Google OAuth — handles authentication. Your sign-in is governed by Google’s Privacy Policy.
  • Resend — transactional email delivery for deal alerts and sign-in links. Your email address is transmitted to Resend only when an alert or sign-in message needs to be sent.
  • Cloudflare Tunnel — proxies traffic to our self-hosted server. Cloudflare may log requests as part of their network operations.

5. Data storage

Your account data is stored in a self-hosted PostgreSQL database on a private server in Canada. Nightly encrypted backups are stored in Backblaze B2 cloud storage.

6. We do not sell your data

We do not sell, rent, trade, or otherwise transfer your personal information to outside parties for commercial purposes.

7. Your rights

You can at any time:

  • Change or clear your location preference in account settings.
  • Change your alert email address or disable alerts in account settings.
  • Delete individual saved items or saved searches.
  • Request deletion of your account and all associated data by emailing us.

8. Data source and scraping

SnagDeals collects publicly listed prices and product information from Canadian retailer websites using automated HTTP requests. We do not log in to retailer accounts, circumvent access controls, or harvest personal data from retailer sites.

Scraped prices and inventory levels are snapshots in time and may be stale. Always confirm price and availability with the retailer before driving to a store.

SnagDeals is not affiliated with or endorsed by any retailer whose prices appear on this site.

9. Changes to this policy

This policy may be updated at any time. Continued use of SnagDeals after an update constitutes acceptance of the revised policy.

10. Contact

Questions or data-deletion requests? Email hello@snagdeals.ca.