Privacy Policy

Privacy Policy

1. Data Collection

Snapwire collects the minimum data necessary to provide its monitoring and auditing services. This includes:

• Tool call metadata: Tool names, parameters (sanitized), timestamps, and response status.
• Agent identifiers: Agent IDs and session identifiers used to group activity.
• Cost data: Estimated and actual costs associated with tool calls for budget tracking.
• User account information: Display name, email (if provided), and authentication identifiers.

2. What We Don't Collect

Raw API keys are never stored in logs. When you store credentials in the Snapwire Vault, your real API keys are encrypted at rest and injected ephemerally — they never appear in audit logs or monitoring data.

Snap-Tokens mask real credentials. Proxy tokens (Snap-Tokens) are used in place of your actual API keys so that your real credentials are never exposed in agent traffic or log entries.

3. Telemetry

Snapwire supports opt-in anonymous telemetry to help improve the service. Telemetry is disabled by default and can be toggled at any time from your dashboard settings.

When enabled, telemetry includes:

• A unique install_id (randomly generated, not tied to your identity)
• Aggregate statistics: total rules, total intercepts in the last 24 hours, number of connected agents, uptime
• Platform type (Replit, Docker, self-hosted)

No personally identifiable information (PII) is ever included in telemetry data.

4. Data Storage

All audit logs, rules, and configuration data are stored in your own database. Snapwire does not maintain a centralized data store for user monitoring data.

Self-hosted users control their data entirely. If you deploy Snapwire on your own infrastructure, all data remains on your servers and is never transmitted to us.

5. Third-Party Services

Snapwire integrates with LLM providers (such as Anthropic and OpenAI) solely for the purpose of AI-powered auditing of tool calls. When the AI auditor is enabled:

• Tool call metadata (tool name, parameters, intent) is sent to the configured LLM provider for analysis.
• This data is used for real-time auditing only and is subject to the LLM provider's own data policies.
• No raw API keys or vault credentials are ever sent to LLM providers.

6. Data Retention

You can delete your data at any time by deleting your account. Upon account deletion, all associated audit logs, rules, API keys, vault entries, and configuration data are permanently removed from the database.

7. Cookies & Local Storage

Session cookies are used for authentication only. These cookies are essential for maintaining your login session and do not track you across other websites.

localStorage is used for UI preferences such as theme settings, sidebar state, and dashboard layout. This data stays in your browser and is never transmitted to our servers.

8. Contact

If you have questions about this Privacy Policy or your data, you can reach out through the project repository or your deployment's configured contact channels.