Privacy
Snapsus is built so the question "what do you do with my data?" has a very short answer: almost nothing.
What we collect
No accounts. No tracking pixels. No analytics scripts. No cookies. No fingerprinting. We do not embed Google Analytics, Mixpanel, Segment, or any equivalent.
What we store
Snapshot results are computed in your browser and never stored on our servers, unless you click "Get a shareable link". The CSV and JSON archives you download exist only on your machine. We do not keep a copy.
The Cloudflare edge keeps copies of public API answers to cut load: collection details for up to 1 hour, holder lists for 3 to 5 minutes, OpenSea account lookups for up to 24 hours and OpenSea collection lists for up to 6 hours. Share pages and their data are cached for 5 minutes. These copies hold only the public API answer. They are never linked to you, we don't look at them, and they expire on their own.
Shared snapshots
If you click "Get a shareable link" we publish the snapshot to Cloudflare KV under a random 8-character ID and return a URL like snapsus.com/s/ABC12345. Anyone with that URL can view the snapshot and check addresses against it.
The published payload is the same data anyone could derive themselves from public on-chain history: holder addresses, allocation counts, the source wallets/contracts you snapshotted, collection names, and the block heights used. No personal data is added. Share pages tell search engines not to list them.
Shared snapshots auto-expire after 1 year. We have no UI for deletion before that. If you need a snapshot taken down sooner, email [email protected] with the ID.
What hits third parties
To do its job, Snapsus queries:
- Alchemy: for on-chain reads (contract metadata, transfers, owners). Snapsus uses a server-side API key, so Alchemy sees our edge IP, not yours.
- OpenSea: for finding the collections a creator made. Same setup as Alchemy: the request comes from our edge.
- ENS Ideas (
api.ensideas.com): for ENS names. These calls go straight from your browser, so they see your IP and may log it under their own privacy policy. - DefiLlama (
coins.llama.fi): to turn a date into a block number. Also straight from your browser. - Google Fonts (
fonts.googleapis.com,fonts.gstatic.com): the Inter typeface loads from Google, so Google sees your IP when the font loads. - Simple Icons (
cdn.simpleicons.org): two small logos on the export buttons load from this CDN. - Images: ENS avatars and collection pictures load straight from where they are hosted (the ENS metadata service, OpenSea, IPFS gateways and others), so those hosts see your IP.
If any of these are a concern, you can use the site without ENS resolution (it's optional, address-only mode works) and avoid historical snapshots (which need DefiLlama).
What Cloudflare sees
The site is hosted on Cloudflare Pages. Cloudflare logs the IP address of every request for security and abuse prevention; we do not have access to this data beyond aggregate counters and never link it to any other identity.
Rate limiting
To keep the proxy from being abused as a free Alchemy/OpenSea relay, we count requests per IP via Cloudflare KV. The per-minute counters hold an IP and a count for at most 90 seconds. The contact form counter lasts about an hour. Then they delete themselves. We do not keep or analyze this data.
Agent tools
The paid agent tools at tools.snapsus.com answer JSON requests from AI agents. We use the inputs (addresses, contracts, transaction hashes) only to answer, and keep a copy of each answer at the edge for 2 minutes so repeat calls are cheap. We don't keep request logs.
Calls are paid in USDC on Base through x402. A payment facilitator (Coinbase CDP, or PayAI as a fallback) checks and settles each payment, and the paying wallet and the transaction are public on-chain. After a paid call we report the payer address, the transaction hash and the response time to OpenSea's tool registry, so the call counts in the tool's public usage stats.
To answer, the tools query Alchemy, GoPlus, Sourcify, 4byte and DefiLlama from Cloudflare's servers, so those services see Cloudflare's IP, not the agent's.
Contact form
The contact form is switched off for now. When it is on and you send a message, we receive your email address, the subject and body of your message, the topic you selected, and the IP address that submitted it. The message is delivered to [email protected] via Resend (transactional email service) and a copy is retained for 90 days under a random ID in Cloudflare KV for audit and abuse-prevention purposes, then auto-deletes.
We use the email address solely to reply. We don't add it to any newsletter or sell it.
Children
Snapsus is not directed at children under 13 and we do not knowingly collect data from anyone of any age.
Changes
If we ever start collecting more than this (we don't plan to), the change will land here with the date above updated. There's no email list to notify.
Contact
Questions? Email us at [email protected].
This document is a plain-language summary. It is not legal advice. Where stricter local privacy law applies (GDPR, CCPA, etc.), that law takes precedence.