Effective Date: January 16, 2025

Privacy Policy

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

Privacy Policy - Snowball

_{Last Updated:}_{December 25, 2025}

_{This Privacy Policy explains how Snowball ("we," "us," or "our") collects, uses, stores, and protects your personal data when you use our platform. We are committed to protecting your privacy in compliance with the General Data Protection Regulation (GDPR) and French data protection laws.}

1. Data Controller

_Identity:_{Snowball
Lille, Hauts-de-France, France}_{Contact Email:}_{clipflow59@proton.me}

_{As the data controller, we determine how and why your personal data is processed.}

2. Information We Collect

We collect the following categories of personal data through OAuth authentication and platform usage:

From Twitch (via OAuth):

_{Twitch username}
_{Twitch user ID}
_{Profile picture URL}
_{Email address associated with your Twitch account}
_{OAuth access token (encrypted)}
_{OAuth refresh token (encrypted)}
_{OAuth scopes authorized by you}
_{Twitch user IDs of clippers you whitelist}
_{Clip metadata provided by Twitch API (title, creator, creation date, duration, view count, etc.)}

From YouTube (via OAuth):

_{OAuth access token (encrypted)}
_{OAuth refresh token (encrypted)}
_{OAuth scopes authorized (currently video.upload and user authentication)}

From TikTok (via OAuth):

_{OAuth access token (encrypted)}
_{OAuth refresh token (encrypted)}
_{OAuth scopes authorized (currently video.upload and user authentication)}

Technical Data:

_{IP address}
_{Browser type and version}
_{Device information}
_{Access logs and timestamps}

_Important:_{We do NOT permanently store video files. Clips are temporarily downloaded to}_/tmp_{storage during processing and immediately deleted after upload to your connected social media platforms.}

3. Legal Basis for Processing

_{We process your personal data based on the following legal grounds under GDPR Article 6:}

_{Consent (Art. 6.1.a):}_{When you authorize OAuth access to your Twitch, YouTube, or TikTok accounts}
_{Contract Performance (Art. 6.1.b):}_{To provide the clip scheduling and automation services you requested}
_{Legitimate Interests (Art. 6.1.f):}_{To maintain platform security, prevent fraud, and improve service quality}

4. How We Use Your Information

_{Your data is used exclusively for the following purposes:}

_{Core Service Functions:}

_{Authenticate your identity via Twitch OAuth}
_{Retrieve clips created by your whitelisted clippers from the last 24 hours (every 10 minutes)}
_{Convert clips to short-form vertical video format}
_{Schedule and upload clips to your connected YouTube and TikTok accounts at specified times}
_{Prevent duplicate posts on the same platform}
_{Automatically refresh OAuth tokens when they expire to maintain service continuity}

_{Platform Maintenance:}

_{Monitor service performance and troubleshoot technical issues}
_{Ensure compliance with third-party platform Terms of Service (Twitch, TikTok, YouTube)}
_{Detect and prevent unauthorized access or fraudulent activity}

_{We do NOT:}

_{Sell or rent your personal data to third parties}
_{Use your clips for marketing or promotional purposes without explicit consent}
_{Share your data with advertisers or data brokers}

5. Data Retention

_{We retain your personal data only as long as necessary to provide our services:}

_{Active Accounts:}

_{OAuth tokens: Stored (encrypted) until you revoke access or delete your account}
_{Clip metadata: Retained until clips are successfully posted to all scheduled platforms}
_{Whitelist data: Stored while your account remains active}

_{Inactive Accounts:}

_{Accounts inactive for 24 consecutive months will be automatically deleted, including all associated personal data}

_{Immediate Deletion:}

_{When you revoke platform access, associated tokens are immediately deleted from our database}
_{When you delete your account, all personal data is permanently removed within 30 days}

6. Data Security Measures

_{We implement industry-standard security practices to protect your data:}

_Encryption:

_{All OAuth access and refresh tokens are encrypted using AES encryption via Python's}_cryptography_library
_{Encryption keys are stored securely as environment variables on Render (not in code or version control)}
_{All data transmission uses HTTPS/TLS encryption}

_{Access Controls:}

_{Administrative access to production databases is restricted and logged}
_{Regular security audits of infrastructure and code}

_{Infrastructure Security:}

_{Hosted on Render with SOC 2 Type II certified infrastructure}
_{Database managed by Supabase with built-in security features}
_{Temporary video files stored in}_/tmp_{with automatic deletion after processing}

_Limitations:
_{While we take reasonable precautions, no internet transmission method is 100% secure. We cannot guarantee absolute security.}

7. Third-Party Data Sharing

_{We share your data with the following third-party services solely to operate Snowball:}

_{Service Providers:}

_{Render (USA):}_{Cloud hosting platform for backend infrastructure. Data transfer is protected by Standard Contractual Clauses (SCCs) under GDPR Article 46}
_Supabase:_{PostgreSQL database hosting. Data is encrypted at rest and in transit}
_{Twitch API:}_{To retrieve clips and authenticate users}
_{YouTube API:}_{To upload scheduled clips (complies with YouTube API Terms)}
_{TikTok API:}_{To upload scheduled clips (complies with TikTok Developer Terms)}

_{We do NOT share your data with analytics providers, advertising networks, or marketing platforms.}

8. International Data Transfers

_{Your data may be transferred to and processed in countries outside the European Economic Area (EEA), specifically the United States (Render hosting). These transfers are protected by:}

_{Standard Contractual Clauses (SCCs) approved by the European Commission}
_{Service providers with adequate security certifications (SOC 2, ISO 27001)}

9. Cookies and Tracking Technologies

_{Current Status:}
_{Snowball currently does not use cookies for analytics or tracking purposes. If we implement cookies in the future (e.g., for session management), this policy will be updated and you will be notified.}

Third-Party Cookies:
_{OAuth authentication with Twitch, YouTube, and TikTok may set cookies according to their respective privacy policies. We do not control these third-party cookies.}

_{10. Your GDPR Rights}

_{Under GDPR, you have the following rights regarding your personal data:}

_{Right to Access (Art. 15):}_{Request a copy of all personal data we hold about you. Contact us to receive your data in a structured, machine-readable format.}

_{Right to Rectification (Art. 16):}_{Correct inaccurate or incomplete personal data through your account settings.}

_{Right to Erasure (Art. 17):}_{Request deletion of your account and all associated data at any time via account settings or by contacting us.}

_{Right to Restrict Processing (Art. 18):}_{Limit how we process your data under certain circumstances (e.g., while disputing accuracy).}

_{Right to Data Portability (Art. 20):}_{Receive your data in CSV or JSON format to transfer to another service.}

_{Right to Object (Art. 21):}_{Object to processing based on legitimate interests.}

_{Right to Withdraw Consent:}_{Revoke OAuth access to Twitch, YouTube, or TikTok at any time through account settings. This will immediately stop clip retrieval and uploads.}

_{To exercise these rights, contact us at:}_{clipflow59@proton.me}

_{We will respond to requests within 30 days as required by GDPR.}

11. Data Breach Notification

_{In the event of a data breach that poses a risk to your rights and freedoms, we will:}

_{Notify the French data protection authority (CNIL) within 72 hours}
_{Inform affected users via email without undue delay}
_{Provide details on the nature of the breach, potential consequences, and mitigation measures}

12. Children's Privacy

_{Snowball is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If we discover that a minor has provided personal information, we will delete it immediately.}

13. Compliance with Platform Policies

_{Our data practices comply with the following third-party Terms of Service:}

_{TikTok Developer Terms of Service}
_{TikTok Developer Data Sharing Agreement}
_{YouTube API Terms of Service}
_{Twitch Developer Services Agreement}

14. Changes to This Privacy Policy

_{We may update this Privacy Policy to reflect changes in our practices, legal requirements, or service features. Material changes will be communicated via:}

_{Email notification to your registered address}
_{In-app notification upon login}
_{Prominent notice on our website}

_{The "Last Updated" date at the top of this page will reflect the most recent revision. Continued use of Snowball after changes take effect constitutes acceptance of the updated policy.}

15. Contact Us and Complaints

_{Questions or Data Requests:}_{Email: clipflow59@proton.me
Address: Snowball, Lille, France}

_{File a Complaint:}_{If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with the French supervisory authority:}

_{CNIL (Commission Nationale de l'Informatique et des Libertés)}_Website:_{https://www.cnil.fr}_{Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France}

Privacy Policy

Privacy Policy - Snowball

Last Updated: December 25, 2025

1. Data Controller

Identity:SnowballLille, Hauts-de-France, FranceContact Email: clipflow59@proton.me

As the data controller, we determine how and why your personal data is processed.​

2. Information We Collect

From Twitch (via OAuth):

From YouTube (via OAuth):

From TikTok (via OAuth):

Technical Data:

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:​

4. How We Use Your Information

Your data is used exclusively for the following purposes:​

Core Service Functions:

Platform Maintenance:

We do NOT:

5. Data Retention

We retain your personal data only as long as necessary to provide our services:​

Active Accounts:

Inactive Accounts:

Immediate Deletion:

6. Data Security Measures

We implement industry-standard security practices to protect your data:​

Encryption:

Access Controls:

Infrastructure Security:

Limitations:While we take reasonable precautions, no internet transmission method is 100% secure. We cannot guarantee absolute security.​