Privacy Policy
screenshot-api.net is operated by Caio Ricciuti (“we”, “us”), an individual sole operator, acting as the data controller for the data described below. This policy covers the website, the dashboard and the rendering API. It is written to be read, not to be survived.
1. The short version
- We do not store your screenshots. An image is rendered, returned in the HTTP response, and never written to a database or object store.
- We do not store the URLs you capture. Only the hostname is logged —
example.com, never the path, query string or fragment. - We ask for an email address and nothing else. No name, no company, no phone number, no address.
- We never see your card. Payments run entirely inside Stripe.
- We do not sell data, run ad trackers, or share anything for marketing. Analytics is self-hosted and cookieless.
- Everything lives on one server in Helsinki, Finland, inside the EU.
2. What we collect
Your account
Your email address, the plan you are on, the date you signed up, and — once you subscribe to a paid plan — the Stripe customer identifier that links your account to your billing record. There is no password to store: you sign in with a single-use link sent to your email.
API keys
We store a SHA-256 digest of each key and its first 16 characters, so the dashboard can show you which key is which. The key itself is never written down. It is shown to you once, at creation, and after that we could not recover it if we wanted to. We also record when a key was created, when it was last used, and whether it has been revoked.
Usage and metering
A counter of renders per calendar month per account, which is what your quota is measured against.
The render log
One row per capture, holding: your account id, the hostname of the target page, the output format, the size of the image in bytes, how many milliseconds it took, whether it succeeded, and the timestamp. This is what draws the charts on your dashboard and what we look at when you tell us something is slow or broken. It is deleted after 90 days.
Sign-in tokens and sessions
Sign-in links and session tokens are stored only as SHA-256 digests, alongside their creation and expiry times. A sign-in link is single-use and expires after 20 minutes; a session expires after 30 days.
Server logs
The web server writes an access log containing IP address, timestamp, requested path, response status, response size and user agent. These logs exist to debug faults and to spot abuse. They rotate automatically and old files are discarded — we do not archive them.
The public demo
The demo on the home page runs without an account. To keep it from being used as a free rendering farm we hold your IP address in memory only for an hourly rate-limit counter. It is never written to disk and it is gone when the process restarts.
Waitlist
If you gave us an email address for a feature waitlist, we hold that address and where you submitted it, until the feature ships or you ask us to delete it.
3. Screenshots are not stored
This is the part people actually want to know, so it gets its own section.
- Each capture runs in a fresh, isolated browser context that is destroyed when the render finishes. Cookies,
localStorageand HTTP cache never carry from one customer’s render to another’s. - The resulting image is streamed back in the response body. We do not write it to disk, to a database, or to any cache or CDN of ours.
- We do not keep the full URL you asked for. The guard that validates it sees the whole URL in memory for the length of the request; only the hostname survives into the log.
- We do not read, index or analyse the contents of the pages you capture.
API responses carry a Cache-Control header allowing five minutes of caching. That instruction
is for your client and any proxy you put in front of it. If you capture something sensitive,
set your own caching rules accordingly.
4. Why we are allowed to
Under the GDPR, each thing we do rests on one of these legal bases:
| What | Basis |
|---|---|
| Running your account, issuing keys, metering quota | Performance of a contract (Art. 6(1)(b)) |
| Taking payment and issuing receipts | Performance of a contract (Art. 6(1)(b)) |
| Keeping invoices and payment records | Legal obligation — tax and accounting law (Art. 6(1)(c)) |
| Server logs, rate limiting, abuse prevention, security | Legitimate interests — keeping the service up and not being abused (Art. 6(1)(f)) |
| Aggregate, cookieless traffic statistics | Legitimate interests — understanding what the site is used for (Art. 6(1)(f)) |
| Waitlist emails | Consent (Art. 6(1)(a)), withdrawable at any time |
5. How long we keep it
| Data | Kept for |
|---|---|
| Account email, plan, signup date | As long as the account exists, then deleted within 30 days of your deletion request |
| API key digests | Until you revoke the key or delete the account |
| Monthly usage counters | Life of the account — they are your billing history |
| Render log (hostname, size, duration) | 90 days, then automatically deleted |
| Sign-in tokens | 20 minutes, or until used |
| Sessions | 30 days, or until you sign out |
| Server access logs | Until rotated out — days to weeks, never archived |
| Demo rate-limit IPs | In memory only, roughly an hour |
| Invoices and payment records | As long as tax and accounting law requires |
| Backups | 14 nightly snapshots, then overwritten |
Deleting your account removes your email, keys, usage rows and render log. Payment records held by Stripe, and anything we must keep for tax purposes, survive that deletion because the law requires it.
6. Who else touches it
The list is short on purpose. Every one of these is a company we pay to do one job.
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | The server everything runs on | Helsinki, Finland (EU) |
| Stripe Payments Europe, Ltd. | Subscriptions, cards, invoices, the billing portal | Ireland (EU), with transfers to Stripe, Inc. in the US |
| Resend, Inc. | Delivering sign-in links and account email | United States |
Analytics is self-hosted on our own infrastructure and is not a third party. There is no CDN, no tag manager, no advertising network, no session recorder, and no customer-support widget.
Business customers can find the same list, in contractual form, in the Data Processing Addendum. We will give notice there before adding a subprocessor.
7. International transfers
Your data is stored in Finland. Two providers involve a transfer outside the EEA: Resend, which delivers email from the United States, and Stripe, which may route data to its US entity. Both transfers are covered by the European Commission’s Standard Contractual Clauses. The only personal data leaving the EEA is your email address, and for Stripe, your billing details.
8. Cookies
We set two cookies, both strictly necessary, neither used for tracking. There is no cookie banner because there is nothing to consent to.
| Cookie | Purpose | Life |
|---|---|---|
sa_session | Keeps you signed in. HttpOnly, Secure, SameSite=Lax; holds an opaque token whose digest is what we store. | 30 days |
sa_auth | A flag with no secret in it, readable by the page so the navigation can render a signed-in state without a round trip. | 30 days |
Signing out deletes both. Your browser’s theme preference is kept in local storage, not in a cookie.
9. Analytics
We run a self-hosted Umami instance on our own server. It is cookieless, sets no
identifier, does not follow you between sites, and produces aggregate counts: pages viewed, referrer,
country, browser family. No data reaches a third-party analytics company because there isn’t one.
A browser sending Do Not Track, or any ad blocker, will suppress it entirely, and nothing on
the site depends on it.
10. Personal data in the pages you capture
When you point the API at a URL, whatever is on that page may contain personal data — names, faces, comments, a signed-in user’s own dashboard. For that data you are the controller and we are your processor: we render what you ask for, hand it back, and keep none of it.
That split carries obligations for you as well as for us. You must have a lawful basis and the right to capture the page — see the Acceptable Use Policy — and if you need a signed processor agreement, the Data Processing Addendum is it.
11. Security
- Everything is served over TLS. HTTP is redirected, and HSTS is set.
- API keys, sign-in links and session tokens exist in the database only as SHA-256 digests. A copy of the database yields no working credentials.
- The renderer runs as an unprivileged user in a container with filtered network egress, and every submitted URL is checked against private, loopback, link-local and reserved address ranges before a browser is allowed near it.
- The host runs a default-deny firewall; only ports 22, 80 and 443 are reachable, and SSH is key-only.
- Backups are taken nightly, kept for 14 days, and readable only by the operator.
- Card data never touches our servers.
No system is perfect. If you find a security problem, please write to me@caioricciuti.com before disclosing it publicly; we will not pursue anyone who reports a flaw in good faith and does not exfiltrate or destroy data.
If a breach affects your personal data and is likely to put you at risk, we will notify you and the relevant supervisory authority without undue delay.
12. Your rights
If you are in the EEA or the UK, you have the right to:
- ask what we hold about you, and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to processing we base on legitimate interests;
- receive your data in a portable format;
- withdraw consent where consent is what we relied on;
- complain to your national data protection authority — ours is the Spanish Agencia Española de Protección de Datos (AEPD).
Write to me@caioricciuti.com from the address on the account. We answer within 30 days, usually much sooner, and we do not charge for it. There is no automated decision-making and no profiling.
13. Children
This is a developer tool and is not directed at children. We do not knowingly hold data about anyone under 16. If you believe we do, tell us and we will delete it.
14. Changes
We may update this policy. The date at the top always reflects the current version, and material changes will be announced by email to account holders before they take effect.
15. Contact
Caio Ricciuti, sole operator of screenshot-api.net — me@caioricciuti.com. We have no Data Protection Officer; there is no separate department to route you to, so that address reaches the person who runs the service.