Snag: privacy, cookies and legal documents

Date: 3 October 2026.

Scope: marketing website, mobile app, future desktop app and backend. Assumption: a French company offering services in the European Union.

This is a roadmap, not a compliance certification or legal opinion. Documents must describe actual processing and receive legal review before commercial release. See also the production-readiness checklist.

1. Documents

Document	Purpose and status	Recommended location
Legal notice	Required for a professional website: company identity, registration, contacts, publication director and hosting provider.	Website footer; accessible from apps.
Privacy policy	Explain data, purposes, legal bases, recipients, retention, transfers and rights.	Public URL without login; app settings; collection forms.
Cookies and other trackers	Describe actual terminal storage/tracking and its controls. May be a privacy-policy section.	Website and relevant app settings.
Terms of use	Recommended for accounts, collections, scans, sharing and limitations of price estimates.	Website/apps; available before contractual acceptance.
PRO subscription/sales terms	Adapt to the sales channel: tax-inclusive prices, trial, renewal, cancellation, withdrawal, applicable warranties and mediation.	Before purchase and within the relevant website/apps.

A shared policy can have separate website, mobile and desktop sections describing their real differences.

Sources: Service Public, CNIL transparency guidance.

2. Tracker consent

• Storage strictly necessary for the service expressly requested can be exempt from consent; document necessity.
• Advertising, marketing tracking and non-exempt audience measurement require prior consent before activation.
• Some audience measurement can qualify for an exemption only when all applicable conditions hold.
• "Cookieless" does not automatically mean exempt. Mobile SDKs and desktop terminal reads/writes are also relevant.
• When consent is required, offer accept, refuse and customize without making refusal harder; optional purposes stay off until agreement.
• Actually block the processing before consent, retain evidence, remember refusal and provide easy withdrawal.

A server-side Redis price cache alone is not a tracker written to the user's terminal and does not itself require a cookie banner.

Source: CNIL tracker FAQ.

3. App journeys

Provide Settings > Privacy for documents, optional-processing preferences where relevant, rights requests, portability when applicable, and account deletion with justified retention explained.

Explain local versus server data, scan-photo uploads and retention, diagnostic images, any model-improvement reuse, collection synchronization, logs, account/device identifiers, collection valuation/history, aggregate versus individual scan statistics, public sharing and actual recipients.

Request camera permission when needed. OS permissions do not automatically constitute GDPR consent. Privacy information or acceptance of terms is not blanket consent for optional processing.

Source: CNIL mobile permissions.

4. Store disclosures

• Apple: accessible policy in the app and listing; App Privacy declarations reflect actual behavior, including SDKs.
• Google Play: accessible policy in the app/listing; accurate, maintained Data Safety declarations, including SDKs.
• Apps supporting account creation need an in-app deletion path; Google also requires an external web resource to initiate deletion.
• Deactivation is not deletion. Explain any legitimately retained data.

Sources: Apple review rules, App Privacy, Google user-data policy.

5. Organization and backend

Inventory processing and maintain the applicable register; justify legal bases; identify processors and contracts; safeguard transfers outside the EEA. Define and enforce retention for data, photos, logs and backups. Implement applicable rights and secure access, transport and backups. Have a breach procedure, including CNIL notification within 72 hours when required.

For relevant consent-based online processing in France, children under 15 require joint consent with a holder of parental authority. This is not a general ban on using Snag below 15. Contractual capacity and other countries' rules also need assessment.

Sources: CNIL first steps, breaches, children's consent.

6. Collection valuation and scan statistics

These are requirements to assess, not confirmation that the features are implemented.

Private valuation

Contract performance can generally support objectively necessary processing for the requested valuation service. Merely adding a feature to terms does not establish necessity. Holdings, quantities, condition, language, grading, acquisition prices and valuation history linked to an account are personal data, even with a technical ID or nickname.

Keep valuation private by default and out of public sharing unless selected. Define recipients, retention, deletion and rights. Send external pricing providers only necessary card characteristics, not owner identity or complete inventories unless required. Describe estimates as indicative, not guaranteed sale prices.

Aggregate per-card counters

Prefer account-independent backend counters:

Card ID | Day | Scan count

No user ID, IP, device ID or photo is needed for that simple counter. Decide whether it counts attempts, successful scans or confirmed cards. Avoid individual event retention when unnecessary; choose granularity/publication thresholds that limit reidentification; do not join counters back to accounts, holdings or identifying logs.

Hashing an ID is usually pseudonymization, not anonymity. Very fine aggregation may identify people. Any personal-data processing before aggregation still requires an appropriate purpose, legal basis, minimization and retention.

A server-side counter derived from necessary scan requests does not itself require a cookie banner. This is not a blanket exemption for analytics SDKs, additional telemetry or terminal access.

Individual history and analysis

Use	Assessment
Personal scan history offered to users	Separate service purpose, necessary data, explained retention and justified legal basis.
Account-linked internal analytics	Own purpose and legal basis. If legitimate interests apply, document necessity, proportionality, balancing and applicable objection rights.
Marketing profiling or non-exempt tracking	Prior consent where required, easy refusal/withdrawal, no conditioning essential features on optional tracking.

Legitimate interests do not override tracker-consent requirements. Audience-measurement exemptions must be demonstrated.

Register and policy decisions

Separate collection management/valuation, personal scan history if present and usage/scan statistics. For each, record data, justified legal basis, recipients, retention/criteria and applicable rights. Justify any individual events and their short retention before aggregation/deletion; no universal period is prescribed here.

Include derived personal valuation data in applicable rights/deletion procedures. Retain statistics after account deletion only when genuinely anonymous; handle legally justified personal retention separately. Store declarations must match real collection, including SDK events.

Recommended architecture: private account valuation; account-independent aggregate popularity counters; no implicit marketing tracking.

Sources: legal bases, legitimate interests, anonymization, audience measurement.

7. Observed local state and verification limits

On 3 October 2026, the inspected local snag-landing/app/legal/page.tsx still contained placeholder legal text. This is not a check of the deployed website or proof about other branches. No complete SDK, tracker, retention, store-disclosure or deletion audit was performed for this document.

8. Before launch

1. Inventory actual data, terminal storage, SDKs and recipients on each platform.
2. Justify bases, retention and processors; identify necessary consent.
3. Separate private valuation, personal history and aggregate statistics; assess minimization/reidentification.
4. Replace placeholders with accurate Snag documents.
5. Implement documents, consent, rights and deletion journeys, including derived data/history.
6. Reconcile Apple/Google declarations with actual behavior.
7. Test refusal, withdrawal and deletion end to end; obtain legal review.

Goal: documents, interface and backend agree, without unnecessary consent banners.