Privacy Notice

Updated November 7, 2026 · Contract version 2026-11-07-r14

Eric Bouchard, a sole proprietor in British Columbia operating the SnafuFinder publicly as edr0id, is responsible for personal information under the service’s control. Privacy questions and complaints are handled by the Privacy Officer at [email protected].

Information processed

• The customer or beta participant name and email.
• For Claude connector accounts, the email address used to sign in, the account’s creation and last sign-in times, and the stores audited with it, their audit results and ownership confirmations.
• The public store URL submitted for auditing.
• Audit results and technical observations about that public store.
• Contract or privacy acceptance date and policy version.
• For purchases, the billing country the customer states and the country Cloudflare reports for the connection, used to apply where paid audits are sold and kept as tax-record evidence of where the customer is located.
• For purchases, the time the customer confirmed they own the store or have the owner’s permission to test it.
• For beta participants, invitation status, platform, private questionnaire ratings, written feedback, and optional permission to be contacted about that feedback.
• PayPal order, capture, amount, currency, invoice, and payment-status identifiers for paid services. SnafuFinder doesn't receive or store full payment-card details.
• Basic request information used for security, rate limiting, and diagnosis, such as an IP address and limited server logs.
• Support, recovery, cancellation, and refund communications.

Why it is used

Information is used to process payment where applicable, redeem beta invitations, prevent duplicate or unauthorized access, run the requested audit, deliver and support the report, improve beta accuracy and usefulness, diagnose failures, handle refunds, and maintain required business records. Beta feedback is private and isn't published with a participant or store identity without separate permission.

Anonymous preview telemetry

When someone submits a public storefront URL for a free preview, SnafuFinder retains the submitted public URL and technical audit information so the service can operate, diagnose failures, maintain security and reliability, evaluate Auditor accuracy, identify unreliable checks, and improve product functionality. This may include the audit time and duration, Auditor version and profile, detected ecommerce platform, readiness score and finding counts, individual technical check outcomes and evidence generated from public storefront behavior, DNS/HTTPS/TLS findings, storefront and checkout-entry signals, payment-provider signals, policy-page findings, rendered desktop/mobile journey status, and normalized failure category or failed stage.

Free-preview telemetry doesn't deliberately include names, email addresses, payment credentials, passwords, private storefront credentials, browser fingerprints, advertising identifiers, keystrokes, or unrelated page contents. Detailed anonymous-preview telemetry is scheduled for automatic deletion after 90 days; cleanup runs when new anonymous telemetry is recorded or the owner telemetry dashboard is read. It is available only through the authenticated owner system and isn't exposed through the public preview response.

Claude connector

SnafuFinder offers a connector for Claude, Anthropic’s AI assistant. Quick scans through the connector need no account. When one is requested, SnafuFinder receives the store URL and the IP address Cloudflare reports for the connection. The IP address is stored only as a keyed one-way hash, together with the store’s domain and the time, and only to apply daily scan limits; these records are deleted after 24 hours. The scan result for a domain is kept for 24 hours so repeated requests don’t scan the same store again.

Some connector features, such as listing your stores and running full audits, need you to sign in with your email address. SnafuFinder then keeps that email address with an account reference, the times the account was created and last signed in, the stores audited with it, each audit’s results and the time you confirmed you may test the store, to provide those features and keep your stores together. The 6-digit sign-in code SnafuFinder emails you is stored only as a keyed one-way hash, works once, and expires after 10 minutes. The records used to limit sign-in emails (the email address and a keyed one-way hash of the IP address) are deleted after 24 hours. After you sign in, Claude holds an access token for SnafuFinder rather than any password. Cloudflare stores these tokens for SnafuFinder only as one-way hashes, and a sign-in expires 30 days after it was made, when you sign in again.

Connector results, which can include your email address and the stores you audited, become part of your conversation with Claude. The connector doesn’t receive your name or the rest of your conversation. Anthropic processes your conversation under its own Privacy Policy. You can disconnect SnafuFinder in Claude’s settings at any time. To delete your connector account, its store list and its audit results, email the Privacy Officer at [email protected]; it’s deleted within 30 days unless a record must be kept for a legal reason.

Website analytics and cookies

With your permission, SnafuFinder uses Google Analytics on its public customer-facing pages to understand how visitors find and use the website and to improve those pages. Google Analytics uses cookies and similar identifiers to measure visits and interactions. Information may include pages viewed, referring websites, visit times, approximate location, browser and device information, and interactions such as scrolling or clicking links, depending on the Analytics settings enabled. Google processes IP addresses to provide the service, but Google Analytics 4 doesn't log or store individual IP addresses.

With the same permission, SnafuFinder also uses Microsoft Clarity on its public pages to see how visitors use them, so confusing or broken parts of the site can be fixed. Clarity records clicks, taps, scrolling, mouse movement and the page layout, and Microsoft uses this to produce session replays, heatmaps and aggregated usage statistics. Clarity sets first-party cookies (_clck and _clsk) that hold a pseudonymous ID so page views can be linked into one visit. SnafuFinder tells Clarity that advertising storage is denied, so Clarity doesn't share this data with Microsoft Advertising. Text typed into form fields, numbers and email addresses are masked by default and aren't sent to Clarity, and SnafuFinder also masks audit results and report links shown on the homepage. Microsoft keeps session replay data for 30 days and aggregated click and heatmap data for up to 9 months.

This visitor analytics is separate from the free-preview audit telemetry described above. The Google Analytics and Clarity tags aren't loaded on private report or feedback pages or the admin area. SnafuFinder doesn't deliberately send names, email addresses, submitted store URLs, payment details, private access tokens, or form contents to Google Analytics or Microsoft Clarity.

Google processes analytics information under its own terms and privacy policies. Read how Google uses information from sites that use its services and Google’s Privacy Policy. Read the Microsoft Privacy Statement for how Microsoft processes Clarity data. Google Analytics and Clarity stay blocked until you select Accept analytics in the consent popup. Rejecting analytics doesn't prevent you from using SnafuFinder. Your choice is stored locally in this browser for up to 180 days. Use the Analytics settings button on a public page to change your choice or withdraw permission. Withdrawing permission stops future collection and removes Google Analytics and Clarity cookies accessible to this site; it doesn't undo data already collected. If browser storage is unavailable, your choice may not persist between pages. You can also block or delete cookies using your browser settings, use a browser tracking blocker, or install Google’s Analytics opt-out browser add-on where supported. Deleting cookies alone doesn't prevent new cookies from being set on a later visit.

Cloudflare also provides its own Web Analytics on these pages to measure aggregate visits and page performance. Cloudflare Web Analytics doesn't use cookies or other persistent client-side identifiers and doesn't build an individual visitor profile, so it isn't covered by the Accept analytics choice above, which applies to Google Analytics and Microsoft Clarity. Cloudflare processes this information under its own Privacy Policy.

Website security and bot protection

SnafuFinder uses Cloudflare to deliver this website and protect it against abuse. Cloudflare processes request information such as IP addresses, request headers, and security signals to route traffic, block malicious requests, and enforce rate limits. The free preview form uses Cloudflare Turnstile to check that a preview request comes from a person rather than an automated tool. Turnstile collects browser and device signals for that check and returns a single-use verification result to SnafuFinder. It is used for security, not for advertising or website analytics. Cloudflare processes this information under its own Privacy Policy and the Turnstile Privacy Addendum.

Service providers

PayPal processes checkout and payment information under its own privacy terms. Resend sends SnafuFinder’s emails, such as receipts, report links, and sign-in codes, and processes the destination email address and message. Apple iCloud Mail hosts the support mailbox and processes messages sent to it. Google, Microsoft (Clarity) and Cloudflare provide website analytics as described above. Cloudflare also provides website delivery, security, and bot protection as described above, and runs the Claude connector, including storing its sign-in tokens. Vultr (The Constant Company, LLC) hosts the application server that runs SnafuFinder and may process limited server and security logs needed to operate the service.

Consent and choices

The service collects information needed to respond to a service inquiry and provide the requested audit, private link, recovery, support, payment processing, or beta access. A customer who doesn't provide required checkout information can't complete a purchase. A beta participant may keep the report without completing the optional questionnaire. A feedback contact doesn't subscribe anyone to marketing. Consent may be withdrawn for optional or future uses, but withdrawal can't undo processing already required to complete a transaction or satisfy legal obligations.

Security

Payment and email credentials remain server-side. Private report tokens are stored as one-way hashes, and the recoverable token copy is separately encrypted. Connector sign-in codes and tokens are also stored only as one-way hashes. Private links keep tokens out of ordinary HTTP request paths. Access is limited to operational need and reasonable safeguards are used, but no system can promise absolute security. Customers should keep report links private.

Retention

Detailed anonymous free-preview telemetry is retained for 90 days. A Claude connector account is kept until you ask for it to be deleted. Personal information used to make a decision directly affecting a customer is retained for at least one year where required by British Columbia’s Personal Information Protection Act. Transaction and accounting records may be kept for at least six years from the end of the relevant tax year where required for Canadian tax records. Other identifiable information is deleted or de-identified when it is no longer reasonably needed for report delivery, recovery, support, security, disputes, or another legal or business purpose.

Access, correction, deletion, and complaints

Requests to access or correct personal information, ask about deletion, or challenge compliance can be sent to the Privacy Officer at [email protected]. Identity may need to be verified before a request is fulfilled. Some records can't be deleted immediately where continued retention is required by law or reasonably necessary for a dispute or business record.

International processing

Cloudflare, Google, Microsoft, PayPal, Anthropic, Resend, and Apple may process data outside Canada; their contractual and technical safeguards apply to their processing. The application server runs on a Vultr (The Constant Company, LLC) virtual private server located in Toronto, Canada, so that hosting doesn't involve processing outside Canada.