Privacy policy
Last updated: October 1, 2026
Snow OS is built to need as little about you as possible. There is no e-mail, no phone number, no name, no advertising and no analytics. This page lists everything the website and your Snow OS account do keep, and for how long.
The short version
- We do not ask for or store your e-mail, phone number, real name, address or payment details.
- We store a username and a hash of your password. Your recovery key is shown once and never stored in readable form.
- We do not store IP addresses. To stop abuse we keep short-lived counters under a scrambled (keyed-hash) identifier.
- No ads, no analytics, no third-party scripts, no selling or sharing of data.
- You can delete your account yourself, any time, from My account.
1. What we keep, why, and for how long
| What | Why | How long |
|---|---|---|
| Username | Identifies your account; administrators can see it. | Until you delete the account. |
| Password (as an Argon2id hash, never the password itself) | To check that it is you signing in. | Until you change it or delete the account. |
| Recovery key (only a keyed fingerprint) | To let you recover the account if you lose the password. The key itself is shown to you once and we cannot show it again. | Until you generate a new key, recover the account or delete it. |
| Account dates and settings: when it was created, when you last signed in, when the recovery key was issued, whether it has experimental access or is an administrator | Running the account and the download channels. | Until you delete the account. |
| Invitation used (which invitation, and the private note an administrator wrote on it) | Sign-ups can be limited to invited people; this tells administrators which invitation brought an account. | Until you delete the account. |
Session cookie (snow, or __Host-snow over HTTPS) and the session data kept on our server: a random id, a form-protection token, the captcha you are solving, one-time messages | Keeps you signed in and protects forms against forgery. It is only created when you use a page that needs it (sign-up, log-in, account…), not when you read the home or download pages. | The cookie ends with your browser session or when you log out; the server copy is removed after 14 days at most. |
| Abuse-protection counters: how many requests a connection made recently, stored under a keyed hash of your network (for IPv6, of the /64 block) — not your IP address | Stops floods, password guessing and automated sign-ups, and keeps the site fast for everybody. | Minutes to about a day, then deleted automatically. |
| Computers linked to Snow Cloud (if you use it): the name you gave each computer, its model and system version as it reports them, a public key the computer generates for itself, when it was last seen, and sign-in tokens (stored as hashes) | Shows your computers on your account and lets them sign in to your cloud features. | Until you remove the computer or delete the account. |
| Moderation records: if an account is suspended, the reason, the date and who did it; plus a log of administrator actions (who did what to which username, and when) | Fighting abuse and keeping administrators accountable. | The suspension ends with the account. The administrator log keeps the username text (nothing else about you) even after an account is deleted. |
| Download counts | How many times each version was downloaded. | Only a total per version is kept — no list of who downloaded what. |
The Snow OS package service (the updates your computer downloads) is anonymous: it needs no account and records no list of what a computer downloaded.
2. What we do not collect
E-mail addresses, phone numbers, names, postal addresses, payment details, location, device fingerprints, advertising identifiers, or anything from analytics or advertising networks. The website uses no third-party scripts, and its fonts are served from the site itself.
3. Services we rely on
- Our hosting provider runs the web server. Like any web server, it normally keeps technical access logs (IP address, requested address, time, browser string) for security and troubleshooting. We do not use those logs to build profiles, and we cannot see them as part of the website.
- Cloudflare sits in front of the site to deliver pages faster and filter abusive traffic. It sees the requests that pass through it, including IP addresses, and may set its own technical cookies for security. See Cloudflare's privacy policy for how it handles that data.
We do not sell your data and we do not share it with anyone else, except if the law obliges us to.
4. Your choices
- Delete everything. My account → I want to delete my account permanently removes your account, sign-in, recovery key fingerprint, invitation record and linked computers. It cannot be undone. Counters expire by themselves, and copies in our hosting provider's backups are overwritten as those backups rotate.
- Change or renew. You can change your password, generate a new recovery key, and unlink computers whenever you want.
- Ask us. Depending on where you live, laws such as the GDPR or Brazil's LGPD may give you rights to access, correct or delete your data, or to object to how it is used. Because we hold so little, most of it is visible on your account page and can be removed there. For anything else, contact us (see below). Since we have no e-mail address for you, we may ask you to prove you control the account by signing in.
5. Losing your password and your recovery key
Because we do not hold your e-mail, we have no way to identify you outside the account. If you lose both your password and your recovery key, nobody — including us — can open the account again. That is the price of not collecting your personal details.
6. Security
Passwords are stored with Argon2id; recovery keys are never kept in readable form; the site is served over HTTPS; forms are protected against forgery; sign-in attempts are rate-limited. No system is perfectly safe, but we collect so little that there is little to lose.
7. Children
Snow OS accounts are not meant for children under 13. If you believe a child has created an account, contact us and we will delete it.
8. Changes to this policy
If we change what we collect, we will update this page and its date, and announce significant changes on the website before they take effect.
9. Contact
Questions about these pages, or about your data? Contact us at [email protected].
See also the Terms of service.