Privacy Policy

Snowfairy AI™ Labs Private Limited — Snowfairy AI™ OS Pen Software

Last updated: September 25, 2026  ·  Governing law: India

This Privacy Policy explains exactly what data OS Pen collects, why, how long it's kept, who sees it, and the rights you have. It covers only OS Pen — other Snowfairy AI™ products (like IntelliRecover) have their own separate privacy policies, since each collects different data for different reasons.

1. What We Collect

The following data is collected as a condition of using OS Pen, disclosed here and in the in-app License Agreement.

a) Account & Identity Data

When you create an account: your email address. If you use Google or Microsoft sign-in instead: your display name, email address, and profile photo, as provided by that service. Passwords are managed entirely by Firebase Authentication — we never see or store raw passwords.

b) License & Trial Data

Your license key, product tier (Basic, Standard, or Premium), activation date, and device count, if you purchase or activate a license. We keep your license bound to that device using a one-way hashed device identifier, so it stays valid across an app uninstall or reinstall. The same kind of device identifier is used during your 14-day free trial, solely to limit each device and account to one trial. In both cases, we only ever see the hash — never the underlying device information itself, and it can't be reversed to identify your hardware.

c) Email Verification Data

A short-lived 6-digit verification code, used only to confirm your email address before a trial can start. It's deleted as soon as you verify successfully, and it stops working automatically after 10 minutes if you don't.

d) Payment & Purchase Data

If you buy a license: your order reference, product tier, price, and a payment gateway reference number. If you're in India, payment is processed entirely by Razorpay; outside India, by Paddle.com Market Limited (our Merchant of Record for those purchases). Either way, we never receive or store your full card number, CVV, or bank account details — that's handled entirely by the processor.

e) Crash & Usage Diagnostics

If OS Pen terminates unexpectedly, a privacy-minimised crash report is written to a local file on your own device. Whether anything is also sent to us is your choice: diagnostic reporting is off until you turn it on, you are asked once during the Quick Start tour, and you can change it at any time in Settings. While it is on, crash and freeze reports are sent when something goes wrong, along with a once-per-session summary of how long the app was open and how many screenshots, exports or OCR runs were made — counts only. Both are linked to your licence so support can identify your installation. These reports never include your screen content, ink strokes, drawings, file names, or the contents of any file you have annotated. See section 3 for the full detail.

f) Website AI Chat & Support Data

If you use the website chat, we process the messages you submit together with limited context such as the current Snowfairy domain, page path, device category, and a random chat-session identifier. Messages are sent to our AI provider to generate replies. When a conversation ends, a redacted transcript may be delivered through our email provider to Snowfairy's restricted support inbox so our team can understand unresolved issues and improve support. We do not store the transcript itself in Firebase; limited hashed rate-limit, abuse-prevention, and duplicate-delivery records may be stored temporarily. Do not submit passwords, verification codes, payment-card details, license keys, government identifiers, or another person's personal information through chat.

g) WiFi Collaboration Connection Data (Premium)

Local-network collaboration. When the user starts or joins Wi-Fi/LAN Collaboration, the application uses the local network to discover or connect participating devices and exchange session information necessary for collaboration. Availability may depend on firewall, router and device settings. Local collaboration content is not automatically uploaded to Snowfairy's servers unless a separately identified online service is explicitly used.

In more detail: Wi-Fi/LAN Collaboration (a complimentary Premium Beta feature, local-network sessions between devices on the same WiFi/LAN) connects participating devices directly over your local network using a plain TCP socket connection — there is no internet connection, no Snowfairy server or cloud relay, and no third-party signaling service involved in setting up or carrying a Wi-Fi/LAN Collaboration session. The host device shares a session room code; a joining device uses it to connect directly to the host over the local network. The drawing/annotation data exchanged between devices during the session is encrypted with a key derived from that room code (AES-256-GCM). As with any local-network feature, connection reliability and how many participants a session can smoothly support depend on your WiFi network's speed and stability — see Terms of Service Section 17 for which tiers include Wi-Fi/LAN Collaboration.

h) Local Screen, Camera & Microphone Processing (Creator Recorder)

Local screen, camera and microphone processing. When the user explicitly starts Creator Recorder, the application may access the selected screen or display, microphone and optional camera for the purpose of creating a local recording. Recording controls and status are shown to the user. Recordings are saved to a location selected or controlled by the user and are not automatically uploaded to Snowfairy. Operating-system permission and privacy settings apply.

Creator Recorder is a Premium feature for Windows (see Terms of Service for which tiers include it). All recording — screen, camera, and microphone — happens locally on your device; nothing is uploaded to Snowfairy unless you explicitly choose to share the resulting file yourself.

i) On-Device Android OCR (Google ML Kit)

On Android, the optional OCR tool uses Google ML Kit to recognise text. The image or screen content selected for OCR, and the recognised text produced from it, are processed on your device and are not sent to Google by ML Kit. ML Kit may periodically contact Google to receive bug fixes, updated models or hardware-accelerator compatibility information, and may send performance and utilisation metrics. Google processes those limited metrics under its own privacy policy. Snowfairy does not use ML Kit to upload your drawing, screenshot or recognised text content.

2. What We NEVER Collect

We do not sell your personal data, use it for advertising profiling, or share it with data brokers.

3. Crash & Usage Reports

Diagnostic reporting is off until you turn it on. OS Pen asks you once, during the Quick Start tour, and records whichever answer you give — a “no” is never asked again. You can change it at any time in Settings.

If you leave it off, nothing described in this section ever leaves your device. Crash reports are still written to a local file you can inspect or delete, and you can choose to send that file to support yourself.

If you turn it on, two kinds of report are sent to us:

• Crash and freeze reports, sent only when something actually goes wrong — the error type, where in the code it happened, how long a freeze lasted, your Windows version and the app version.
• A once-per-session usage summary — how long the app was open, and counts of actions such as screenshots, exports, or OCR runs. Counts only: never what any of them contained.

Both are linked to your licence, so that if you contact us we can see what actually happened on your installation instead of asking you to reproduce the problem.

What is never included, whichever setting you choose: your screen content, ink strokes, drawings, documents, file names, file contents, or anything you have written.

Support logs are unchanged: they are only ever generated on your device, and only ever shared with us if you explicitly choose to send them when contacting support.

4. Geolocation Data (Website Only)

When you visit our pricing page, it makes a single request to ipapi.co (a third-party geolocation service) to determine your approximate country, so the correct currency (USD or INR) can be shown. We do not store your IP address in our own databases beyond what's needed to process that single request. If you prefer not to share this, select your region manually on the pricing page, or block outbound requests to ipapi.co in your firewall.

5. Cookies & Session Data

OS Pen shares the same account system (account.snowfairy.ai) used across Snowfairy AI™ Labs products. That portal uses:

• sf_session (authentication cookie): a Secure, HttpOnly session cookie enabling sign-in across Snowfairy subdomains. Expires after 1 hour of inactivity.
• Firebase Authentication tokens: short-lived tokens held in browser memory, not persistent cookies.
• Functional local storage: non-personal UI preferences (theme, tab state), never transmitted to our servers.

The OS Pen website (ospen.snowfairy.ai) sets one further cookie, and only if you arrive through a referral partner's link: __Host-sf-ref-aiospen. It stores a signed reference to that partner's referral code so that a purchase can be credited to them. It contains no personal information about you, is readable only on ospen.snowfairy.ai, is not used for advertising or for tracking across sites, and expires after 30 days.

We do not use advertising cookies, cross-site tracking, or retargeting pixels on the account portal or the OS Pen desktop application.

6. How We Use Your Data

7. Data Storage & Security

Account, license, and trial data is stored in Google Firebase (Firestore + Firebase Authentication), hosted on Google Cloud infrastructure. Security measures:

• All data in transit: HTTPS/TLS encryption
• License key integrity: HMAC-SHA256 signatures
• Locally stored license, account, and trial data on your device: encrypted using Windows' own Data Protection API, tied to your specific device
• Firebase Security Rules: you can only access your own data — cross-user access is blocked at the database rule level
• Cloud Functions validate their inputs, enforce product and device rules, apply rate limits where applicable, and return cryptographically signed entitlements; browser-facing administrative operations additionally require authenticated administrator authorization

No system can guarantee complete security. In the event of a personal data breach that poses a risk to your rights, we will notify you as required by applicable law.

8. Data Retention

9. Third-Party Services

We do not share your data with any other third party, except as required by applicable law.

10. Your Rights

Wherever you're located, you can ask us to access, correct, or delete your data, or object to a specific use described above. Email support@snowfairy.ai with your registered email address and the right you wish to exercise. We aim to acknowledge within 3 business days and resolve within 30 days (or the applicable statutory deadline). We may verify your identity before acting on your request.

This policy is written with reference to GDPR, UK GDPR, DPDP Act 2023, and CCPA/CPRA concepts as a matter of good practice — this is not a representation that every jurisdictional threshold making a specific law legally mandatory for us has been independently verified.

11. Children's Privacy

OS Pen is not directed at children under the age of 18, or the higher age threshold required by local law. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact support@snowfairy.ai immediately and we will delete it without undue delay.

12. International Data Transfers

Our data is stored on Google Firebase infrastructure. Where Google or our other service providers transfer personal data across borders, this is done under the contractual safeguards required by applicable law (such as Standard Contractual Clauses, where relevant). See each provider's policy in Section 9 for further detail on their own transfer practices.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We'll post the updated policy here with a new "Last updated" date and notify you of material changes by email or in-app notification before they take effect. Continued use of OS Pen after the effective date constitutes acceptance of a non-material update; for a materially expanded use of your data, we will seek fresh consent where required by law.

14. Contact & Grievance Redressal

India DPDP Act grievance: If your grievance is not resolved within 30 days, you may escalate it to the Data Protection Board of India.

© 2026 Snowfairy AI Labs. Snowfairy AI^™. All rights reserved.  ·  Terms of Service  ·  Refund Policy