Privacy in the Snusdex app
This privacy policy explains how the Snusdex app and its associated backend services process personal data.
Version 1.0 · Last updated: 8 August 2026
1. Controller and contact
The controller under the General Data Protection Regulation (GDPR) is SDX Solutions UG (haftungsbeschränkt), Hauptstraße 12 1/2, 84416 Taufkirchen (Vils), Germany, represented by managing director Norman Tarayan.
Privacy requests may be sent to contact@sdxsolutions.de with the subject “Snusdex privacy request”.
2. Scope and overview
This policy applies to the native Snusdex iOS app, its APIs, databases, cloud functions and storage, and the related support, moderation, consent and account-deletion processes.
Snusdex is an information, collection, rating, statistics and community service for tobacco-free nicotine pouches. Nicotine products cannot be purchased or ordered through the app, which is intended only for adults.
We do not integrate advertising SDKs or perform cross-company advertising tracking in the app. Direct identifiers such as email address, username, account ID, authentication or push tokens, and MouTrack positions are not used for reports involving external business partners or disclosed to them.
3. Data we process
Account and authentication
- internal user ID, email address, verification status and sign-in provider
- encrypted or hashed authentication data
- session, access and refresh tokens and registration or sign-in timestamps
- for Sign in with Apple, a name and Apple relay email address where provided
Age, profile and appearance
- date of birth and the derived adult-status result
- username, optional profile image, profile and creator details
- XP, levels, streaks, badges, Collector Card appearance and creator-code redemptions
- language, theme, haptics, tracking mode and other app preferences
Collection, ratings and usage
- scanned or selected products, barcodes, collection timestamps and favourites
- taste, smell, bite, drip, visual and strength ratings and optional text
- opened and completed cans, pouches taken, timestamps and product nicotine values
- derived daily, weekly and monthly statistics, streaks, badges and trends
- product suggestions and related information
Social and community data
- follow requests and connections, blocks and visible profile details
- collection entries shared with confirmed connections
- community averages, rankings and creator content
MouTrack
If MouTrack is expressly enabled, we store the selected mouth position, date, usage count, corrections and the suggested next position. MouTrack data is strictly excluded from market, trend and B2B analysis and is not disclosed to manufacturers, retailers or data partners.
Push notifications
- APNs device token, installation ID, bundle ID and technical environment
- app language and selected notification preferences
- technical delivery data for social and low-stock notifications
Local and technical data
Sign-in sessions are stored in the iOS Keychain. Preferences, favourites and consent status may be stored in UserDefaults. Protected app caches contain catalogue, profile, collection, usage and social data and are treated as stale after 7 to 30 days depending on the content. Profile images may be stored temporarily before upload.
App, API, image and authentication requests necessarily expose data such as IP address, time, requested endpoint or content, device and app version, status code and error information to the relevant provider.
Approximate rating region
For regional rating statistics, the IP address visible during a request may be sent to ip-api.com to derive an approximate country, region, city and time zone that is stored with the rating entry. Precise GPS location is not requested.
4. Purposes and legal bases
Account and core features
Required account, profile, collection, rating, usage and social data is processed to provide the account and actively selected app features, synchronise content across devices, and enable support and account deletion. The legal basis is Article 6(1)(b) GDPR.
Age restriction
Date of birth and adult status are processed to restrict access to adults. Depending on the requirement, the legal bases are Article 6(1)(b), (c) and (f) GDPR.
Security and abuse prevention
Technical logs and security signals protect accounts and systems, support error diagnosis, and prevent spam, manipulation and abuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable app operation.
Optional features and consent
The analysis of eligible app data to create and use aggregate, anonymised product, market and trend insights is enabled as one voluntary purpose. These insights may be used internally for Snusdex and with selected external business partners. The legal basis is Article 6(1)(a) GDPR and, where consumption data may reveal health-related information, as a precaution Article 9(2)(a) GDPR. Consent can be withdrawn in the app at any time with future effect.
MouTrack and push notifications are activated separately because each provides an independent feature, and they can be disabled independently of analysis.
Essential local storage and device access also rely on section 25(2) TDDDG; non-essential access takes place only after consent under section 25(1) TDDDG.
5. Optional analysis and use of aggregate insights
If the user voluntarily consents, eligible rating, scan, collection and consumption-pattern data may be combined within Snusdex to create aggregate product, market and trend insights. This analysis purpose covers internal use for product improvement and recommendations as well as the use of anonymised insights with selected external business partners described below. MouTrack is always excluded.
Data from many adult users may be combined for this purpose and anonymised after a re-identification risk assessment. SDX Solutions may provide the resulting aggregate dashboards, reports and trends to manufacturers, brands, retailers or market-research organisations for their market and product analysis. This may take place as part of a paid business relationship.
These outputs must not contain email addresses, usernames, account IDs, exact dates of birth, raw IP addresses, authentication or push tokens, raw free text, block data or MouTrack positions. Small groups and rare attribute combinations must be suppressed or generalised.
After consent is withdrawn, personal source data is no longer used for new optional analysis or reports. Group values that have already been effectively and irreversibly anonymised can no longer be linked to an individual and therefore cannot be deleted individually.
6. Device permissions and local storage
The camera is used only with iOS permission to recognise barcodes. Camera images are not uploaded to Snusdex as photographs. The photo picker opens only when a profile image is selected. Push notifications are sent only after separate iOS permission.
Favourites, appearance and haptic preferences, and certain technical state remain local to the device. Performance diagnostics are provided by iOS MetricKit and are currently logged locally by Snusdex; no separate external analytics SDK is integrated.
7. Service providers and recipients
Supabase
Supabase provides authentication, database, file storage and cloud functions. The Snusdex project is currently hosted in the EU West region in Ireland. Depending on the feature, Supabase processes account, profile, collection, rating, usage, social, consent, push and MouTrack data as a technical service provider.
Apple and Google
Apple processes data when Sign in with Apple, Apple Push Notification Service or App Store services are used. Google processes authentication data only when Google sign-in is actively selected. The providers’ own privacy terms also apply.
GitHub, ip-api.com and external providers
Product and badge images may be loaded through GitHub or raw.githubusercontent.com. ip-api.com may process the IP address to derive an approximate region for regional rating analysis. If an external shop or social-media service is actively opened, that provider processes the technically necessary request data under its own responsibility.
8. International transfers
Some providers or subprocessors may process data outside the European Economic Area, particularly in the United States. Such transfers take place only under Articles 44 et seq. GDPR, for example based on an adequacy decision, the EU-US Data Privacy Framework, or EU Standard Contractual Clauses with any necessary additional safeguards.
9. Retention and deletion
Account and app data
Account, profile, collection, rating, usage, social and MouTrack data is generally stored for the life of the account or until the relevant content is deleted or optional processing consent is withdrawn.
Push, sessions and local caches
Push tokens are removed when notifications are disabled, on sign-out, when technically invalid or when the account is deleted. Session data remains valid until expiry, renewal, sign-out or account deletion. Local app caches are treated as stale after 7 to 30 days depending on the data area and are removed on sign-out or account deletion.
Logs, records and backups
Technical logs, security records, support cases and consent records are retained only as long as required for operations, accountability, abuse prevention or legal claims. Deleted data may remain in protected backups until routine overwrite and is not used there for new purposes. Irreversibly anonymised aggregate statistics may be retained for longer.
10. Account deletion, export and withdrawal
The account can be deleted directly in the app under Settings → Data & consent → Delete account and data. This removes the authentication account, profile, profile images, collection and rating data, usage logs, social connections, creator data, MouTrack data, push tokens and consent records from active systems unless a legal obligation requires limited further retention.
Consent for optional analysis and use of aggregate insights can be withdrawn under Settings → Data & consent. MouTrack and push notifications can be disabled independently there or in iOS Settings. Withdrawal applies for the future and does not affect access to the core app; only the relevant optional feature or data use ends.
For access, portability or deletion assistance, email contact@sdxsolutions.de. Identity verification may be required to protect the account.
11. Data security
We use appropriate technical and organisational safeguards, including encrypted transport between the app and our primary services, protected session storage in the iOS Keychain, file protection for local user caches, role- and row-based access controls, separate server secrets and limited permissions. No technical system can guarantee absolute security.
12. Your rights
Subject to the legal requirements, rights include access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20), objection (Article 21), and withdrawal of consent with future effect.
You may also lodge a complaint with a data-protection authority. Our competent authority is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.
13. Minors and changes
Snusdex is intended only for people aged 18 or over. If we learn that an account belongs to a minor, we may block access and delete the data after review. Parents or guardians may contact contact@sdxsolutions.de.
We update this policy when features, processing, providers or legal requirements change. Material changes will be communicated in the app. New optional purposes or recipients will not be authorised merely by changing this text; where required, we will request fresh consent.
This app privacy policy supplements the general privacy policy for the SDX Solutions website. This app-specific version applies to the Snusdex app.