Last updated: 14 August 2026
1. Controller
The controller responsible for data processing within the meaning of the EU General Data Protection Regulation (Datenschutz-Grundverordnung, DSGVO) is:
No data protection officer has been appointed, as the legal requirements for a mandatory appointment are not met.
2. What Data We Process
When you use SnapSpace on your Meta Quest headset and in this web viewer, the following data is processed:
- Raw Sensor Data: Spatial and camera frame data captured by your headset's sensors to map your physical environment. Camera frames may show your surroundings and, if present, other people.
- Point Cloud & Mesh Data: 3D spatial representations (scans) of the specific spaces you choose to capture within the app, including derived data such as camera poses and reconstructed meshes.
- Account Data: If you create an account: your email address, a display name you choose, a securely hashed password, your account role and the creation timestamp.
- Sharing Data: Which captures belong to or have been shared with your account, and share links you create.
- Server Log Data: Each request to this website is logged by our hosting providers for operational and security purposes. This includes your IP address, date and time, the requested URL, HTTP status, referrer and browser/user agent string.
We kindly ask that you do not scan highly private or sensitive spaces, and that you do not scan other people without their knowledge and agreement. Try to only share spaces you feel comfortable sharing.
3. Purposes and Legal Bases
- Providing the app and web viewer (capturing, processing, storing and displaying your scans; account management; login; sharing) — Art. 6(1)(b) DSGVO (performance of a contract / pre-contractual measures).
- Transactional emails such as account confirmation and password reset — Art. 6(1)(b) DSGVO.
- Server logs, IT security, abuse and error detection, stability — Art. 6(1)(f) DSGVO (legitimate interest in operating a secure and functional service).
- Public display of scans during the test phase — Art. 6(1)(a) DSGVO (consent), which you give by choosing to upload a scan while this notice is in effect. You can withdraw this at any time by requesting deletion (see section 8); withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Providing account and scan data is not legally required, but without it the app cannot be used. We do not carry out automated decision-making or profiling within the meaning of Art. 22 DSGVO.
4. Public Visibility During the Test Phase
All point clouds generated via the headset are automatically synced to this companion web viewer. During the test phase, these scans as well as the associated sensor data may be visible to anyone visiting this site. Please treat everything you upload as potentially public.
5. Cookies and Local Storage
This website does not use advertising cookies, analytics, or any third-party tracking technologies. We do not embed social media plugins, fonts loaded from external servers, or advertising networks.
We only use storage that is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG / ePrivacy exemption), which is why no cookie consent banner is shown:
- Authentication cookies (set by Supabase,
names beginning with
sb-): keep you logged in and protect your session. They are only set once you log in and are removed when you log out. - Session storage (
ss_pending_confirm_email): temporarily remembers the email address you just registered with, so the confirmation page can show it. It is stored in your browser only and cleared when you close the tab.
6. Hosting, Processors and Third-Party Services
We do not sell your data and we do not share it with third parties for their own purposes. We do, however, rely on the following service providers, who process data on our behalf under data processing agreements pursuant to Art. 28 DSGVO:
- Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA) — hosting and delivery of this website and its serverless functions. For security and operational purposes, technical data such as IP addresses, request metadata and browser information is processed by Vercel. Vercel is based in the USA; transfers are safeguarded by EU Standard Contractual Clauses and Vercel's certification under the EU–U.S. Data Privacy Framework. See the Vercel Privacy Policy.
- Cloudflare, Inc. (101 Townsend St., San Francisco,
CA 94107, USA) — authoritative DNS for the domain
snapspace.cloud. When your device looks up our domain, Cloudflare processes the DNS query and the IP address of the resolver making it. Our DNS records are not proxied through Cloudflare, so Cloudflare does not receive, terminate or inspect the content of your requests to this website. Transfers to the USA are safeguarded by EU Standard Contractual Clauses. See the Cloudflare Privacy Policy. - Supabase Inc. (970 Toa Payoh North, Singapore / Supabase Pte. Ltd.) — authentication, account database and transactional emails. Our Supabase project is hosted in the EU (Frankfurt/Ireland region). See the Supabase Privacy Policy.
- STRATO GmbH (Otto-Ostrowski-Straße 7, 10249
Berlin, Germany) — the server that receives, processes and
stores your scans and raw sensor data (
api.snapspace.cloud). Data is stored on servers located in Germany. See the STRATO Privacy Policy.
This website is built with Astro, an open-source framework. Astro runs on our own infrastructure and does not itself collect or transmit any data about you.
Please note that the SnapSpace headset app runs on Meta Quest hardware. Your use of the headset and the Meta platform is additionally subject to the Meta Privacy Policy, over which we have no control.
7. Retention Periods
- Scans, raw sensor data and derived data: stored until you request their deletion or your account is deleted.
- Account data: stored for as long as your account exists; deleted after an account deletion request.
- Server log data: retained only as long as necessary for security and troubleshooting, and deleted or anonymised thereafter in accordance with our providers' retention policies.
Longer retention only occurs where we are legally required to keep specific data.
8. Your Rights
Under the DSGVO you have the right to:
- request access to the personal data we hold about you (Art. 15);
- request rectification of inaccurate data (Art. 16);
- request erasure of your data (Art. 17);
- request restriction of processing (Art. 18);
- receive your data in a portable format (data portability, Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw consent at any time with effect for the future (Art. 7(3)).
We provide this process for all users, irrespective of their region, and we do not charge any fees for fulfilling data deletion requests. If you request the deletion of your data, we will promptly remove your specific point cloud scans from the web viewer and securely delete the associated raw sensor data from our servers. We will fulfil all deletion requests unless we are strictly required by law to retain specific data.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 DSGVO).
9. Data Security
All traffic to this website and to our API is encrypted via HTTPS/TLS. Passwords are never stored in plain text. Access to scans and account data is protected by row-level security rules and short-lived signed URLs, and credentials for our backend API are only ever used server-side and never exposed to your browser.
10. Children
SnapSpace is not directed at children under the age of 16. If you become aware that a child has provided us with personal data, please contact us and we will delete it.
11. Changes to This Policy
As SnapSpace is under active development, we may update this privacy policy to reflect changes to the service or to legal requirements. The current version always applies, and the date at the top of this page indicates when it was last revised.
12. Contact
If you have any questions, privacy concerns, or wish to formally request access to or deletion of your data, please contact me directly via: .