Privacy Policy

1. Who we are

SnitchOS is an employee-monitoring product operated by OS Labs Inc, 705 Lakeview Plaza Blvd, Columbus, OH 43085, United States (“SnitchOS”, “we”, “us”). It licenses the platform to managed service providers, who deploy the agent to company-owned Windows endpoints and view it through the dashboard.

This policy explains how personal data flows through SnitchOS, each party’s role, and how people exercise their rights. Questions: the SnitchOS contact form.

1.1 Key terms

• Customer: the managed service provider that licenses SnitchOS.
• Client Tenant: a downstream client of the Customer, its workforce monitored in an isolated SnitchOS tenant.
• Monitored User: an employee or worker whose company-owned, managed device the agent monitors.
• Administrator: a person the Customer authorizes to sign in to the dashboard to view or manage data.
• Endpoint data: monitoring data the agent collects from a managed device (Section 3).

2. Controller and processor roles

2.1 Endpoint data (SnitchOS as processor)

For endpoint data from Monitored Users, the Customer and/or its Client Tenant is the data controller. It decides which devices are monitored, configures categorization and retention within the available settings, and is responsible for the lawfulness of the monitoring. SnitchOS acts as a data processor on the Customer’s documented instructions, only to provide and support the service, per the Data Processing Addendum (DPA & sub-processors) and Article 28 GDPR where applicable.

2.2 Account and billing data (SnitchOS as controller)

For Administrator identities, account and support records, and billing information, SnitchOS acts as an independent controller, using them to operate the Customer relationship, secure the platform, and bill for service.

3. What data is collected

The agent samples workplace-activity signals from managed devices; the platform also records the data needed to run multi-tenant accounts.

The public marketing site (snitchos.com) uses two measurement tools. Our own first-party counters receive each visit’s page path, external referrer (if any), and stored campaign (UTM) source, and keep only aggregated daily totals per page, referrer domain, and source — no per-visitor records and no IP addresses. Separately, the site loads Google Analytics 4, which sets its own cookies and is operated by Google as a processor on our behalf, and sends a page-view beacon to an analytics endpoint operated by Shield Investments, our affiliate, carrying the page path, referrer, campaign source and browser user-agent. Signing up stores your visit’s referrer and campaign with the signup, for attribution. We use no third-party advertising cookies and do not sell or share personal information for advertising. The signed-in application (app.snitchos.com) and the demo carry neither of these — no analytics and no third-party scripts run there.

3.1 Endpoint data collected by the agent

• Active window: process name and window title.
• Idle and active state, and duration.
• Application usage: which applications ran and for how long.
• Website activity: scheme, host, and path only; query strings and fragments are stripped at the endpoint and on ingest.
• Input counts only: keystroke count, mouse-click count, mouse-distance totals. What is typed is never recorded.
• Screenshots: one deduplicated frame per minute by default, skipped while idle. The interval is a configurable default, not a fixed value.
• Device and OS metadata: hostname, OS version, agent version, owning session or user.
• Administrator identity: name, email, and the immutable ID Microsoft Entra ID or Google returns at sign-in (the Google account ID, if the Administrator signs in with Google).
• Microsoft 365 usage, if the Customer connects its Microsoft 365 tenant: Entra sign-in activity, Teams, and Outlook signals via the Microsoft Graph API.

3.2 What is explicitly not collected

SnitchOS does not intentionally extract the following, though it may appear in a screenshot, window title, or URL path:

• Keystroke content: the keys or text typed.
• Clipboard contents.
• File contents.
• Message, email, or chat bodies.
• Audio or microphone input.
• Webcam or camera images.
• Saved passwords or credentials.
• URL query strings and fragments: these normally carry SSO tokens, magic-link credentials, and OAuth state. Paths, window titles, and screenshots can contain sensitive text.

4. Why we process this data

Endpoint data is processed for the Customer’s purposes, including:

• Showing real-time and historical activity, idle time, and application and website usage.
• Classifying activity as Productive, Neutral, or Distraction and producing management reports.
• Raising per-tenant alerts and recording admin actions in an audit trail.
• Providing evidence for the Customer’s compliance, workforce-management, and security needs.

Account and billing data is processed to authenticate Administrators, operate and secure the platform, provide support, and invoice for service.

5. Legal bases

Where the GDPR or comparable law applies, processing relies on the following bases.

5.1 Where the Customer is controller

For endpoint data, the Customer (and/or its Client Tenant) determines and documents the legal basis for monitoring its workforce: commonly legitimate interests in managing or securing the business, performance of the employment relationship, a legal obligation, or, where local law requires, informed consent of Monitored Users. The Customer is responsible for identifying and meeting the correct basis in each jurisdiction.

5.2 Where SnitchOS is controller

For account, support, and billing data, SnitchOS relies on its Customer contract, legitimate interests in operating and securing the service, and legal obligations such as tax and accounting requirements.

6. How data is shared

SnitchOS does not sell personal data or share it for cross-context behavioral advertising, and endpoint data stays within the Customer’s isolated tenants, accessible only to authorized Administrators. We disclose personal data only to the sub-processors below, the controlling Customer, or as law requires or to protect the service.

6.1 Sub-processors

We engage a few vendors, each bound by contractual data-protection terms; the current list is on the DPA & sub-processors page, summarized below.

7. International transfers

The platform runs on a single dedicated server SnitchOS operates and controls. Personal data crossing borders, to a sub-processor or where the Customer or its Monitored Users sit outside the hosting region, moves under an appropriate safeguard: the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum where relevant, and any supplementary measures law requires. Hosting details: on request.

8. Retention

We keep personal data only as long as needed, per this schedule.

Screenshots follow the 30-day hot / 365-day cold schedule during active service. Offboarding a Client Tenant purges its endpoint data, including screenshots; residual backups expire within 14 days. On termination, data is disposed of per the DPA.

9. Security measures

SnitchOS protects personal data with technical and organizational controls, including:

• TLS 1.2 or later for data in transit between the agent, dashboard, and API.
• Tenant isolation enforced at the database row, object-store key, and API scope layers, refusing cross-tenant access.
• A code-signed agent and MSI, with publisher, manifest, and package-hash verification before updates apply.
• Microsoft Entra or Google single sign-on for Administrators, with no local passwords.
• An append-only audit log recording actor, IP, target, and outcome for every authenticated change.

Off-site backups are encrypted in transit but not at rest; access to the backup target is restricted to authorized operators. No system guarantees absolute security; the Customer remains responsible for its Administrator accounts and devices.

10. Your rights

Depending on where they live, Monitored Users and others may have rights to access, correct, delete, or restrict personal data, object to or limit processing, or port data; under US state laws such as the California Consumer Privacy Act as amended by the CPRA, also to know what is collected, request deletion or correction, and opt out of any “sale” or “sharing” (SnitchOS does neither), without discrimination.

10.1 How to exercise a right

If a Monitored User, direct your request to your employer or the organization managing your device; they decide how your data is handled. If you are unsure who to contact, or a Customer needs help, submit the SnitchOS contact form; we will route or support the request and assist the responsible controller. We may verify identity and respond within the timeframes applicable law requires.

11. Customer responsibility for employee notice

The Customer, and its Client Tenant where relevant, must give Monitored Users lawful notice and obtain any required consent. Several US states, including New York, Connecticut, and Delaware, require advance written notice of electronic monitoring; other jurisdictions impose their own rules. SnitchOS is meant only for company-owned, MSP-managed devices with notice, not personal devices or undetectable use.

12. Children’s data

SnitchOS is a workplace product for company-owned devices used by adult workers, not directed to children or meant to collect data from anyone under the age of majority, and we do not knowingly process children’s personal data.

13. Changes to this policy

We may update this policy for changes in the service, our sub-processors, or the law, updating the effective date above for material changes and, where appropriate, notifying the Customer; continued use after an update means the revised policy applies.

14. Contact us

For privacy questions, legal notices, or general product support, use the SnitchOS contact form. Postal notices go to OS Labs Inc, 705 Lakeview Plaza Blvd, Columbus, OH 43085, United States.