Your snacks.
Your business.

What we save, and why

ShareSnacks saves your list name, optional date, time, location and note, suggested items, and contributions. A contribution can include an item, an optional display name, food tags and a food note. This lets your group see what’s covered and what’s still needed.

We also save the permission keys or their irreversible fingerprints, request identifiers, revisions and timestamps needed to protect editing, prevent duplicate saves and apply expiry. Your name is list content, not proof of identity. There are no accounts, email sign-ups, visitor profiles, ads, analytics scripts, tracking cookies, advertising pixels or outside font requests.

Anyone with the link can see it

Your sharing link opens the list and lets guests contribute. Your separate organizer link can change details, manage every contribution, retrieve the sharing link and delete the list. Keep it private. There is no account or email recovery for a lost link.

Private list pages use generic public HTML and social previews, stay out of the sitemap and ask search engines not to index them. Access to the actual list requires its permission key. Links can still be saved in browser history, copied or forwarded through the service you use to share them. Keep addresses, access codes, children’s information and personal medical details off the list.

Lists expire automatically

Dated lists expire at the end of the day 30 days after the event, using UTC. Undated lists expire exactly 90 days after creation. The form shows the expiry before saving; the undated estimate becomes exact once saved. Every saved list shows its expiry.

Expired links stop reading and changing the list immediately. Bounded hourly cleanup removes expired list details, suggestions and contribution records. Editing the event date recalculates expiry; clearing it returns to 90 days from the original creation, without restarting the clock.

The organizer can delete a list early. Its active records are removed and both links stop working. Irreversible fingerprints of expired or deleted sharing and organizer keys remain indefinitely so old links cannot be reused. These contain no list details; a deletion flag also lets an organizer safely check an interrupted deletion.

Removing a contribution clears its item, name, tags and note. Its editing fingerprint and request identifiers remain until the list expires, preventing an old retry from bringing it back. Removing a suggested spot keeps any contribution already made for it as an extra item.

What this browser remembers

Your browser saves an editing key and expiry for each contribution you make here. This lets you change or remove it in this browser. The server saves an irreversible fingerprint of the editing key. There is no shared visitor identifier.

You can optionally add a four-digit edit code after saving. Guests need that code to edit or remove the entry, including from another browser with the sharing link. The organizer can still manage every entry. Four digits provide light protection, not proof of identity. The server stores a fingerprint protected by a secret server key, not the code itself. Five unsuccessful attempts per entry in a 15-minute window temporarily block code access. Code fingerprints and counters are removed when the list expires or is deleted.

An interrupted creation temporarily keeps the draft and its private links in this tab’s storage. Interrupted contribution saves keep their details and editing key, but not their edit code; organizer changes keep their details and a fingerprint of the organizer link, rather than its secret. Pending drafts clear when resolved or when the browser discards the tab’s session storage. You may need to re-enter a code to check an interrupted save.

Expired keys and drafts are pruned when you next use a list. Deleting a list here, or seeing that it has become unavailable, clears its reachable editing keys and drafts. Other devices and closed tabs cannot be remotely cleared; the server still refuses expired or deleted access.

If storage is blocked or cleared, editing access without a code may be lost after this visit. The organizer can help using their private link.

Hosting, security and backups

ShareSnacks uses Cloudflare for hosting and its database. Hosting and security services process connection information, such as IP addresses, to deliver pages and protect the service. We do not promise that no technical data is processed or that all data stays in Canada.

The app does not log list content, names, permission keys or request bodies. Its activity limits use list or aggregate counters rather than a stored visitor identity. Worker request logging and log exports are disabled. Cloudflare still processes technical traffic information to provide and secure its service.

Deleting active records does not instantly erase historical backups. Our Cloudflare plan provides 30 days of database recovery history. The owner may also keep private exports for recovery; these must be handled as confidential data and removed when no longer needed. See Cloudflare’s recovery documentation.

Before restoring a backup, we pause changes and preserve the current deletion, expiry and contribution-removal records separately. We apply them to a separate restored database before it can serve visitors. We have rehearsed this procedure. If those current records cannot be recovered, we keep the older lists unavailable rather than risk bringing deleted information back.

Questions or corrections

For privacy questions, contact romi@sharesnacks.ca or write to Romi. Leave out private list links and sensitive information.

The contact form sends your message and optional reply address through Cloudflare to Romi’s inbox, where they are kept to handle your enquiry. The snack-list database does not save message text or reply addresses. It keeps a request identifier, a secret-key-protected fingerprint, delivery status and timestamp for retry protection. These receipts and aggregate sending counters are cleared after 24 hours by hourly cleanup. Contact drafts are not saved in browser storage. Cloudflare and the inbox provider process the email.

Use your organizer link to correct or delete a list yourself. A display name or email does not establish ownership.

Anonymous list count

We keep a cumulative count of successful list creations, including a starting count of existing lists. This aggregate contains no list identifiers, details, permission keys or visitor information. It remains after lists expire or are deleted. Only the count and its starting date are shared with the owner's private dashboard; there is no public statistics endpoint or added tracking script.