Last updated: 9 October 2026
Snifff is a browser extension that rates cosmetic ingredients on supported Indian beauty-shopping product pages against EU and Indian cosmetic regulation. This policy explains what the extension reads and sends, what Snifff stores, and what happens if you join the optional mobile-app launch list on this website.
Where Snifff runs
The extension works on cosmetic product detail pages on Nykaa, Tira, Purplle and Sephora India. Its page script is limited to those retailer hosts and uses each retailer's adapter; it does not collect data from unrelated sites or general browsing. On supported pages, it reads product information only after you accept the in-extension privacy notice. You can withdraw that consent in Settings; scanning and product-data requests then stop.
Besides the product page you are viewing, the extension sends requests to the Snifff scoring service hosted on Supabase. When a concentration-specific image check is eligible, the Snifff server can send a product image to Google Cloud Vision as described below.
What leaves your browser
After you agree to the in-extension notice and a supported product detail page is scanned, a request to Snifff may include:
- The ingredient list and its parsed form, the page title, category breadcrumb and relevant product claims. If the page does not expose a usable text ingredient list, the extension may send an unavailable-list request. If you choose to use manual entry, the text you paste is sent for that scan; Snifff does not read your clipboard automatically.
- Public product details when the retailer page exposes them: brand and product name, retailer product identifier or SKU, retailer category, selected option, and other displayed product options or variants.
- The clean public product-page and variant URLs, including their path and any product slug. Query strings and fragments are removed. The extension does not send unrelated URLs or a general history of the pages you visit.
- Public price, currency, list price, availability, product-level rating and rating/review counts when available.
- Public image links, including a primary product image and eligible gallery image URLs when needed as evidence. The extension sends links, not image files. The Snifff server may fetch an allow-listed retailer image for a concentration-specific check.
- The retailer and adapter/evidence format details, plus the extension version, a source-build fingerprint shared by copies of that build, and the installation type. These package facts help diagnose extraction and release issues; they are not user or device identifiers.
The scoring service uses the ingredient and page evidence to return a rating. Relevant request data is also recorded in an anonymous, versioned product observation. The saved observation can include the clean product URL, product and variant details, ingredient text and parsed list, available price/rating/availability, image link, and the server's actual assessment, including score, coverage, matched and unmatched ingredients, concentration evidence, and product-level pregnancy/nursing guidance derived from the ingredients. This guidance is not a record about the shopper. Marketing claims can be sent for scoring context but are not included in the saved product observation. Discovered sibling variants are recorded as not scanned; Snifff does not copy ingredients, scores or pregnancy assessments from one variant to another.
The URLs and product details describe public retailer listings, but they can still reveal which product page you viewed. Snifff uses them only to provide and maintain product ratings and its product database. It does not use them for advertising or sell them.
What is not collected
The extension does not collect your name, email address, retailer account, authentication data, cookies, review text, review authors, or personal messages. It does not create or send a user, session, device, advertising, or extension-runtime identifier. Pregnancy guidance in a scan is about the product's ingredients, not a pregnancy status or health information about you.
The extension does not read your other tabs, bookmarks, or browsing outside supported retailer product pages. It does not set or read cookies. It does not send product-page query strings or fragments.
What is stored on your device
The extension stores display preferences and your consent choice in local extension storage: colour theme, whether the panel opens automatically, whether the in-page score card is shown, whether onboarding was completed, and whether you agreed to product-page data use. These settings are not synced to an account or transmitted to Snifff. Removing the extension deletes them.
What is stored on Snifff's servers
Product observations and scan telemetry. Each scan records anonymous information needed to produce and improve the product rating, including the retailer, time, extension and scoring-data versions, product context, ingredient coverage, assessment, and unmatched ingredient names. Product observations are private and keyed to a product rather than to a shopper. A separate salted hash identifies the product for counting how many distinct products are affected by an unmatched ingredient; the product observation can separately retain the clean public product URL. No user, session, device, or IP identifier is attached to these records.
Rate-limiting counters. Network requests necessarily reach the scoring service with a network address. To limit abuse, the service combines the request IP address with a secret salt and a short time window, then stores only the resulting hash as a counter. These counters expire within an hour. The raw IP address is not written to the database or application logs.
Image-text cache. Full ingredient-list OCR is disabled in the beta. For a concentration-sensitive ingredient, and only after an exact ingredient match when the page does not provide sufficient concentration evidence, the server may fetch an eligible product image and ask Google Cloud Vision to read the concentration. Currently only audited Nykaa product image URLs qualify for OCR; product image references from Tira, Purplle and Sephora India are not sent for OCR. Positive and negative reads are cached against the product, variant and image contents so an unchanged image does not need to be checked again. Image OCR is evidence for concentration only; it is not used to identify ingredients.
Website analytics. On snifff.app we use PostHog to count how the website is used. It receives an anonymous event when a page is viewed, when someone clicks a link to the Chrome Web Store listing, and when someone joins the launch list. An event carries the page address, the page you came from, any campaign tags in the link, and your browser and device type. It does not include the email address you enter. PostHog is configured without cookies or browser storage, without session recording and without automatic capture of clicks or typing, and it is not used when your browser sends a Do Not Track signal. To count visitors without storing anything, PostHog's servers combine your IP address and browser details with a secret value that changes every day, keep only the resulting one-way hash, and discard the IP address and the secret. Because the hash changes daily, Snifff can count a day's visits but cannot recognise a returning visitor or follow a person across days. PostHog is configured not to add location data.
Mobile launch list. If you submit the optional form on this website, we store the email address and signup date to send Snifff development and mobile-app launch updates. Extension users are never added automatically.
Who processes the data
- Supabase hosts the scoring function, database, product observations and scan telemetry.
- Google Cloud Vision receives an audited Nykaa product image only for the conditional concentration check described above. The Snifff server sends the image; this processing does not run in your browser.
- Cloudflare hosts the live website on snifff.app through Cloudflare Workers and stores launch-list email addresses and signup dates in Cloudflare D1. No Neon data was migrated, and the previous Neon database is no longer used by the live site. Cloudflare Web Analytics reports aggregated website-performance metrics through its automatically injected beacon; its current configuration excludes visitors in the EU.
- PostHog (EU Cloud, hosted in the European Union) receives the anonymous website analytics events described above. Its code is bundled with the site and served from Snifff's domain; events are sent to PostHog's EU endpoint at eu.i.posthog.com.
- The website's fonts, styles and images are served from Snifff's domain. Cloudflare Web Analytics uses a beacon hosted on Cloudflare's domain when Cloudflare serves the site. The site has no advertising networks or data brokers.
Selling and sharing
Snifff does not sell product-page data or use it for advertising. Data is shared with the service providers listed above only to operate the extension, its scoring and product observations, this website, and the optional launch list. We do not use extension data for creditworthiness or lending.
Our use of data handled through the Chrome extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
Children
Snifff is not directed at children. Do not submit an email address for someone under 13.
Your choices
You can decline the in-extension notice or withdraw consent later from Settings. When consent is withdrawn, Snifff stops reading product details and sending scans until you agree again. You can also disable or remove the extension; removing it deletes the local preferences and consent choice.
You can leave the mobile launch list at any time by emailing help@snifff.app and asking us to remove your address. Anonymous product observations are not linked to a shopper identity, so Snifff cannot identify a particular person's scans from those records.
Changes to this policy
If Snifff's data handling changes, this page will be updated and the date at the top will change. Material changes will also be disclosed in the extension before the new data collection begins.
Contact
Questions about this policy, the mobile launch list, or extension data: help@snifff.app. The same address sits behind the Send feedback link in the extension's settings panel.