Privacy Policy
Last updated: October 14, 2026
This Privacy Policy explains how Apex Software LLC ("we", "us" or "our") collects, uses, shares and protects personal information in connection with Squiggaloo, including the website at www.squiggaloo.com, the dashboard and the embeddable feedback widget (together, the "Service"). It also explains the choices and rights you have.
1. Two kinds of users
Customers. If you sign up for Squiggaloo or are invited to a team, we are responsible ("controller") for your account information.
Website visitors. If you send feedback through the Squiggaloo widget on someone else's website, that website's owner (our customer) decides what to collect and how to use it, and we process your submission on their behalf ("processor"). Their privacy notice applies to that feedback, and requests about it should go to them first. If you contact us, we will forward your request to the website owner and help them respond.
2. Information we collect
Account and team information
- Your name, email address and password. Passwords are stored only as a salted one-way hash; we cannot read them.
- Organizations you create or join, your role, team invitations (including the invitee's email address) and your email notification settings.
- Site settings you enter, such as site names, allowed domains, widget colors and webhook URLs.
- What you do in the dashboard: comments, status and priority changes, assignments and deletions.
- Messages you send us, for example support emails.
Feedback submitted through the widget
- The comment, and the name and email address if the visitor chooses to give them.
- A screenshot of the area of the page the visitor annotated, with their drawings and text. The screenshot shows whatever was visible on the page at the time. Visitors can black out parts of it with the redact tool before sending.
- The page address and title, the referring page, and the position of the feedback on the page.
- Browser and device details: user agent, window and screen size, pixel density and language.
- Up to 30 recent error and warning messages from the page's browser console, to help diagnose problems.
Information collected automatically
- IP address, browser, requested URL and time of each request. We use IP addresses to rate-limit sign-ins, sign-ups and widget submissions and to protect the Service from abuse. We do not store IP addresses with your account or with feedback.
- Login times and the dates accounts, organizations and feedback were created or changed.
We do not use advertising, analytics or tracking cookies, we do not track you across other websites, and we do not buy personal information from third parties.
3. How we use information
- To provide the Service: create and secure accounts, deliver feedback to the right team, show screenshots and comments, and run features such as live updates, pins and webhooks.
- To send service emails: account activation, welcome and password reset emails, team invitations, and notifications about new or assigned feedback. You can turn off new-feedback notifications in your account settings.
- To keep the Service safe: preventing fraud, spam and abuse, enforcing our Terms, and investigating security incidents.
- To support you: answering questions and troubleshooting problems you report.
- To run and improve the Service, using aggregated usage figures such as the number of accounts, sites and feedback submitted.
- To comply with the law and respond to lawful requests.
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use feedback or screenshots to train machine learning models.
If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases: performing our contract with you (to provide the Service); our legitimate interests in operating, securing and improving the Service, which we balance against your rights; your consent, where we ask for it; and compliance with legal obligations.
4. How we share information
- With your team. Members of an organization can see its feedback, screenshots and comments, and the names and email addresses of other members.
- With service providers. Cloudflare, Inc. hosts the Service and stores our database and screenshots, delivers our emails and keeps short-term request logs. When you use the dashboard, your browser loads fonts from Google Fonts, which receives your IP address and browser details; the widget on customer websites does not load anything from Google. Providers may only use personal information to provide services to us.
- Where customers direct us. If a customer sets up a webhook, details of new feedback (including the comment, page URL and reporter email) are sent to the address they choose.
- Our staff. A small number of authorized Apex Software LLC personnel can access accounts, including by viewing the Service as a particular user, to provide support, investigate abuse or maintain the Service. These actions are logged.
- For legal reasons. When we believe in good faith that disclosure is required by law, subpoena or court order, or is necessary to protect the rights, property or safety of Apex Software LLC, our users or the public.
- Business transfers. If Apex Software LLC is involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.
5. International transfers
Apex Software LLC is based in the United States, and Cloudflare operates a global network, so personal information may be processed in the United States and other countries whose data protection laws differ from yours. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses for these transfers.
6. How long we keep information
- Account information is kept while your account exists and deleted when the account is closed.
- Feedback, screenshots and comments are kept until the organization deletes them. Deleting a feedback item, a site or an organization permanently deletes the related screenshots from storage.
- Login sessions expire after 30 days. Invitations expire after 7 days, activation links after 3 days and password reset links after 1 hour; expired items are removed daily.
- Request logs are kept for a short period, normally no more than 30 days.
- Deleted data can remain in database backups for up to 30 days before it is overwritten.
We may keep information longer where the law requires it or to resolve disputes and enforce our agreements.
7. Security
All connections to the Service use HTTPS. Passwords are hashed with PBKDF2 and a unique salt, session tokens are stored only as hashes and kept in HTTP-only cookies, access is limited by organization and role, and screenshots are only served to signed-in members of the organization that owns them. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and the authorities of a data breach where the law requires.
8. Cookies and local storage
We use only the following, all of which are needed for the Service to work:
| Name | Where | Purpose | Lasts |
|---|---|---|---|
sq_sid | Dashboard | Keeps you signed in | 30 days |
sq_org | Dashboard | Remembers the organization you last viewed | 1 year |
sq_flash | Dashboard | Shows a one-time message after an action | 1 minute |
squiggaloo:who | Widget (browser local storage) | Pre-fills the name and email a visitor entered last time, on that device only | Until cleared by the visitor |
The widget sets no cookies. Because we do not track users across sites or sell personal information, there is nothing to opt out of for "Do Not Track" or Global Privacy Control signals; we treat both as a request not to sell or share.
9. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal information we hold about you and get a copy in a portable format;
- correct inaccurate information (you can edit your name and password on your account page);
- delete your personal information;
- object to or restrict certain processing, and withdraw consent where we rely on it;
- not be discriminated against for exercising these rights.
To make a request, email support@squiggaloo.com from the address on your account. We will verify your identity before acting and respond within 30 days, or sooner if the law requires. You may use an authorized agent if you give them written permission, and we may ask you to confirm your identity directly. If we deny your request, you may appeal by replying to our decision; we will respond to appeals within 45 days. You also have the right to complain to your local data protection authority.
Organization owners can delete an organization and all its data at any time from its settings. Website visitors who submitted feedback should contact the owner of the website where they sent it.
California residents: in the past 12 months we collected the categories of information described in section 2 (identifiers, internet or other electronic network activity, and the content of feedback, which may include visual information) for the purposes in section 3, and disclosed them to the service providers in section 4. We do not sell or share personal information and do not use sensitive personal information to infer characteristics about you.
10. Children
The Service is meant for businesses and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.
11. Changes to this Policy
We may update this Policy from time to time. If we make material changes, we will notify account holders by email or in the Service before they take effect. The "Last updated" date above shows when it last changed.
12. Contact us
Apex Software LLC
Email: support@squiggaloo.com