Privacy Policy
Last updated: July 22, 2026
4Whys LLC, doing business as PermitSnag ("we," "our," or "us"), operates the PermitSnag website (permitsnag.com) and mobile application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information, and the rights you have over it. For visitors in the European Economic Area (EEA), the United Kingdom, and California, see the dedicated sections below.
Data Controller
The data controller responsible for your personal data is 4Whys LLC (doing business as PermitSnag), United States. For any privacy question or to exercise your rights, contact us at privacy@permitsnag.com.
Information We Collect
Account Information
When you create an account, we collect:
- Email address
- Authentication provider information (Apple ID, Google account, or email magic link)
- Account creation date
Trip and Permit Data
When you use our permit tracking features, we collect:
- Permit preferences (parks, dates, party size, zones)
- Alternate permit selections
- Tracking preferences and notification settings
- Outcome reports (whether you secured a permit)
- Calendar sync preferences
Device and Technical Data
We automatically collect:
- Device type and operating system
- Push notification tokens (for sending alerts)
- App version and usage statistics
- IP address and approximate location (country/region level)
- Browser type (for website visitors)
Payment Information
Payment processing is handled by Stripe. We do not store your credit card numbers or bank account information. We receive only:
- Subscription status and expiration date
- Transaction identifiers
- Purchase history (subscription or a la carte permits)
How We Use Your Information and Our Legal Bases
Where the EU or UK GDPR applies, we process personal data only where we have a legal basis to do so. The table below sets out each purpose and its basis.
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Provide the core service (monitor availability, send alerts, manage your account and trips) | Performance of a contract (Art. 6(1)(b)) |
| Process payments and keep required financial records | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| SMS and push alerts you request | Consent (Art. 6(1)(a)) and contract (Art. 6(1)(b)) |
| Analytics and product experiments (A/B testing) | Consent (Art. 6(1)(a)) |
| Recommend alternates, estimate success odds, and improve alert timing | Legitimate interests (Art. 6(1)(f)) in improving the service |
| Security, fraud prevention, and service integrity | Legitimate interests (Art. 6(1)(f)) |
| Comply with legal obligations and enforce our Terms | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
Where we rely on consent, you can withdraw it at any time (see Your Rights). Where we rely on legitimate interests, you can object (see Your Rights), and we will stop unless we have compelling grounds to continue.
Automated Processing and Profiling
We use limited automated analysis to recommend similar permits, estimate the odds of securing a permit, and learn the best time to send you alerts. These do not produce legal or similarly significant effects on you, and no decision about you is made solely by automated means without human involvement. You can object to this processing at any time.
Cookies and Tracking
We use strictly necessary cookies to run the site (sign-in, security, and remembering your cookie choice) and, with your permission, analytics cookies to understand usage and run product experiments. In the EEA and UK, non-essential cookies are set only after you consent, and you can change or withdraw your choice at any time using the "Cookie preferences" link in the footer. Full details are in our Cookie Policy.
Information Sharing
With Other Users (Permit Sharing)
When you share a trip with other users or participate in group applications, those users can see:
- The permit and dates you're tracking
- Current availability status
- Your name or email (as trip owner or member)
You control who you share with. Observers can view status but cannot modify your trip.
With Service Providers (Processors)
We share data with trusted providers that process it on our behalf under contract. We do not authorize them to use your data for their own purposes.
| Provider | Purpose | Location |
|---|---|---|
| Stripe | Payment processing | US |
| PostHog | Product analytics and experiments | US |
| Telnyx | SMS delivery | US |
| Resend | Email delivery | US |
| Vercel | Website hosting | US |
| Railway | Application and database hosting | US |
| Apple (APNs) | Push notifications | US |
| Apple, Google | Sign-in (OAuth) when you choose them | US |
We Do Not Sell Your Data
We do not sell, rent, or trade your personal information to third parties for marketing purposes. Period.
International Data Transfers
PermitSnag is operated from the United States, and your information is processed there. When we transfer personal data from the EEA or the UK to the US, we rely on appropriate safeguards, primarily the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), and, where a provider is certified, the EU-US Data Privacy Framework. You can request a copy of the safeguards we use by emailing privacy@permitsnag.com.
SMS Messaging
When you provide your phone number and opt in to SMS alerts, you consent to receive text messages from PermitSnag regarding:
- Permit availability alerts when openings are detected
- Lottery application reminders and deadline notifications
- Trip and calendar notifications
- Account security messages (verification codes)
Message frequency varies (typically 0 to 10 per week). Message and data rates may apply. Reply STOP to unsubscribe from all SMS alerts, or HELP for assistance. You can also disable SMS in your account settings. We do not sell or share your phone number with third parties for marketing.
Data Retention
We retain your data as follows:
- Account data: Until you delete your account
- Trip data: Until 90 days after the trip end date, then automatically deleted
- Historical outcome data: Anonymized and aggregated for service improvement
- Payment records: As required by law (typically 7 years)
- Consent records: Kept as proof of your choices for as long as required to demonstrate compliance
Your Rights (EEA and UK)
If you are in the EEA or the UK, you have the following rights over your personal data:
- Access: Request a copy of the personal data we hold about you
- Rectification: Correct inaccurate or incomplete data
- Erasure: Ask us to delete your data ("right to be forgotten")
- Restriction: Ask us to limit how we use your data
- Portability: Receive your data in a portable, machine-readable format
- Object: Object to processing based on legitimate interests, including profiling
- Withdraw consent: Withdraw consent at any time, without affecting processing already carried out
- Complain: Lodge a complaint with your local supervisory authority
To exercise any of these rights, contact privacy@permitsnag.com or use the "Delete Account" option in settings. We respond within one month. You will not receive different service or pricing for exercising your rights.
You also have the right to complain to a data protection authority. In the UK, this is the Information Commissioner's Office (ico.org.uk). In the EEA, it is the supervisory authority in your country of residence.
California Residents (CCPA/CPRA)
California residents have the right to know what personal information is collected, to know whether it is sold or shared and to whom (we do not sell or share it), to delete their information, to correct it, and to not receive discriminatory treatment for exercising these rights. To exercise them, contact privacy@permitsnag.com.
Children's Privacy
PermitSnag is not intended for children. We do not knowingly collect personal information from children under 16 in the EEA and UK, or under 13 in the United States. If you believe a child has provided us information, contact us and we will delete it.
Security
We implement industry-standard security measures including:
- Encryption in transit (TLS/HTTPS)
- Encryption at rest for sensitive data
- Secure authentication via Apple/Google OAuth
- Regular security reviews
No method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the app, and where required we will ask for your consent again.
Contact Us
- 4Whys LLC, doing business as PermitSnag
- Privacy: privacy@permitsnag.com
- Support: support@permitsnag.com
- Website: permitsnag.com