Privacy Policy
Last updated: September 13, 2026
4Whys LLC, doing business as PermitSnag ("we," "our," or "us"), operates the PermitSnag website (permitsnag.com) and mobile application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information, and the rights you have over it. For visitors in the European Economic Area (EEA), the United Kingdom, and California, see the dedicated sections below.
Data Controller
The data controller responsible for your personal data is 4Whys LLC (doing business as PermitSnag), United States. For any privacy question or to exercise your rights, contact us at privacy@permitsnag.com.
Information We Collect
Account Information
When you create an account, we collect:
- Email address
- Authentication provider information (Apple ID, Google account, or email magic link)
- Account creation date
Trip and Permit Data
When you use our permit tracking features, we collect:
- Permit preferences (parks, dates, party size, zones)
- Alternate permit selections
- Tracking preferences and notification settings
- Outcome reports (whether you secured a permit)
- Calendar sync preferences
- Booking confirmation numbers, when you choose to give us one. We use them to build your permit pass and, if you are in a lottery pool, to record that you applied.
Device and Technical Data
We automatically collect:
- Device type, hardware model, and operating system version
- Push notification tokens, including Live Activity tokens, so we can send alerts
- An install identifier we generate the first time you open the app, so we can tell your devices apart. It is not an advertising identifier and it is not shared.
- App version and usage statistics
- Your device language and time zone, so dates and deadlines read correctly
- IP address and approximate location (country/region level)
- Browser type (for website visitors)
We do not use advertising identifiers, and we do not track you across other companies' apps or websites.
Location (iPhone app only)
The iPhone app can remind you what you need at the trailhead about five miles out. It asks for location permission on that screen, and nowhere else in the app.
- We use significant-change monitoring and a geofence around your trailhead. We never turn on continuous GPS.
- Your location never leaves your phone. The trailhead coordinates come from us; your phone compares its own position against them and posts the reminder locally. We do not receive, store, or send your position anywhere.
- The app works fully with location denied. The only thing you lose is the reminder.
You can change or withdraw this permission at any time in iOS Settings.
Photos (iPhone app only)
After you book, you can pick the screenshot of your confirmation and the app reads the confirmation number from it.
- The app sees only the screenshot you pick. It has no access to the rest of your library.
- The picture stays on your phone. The text is read on the device. We never upload the image.
- The confirmation number itself is sent to us, and only if you confirm it.
Booking sessions
When you book through the app, the reservation site's own page opens inside it and you sign in to that site directly.
- We never read, store, or send your reservation-site password or cookies. The only thing the app reads is the web address of the page you are on, so it can tell you whether you are signed in.
- That session stays on your phone so the next alert lands you on a booking page instead of a log-in form. Signing out of PermitSnag does not sign you out of the reservation site — those are two different accounts. Use “Clear booking session” on the account screen to end it.
App Clip and sharing into the app
Opening a PermitSnag invitation without installing the app runs a small version of it called an App Clip. It collects the same account information as the app and nothing more. If you then install the full app, your sign-in carries across so you do not have to sign in twice, and the App Clip's copy is removed. If you share a reservation page into PermitSnag from Safari, the app sends us the permit's identifier from that web address so it can find the matching permit, and nothing else about the page.
Payment Information
Payments made on our website are processed by Stripe. Purchases made inside the iPhone app are processed by Apple through the App Store. We do not store your credit card numbers or bank account information, and neither Stripe nor Apple gives us your payment details. We receive only:
- Subscription status and expiration date
- Transaction identifiers
- Purchase history (subscription, single permit, or permit add-on)
- Which store the purchase was made in, and the App Store country your Apple Account buys from
How We Use Your Information and Our Legal Bases
Where the EU or UK GDPR applies, we process personal data only where we have a legal basis to do so. The table below sets out each purpose and its basis.
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Provide the core service (monitor availability, send alerts, manage your account and trips) | Performance of a contract (Art. 6(1)(b)) |
| Process payments and keep required financial records | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| SMS and push alerts you request | Consent (Art. 6(1)(a)) and contract (Art. 6(1)(b)) |
| Analytics and product experiments (A/B testing). On the website these run only where you have consented; the iPhone app is sold on the United States storefront only. | Consent (Art. 6(1)(a)) |
| Recommend alternates, estimate success odds, and improve alert timing | Legitimate interests (Art. 6(1)(f)) in improving the service |
| Security, fraud prevention, and service integrity | Legitimate interests (Art. 6(1)(f)) |
| Comply with legal obligations and enforce our Terms | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
Where we rely on consent, you can withdraw it at any time (see Your Rights). Where we rely on legitimate interests, you can object (see Your Rights), and we will stop unless we have compelling grounds to continue.
Automated Processing and Profiling
We use limited automated analysis to recommend similar permits, estimate the odds of securing a permit, and learn the best time to send you alerts. These do not produce legal or similarly significant effects on you, and no decision about you is made solely by automated means without human involvement. You can object to this processing at any time.
Cookies and Tracking
We use strictly necessary cookies to run the site (sign-in, security, and remembering your cookie choice) and, with your permission, analytics cookies to understand usage and run product experiments. In the EEA and UK, non-essential cookies are set only after you consent, and you can change or withdraw your choice at any time using the "Cookie preferences" link in the footer. Full details are in our Cookie Policy.
Information Sharing
With Other Users (Permit Sharing)
When you share a trip with other users or participate in group applications, those users can see:
- The permit and dates you're tracking
- Current availability status
- Your name or email (as trip owner or member)
You control who you share with. Observers can view status but cannot modify your trip.
With Service Providers (Processors)
We share data with trusted providers that process it on our behalf under contract. We do not authorize them to use your data for their own purposes.
| Provider | Purpose | Location |
|---|---|---|
| Stripe | Payment processing | US |
| Apple (App Store) | In-app purchases and subscription billing | US |
| PostHog | Product analytics and experiments | US |
| Telnyx | SMS delivery | US |
| Resend | Email delivery | US |
| Vercel | Website hosting | US |
| Railway | Application and database hosting | US |
| Apple (APNs) | Push notifications | US |
| Apple, Google | Sign-in (OAuth) when you choose them | US |
Apple Wallet
If you add a permit pass to Apple Wallet, we build the pass on our servers from your trip and your confirmation number and send it to your phone. Apple does not tell us whether you kept it.
We Do Not Sell Your Data
We do not sell, rent, or trade your personal information to third parties for marketing purposes. Period.
International Data Transfers
PermitSnag is operated from the United States, and your information is processed there. When we transfer personal data from the EEA or the UK to the US, we rely on appropriate safeguards, primarily the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), and, where a provider is certified, the EU-US Data Privacy Framework. You can request a copy of the safeguards we use by emailing privacy@permitsnag.com.
SMS Messaging
When you provide your phone number and opt in to SMS alerts, you consent to receive text messages from PermitSnag regarding:
- Permit availability alerts when openings are detected
- Lottery application reminders and deadline notifications
- Trip and calendar notifications
- Account security messages (verification codes)
Message frequency varies (typically 0 to 10 per week). Message and data rates may apply. Reply STOP to unsubscribe from all SMS alerts, or HELP for assistance. You can also disable SMS in your account settings. We do not sell or share your phone number with third parties for marketing.
Data Retention
We retain your data as follows:
- Account data: Until you delete your account
- Trip data: Until 90 days after the trip end date, then automatically deleted
- Historical outcome data: Anonymized and aggregated for service improvement
- Payment records: As required by law (typically 7 years)
- Consent records: Kept as proof of your choices for as long as required to demonstrate compliance
Your Rights (EEA and UK)
If you are in the EEA or the UK, you have the following rights over your personal data:
- Access: Request a copy of the personal data we hold about you
- Rectification: Correct inaccurate or incomplete data
- Erasure: Ask us to delete your data ("right to be forgotten")
- Restriction: Ask us to limit how we use your data
- Portability: Receive your data in a portable, machine-readable format
- Object: Object to processing based on legitimate interests, including profiling
- Withdraw consent: Withdraw consent at any time, without affecting processing already carried out
- Complain: Lodge a complaint with your local supervisory authority
To exercise any of these rights, contact privacy@permitsnag.com or use the "Delete Account" option in settings. We respond within one month. You will not receive different service or pricing for exercising your rights.
You also have the right to complain to a data protection authority. In the UK, this is the Information Commissioner's Office (ico.org.uk). In the EEA, it is the supervisory authority in your country of residence.
California Residents (CCPA/CPRA)
California residents have the right to know what personal information is collected, to know whether it is sold or shared and to whom (we do not sell or share it), to delete their information, to correct it, and to not receive discriminatory treatment for exercising these rights. To exercise them, contact privacy@permitsnag.com.
Children's Privacy
PermitSnag is not intended for children. Our Terms of Service require you to be at least 18 to hold an account, because an account is a contract. Separately, and whatever age a person claims, we do not knowingly collect personal information from children under 16 in the EEA and UK, or under 13 in the United States. If you believe a child has provided us information, contact us and we will delete it.
Security
We implement industry-standard security measures including:
- Encryption in transit (TLS/HTTPS)
- Encryption at rest for sensitive data
- Secure authentication via Apple/Google OAuth
- Regular security reviews
No method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the app, and where required we will ask for your consent again.
Contact Us
- 4Whys LLC, doing business as PermitSnag
- Privacy: privacy@permitsnag.com
- Support: support@permitsnag.com
- Website: permitsnag.com