Slashit

GDPR overview

Slashit claims compliance in explicit terms: the vendor states it adheres to GDPR, CCPA, LGPD and PIPEDA, and cites data minimisation, purpose limitation and accountability as governing principles. The privacy policy, dated 16 June 2025, lists concrete rights — access, rectification, erasure, restriction, portability, objection and withdrawal of consent — exercised through the contact page after identity verification, with response deadlines such as the 45 days set by the CCPA. International transfers are said to rely on standard contractual clauses and on the EU-U.S. Data Privacy Framework. Three things are missing, however, and their absence is explicit: no Article 27 EU representative is designated, no Data Protection Officer is named, and no Data Processing Agreement is published or mentioned anywhere on the site.

Who owns the data?

You keep ownership of what you create. The terms state that users retain ownership of their User Submissions — snippets and templates — but grant slashit.app a worldwide, non-exclusive, royalty-free, perpetual and irrevocable licence over them. That licence covers three uses: running the service itself (storage, sync, backup), publishing content you opt into sharing through public libraries, and developing or improving the vendor's own AI and machine-learning models using anonymised or aggregated versions. Expanded content, which the documentation calls Variable Content, is described as processed locally on your device and generally not stored on the vendor's servers. The privacy policy states that no personal information is sold to data brokers.

Reuse rights

Slashit places no restriction on what you do with your own snippets, templates and clipboard entries: they are your content, they live locally on your machine, and you can export, reuse or delete them without asking anyone. What the terms do restrict is the use of the vendor's own material — the software, design and site content are owned by slashit.app and its licensors, and may not be copied, reverse-engineered or exploited without permission. Scraping the site or copying substantial portions of it is listed among the prohibited activities. Note one clause that sits awkwardly with the product's own team plans: the terms limit use of the Services to lawful, personal and non-commercial purposes.

Data retention & training

Hosting summary

Slashit names no hosting country and no hosting region anywhere. Neither the privacy policy nor the terms identify a data centre, a jurisdiction or a cloud provider, and the site publishes no trust or security page that might. What the privacy policy does say is that data may be transferred internationally, that standard contractual clauses are used as a safeguard, and that the vendor adheres to the EU-U.S. Data Privacy Framework — which implies processing in the United States without ever stating it. Much of the sensitive material never reaches a server at all: snippets, templates and clipboard history are described as living locally on the device, and expanded Variable Content as generally not stored on the vendor's servers. Security measures claimed include encryption at rest and in transit, pseudonymisation, access controls, penetration testing and a breach response plan. The site itself is served through Cloudflare, but that is content delivery infrastructure and says nothing about where user data is kept.