❄️🔒 Privacy Policy & Terms of Use

0. Scope and summary

The SALS Identity System (“the Service”) is the visual identity component of the HOME Wealth App. It generates a unique Snowflake Visual ID and an AI-readable occupational Lettered Shadow for each member, and lets a Snowflake be verified as authentic.

The short version of our position:

• We ask for the minimum data needed to create your identity.
• Your email address is optional and is never sold or shared for advertising.
• We run no advertising, no analytics and no cross-site tracking.
• You can access, correct, export or delete your data at any time.
• We never ask for government ID, bank details, or a password in an email or message.

1. Data we collect

We collect only what the Service needs to function. The table below lists every category of personal data the Service handles.

2. How we use your data

We use your data only to:

• Create and display your identity — generate your Snowflake Visual ID and Lettered Shadow.
• Render your artwork — turn uploaded images into photomosaic Snowflakes.
• Verify authenticity — confirm that a Snowflake SVG was genuinely issued by this Service and has not been altered.
• Operate and secure the Service — enforce rate limits, block abuse, and repair faults.
• Recover your account — if you supplied an email address and later lose access.
• Comply with law — respond to valid legal process.

We do not use your data for advertising, profiling, or automated decision-making that produces legal or similarly significant effects.

3. Legal basis for processing

Where the GDPR or comparable law applies, we rely on the following bases (Article 6(1)):

• Performance of a contract — to create, render and verify your identity as you request.
• Legitimate interests — to secure the Service, prevent abuse and diagnose faults, balanced against your rights and freedoms.
• Consent — where we ask for an optional piece of data, such as an email address you have not required us to hold. You may withdraw consent at any time.
• Legal obligation — where retention or disclosure is required by law.

4. Cookies, analytics and tracking

The SALS Identity System sets no cookies and uses no advertising, analytics or fingerprinting technology. There are no third-party trackers, no social media pixels, and no cross-site or cross-app tracking.

The Service does load the Inter typeface from Google Fonts, which means your browser makes a request to fonts.googleapis.com and fonts.gstatic.com and that Google may log your IP address as a consequence. This is the only external request the page makes, and it can be removed by self-hosting the font.

Where cookies are required for security or session handling in other parts of the HOME Wealth App, we use them strictly for that purpose and describe them in the relevant in-app notice.

5. How we protect your data

We apply the following technical and organisational measures:

• Encryption in transit — all connections are served over HTTPS/TLS, with HTTP automatically redirected to HTTPS and HSTS enforced.
• Rate limiting — API requests are rate-limited per IP address, with stricter limits on administrative endpoints to hinder brute-force attempts.
• Password hashing — administrative credentials are stored as salted PBKDF2-SHA256 hashes, never in plain text.
• Short-lived tokens — administrative access tokens expire within minutes; longer refresh tokens are scoped and revocable.
• Browser security headers — Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and related headers are set for every response.
• File size limits — uploads are capped (10 MB for images, 2 MB for SVG verification) to reduce abuse and denial-of-service risk.
• Restricted administrative access — privileged operations require a valid administrative token.
• Backups — operational data is backed up so that service can be restored, with access to backups limited to operators.

No system is perfectly secure. If a breach affects your data, we will notify you and the relevant supervisory authority without undue delay where the law requires it.

6. Who we share your data with

We do not sell, rent or trade your personal data. We share it only with:

• Service providers — hosting and database providers who process data on our instructions, under confidentiality obligations.
• Professional advisers and authorities — where disclosure is required by law, court order, or to establish or defend legal claims.
• A successor entity — in connection with a merger, reorganisation or sale of assets, in which case this policy continues to apply.

We do not sell or share personal data for cross-context behavioural advertising, and we have not knowingly shared it for that purpose.

7. How long we keep your data

We keep data only for as long as it serves the purpose it was collected for:

We may retain data longer where retention is required by law, to resolve disputes, or to enforce our agreements. Once retention is no longer required, the data is deleted or irreversibly anonymised.

8. Your rights

Depending on where you live, you may have some or all of the following rights over your personal data. To exercise any of them, contact us using the details in section 7.

• Access — ask for a copy of the personal data we hold about you.
• Rectification — ask us to correct data that is inaccurate or incomplete.
• Erasure — ask us to delete your data (the “right to be forgotten”).
• Restriction — ask us to pause certain processing while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting prior processing.
• Complain — lodge a complaint with your local data protection authority (for example, the ICO in the UK, or your national supervisory authority in the EU).

9. International transfers

The Service is operated from servers in the EEA. Some service providers may process data in other countries. Where your data is transferred outside the EEA, we ensure an adequate level of protection, using standard contractual clauses or another lawful transfer mechanism, and we take steps to ensure that protection travels with the data.

10. Children’s privacy

The Service is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal data from children below that age. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page always reflects the current version. If a change materially affects how we use your data, we will make reasonable efforts to notify you, for example by posting a notice in the app or sending an email if you have provided one. Continuing to use the Service after an update means the revised policy applies to you.

1. Acceptance of these terms

By creating or using a Snowflake Visual ID, uploading an image, or otherwise using the Service, you agree to these Terms of Use and to our Privacy Policy. If you do not agree, do not use the Service.

You must be legally capable of entering into a binding contract. If you are using the Service on behalf of someone else, you confirm you have authority to do so and that they accept these terms.

2. What the Service does

The Service provides a visual identity system. It allows you to:

• generate a unique Snowflake Visual ID rendered as an SVG image;
• create photomosaic Snowflakes from images you supply;
• build an AI-readable occupational Lettered Shadow using gate letters from F·R·E·E·D·O·M;
• verify that a Snowflake SVG was issued by this Service and has not been tampered with.

We may add, modify, suspend or discontinue features. Where a change is significant and affects your ability to use an identity you already created, we will make reasonable efforts to notify you first.

3. Identity verification — important limits

Accordingly, you must not:

• present a Snowflake as official identification, a credential, or a qualification;
• imply that a Snowflake has been issued, endorsed or approved by a government, employer, university, bank or regulator;
• use a Snowflake to misrepresent your identity, occupation, employment status or qualifications;
• rely on a Snowflake as a substitute for lawful identification, employment or credit checks.

Any third party who accepts a Snowflake as proof of something does so at their own risk. You are solely responsible for how you present and use your identity.

4. Your account

Keep your credentials confidential and notify us promptly of any unauthorised access. You are responsible for activity under your identity unless that activity resulted from our failure to apply reasonable security measures.

You must provide accurate information and keep it current. Usernames must not impersonate others or infringe anyone’s rights.

5. Your content

You keep ownership of the images and content you upload. You grant us only the limited licence needed to host, process and display that content in order to operate the Service — for example, to convert your image into a photomosaic. That licence ends when we delete the content or you close your identity.

You are responsible for having the rights to everything you upload, and you confirm:

• you own the content or hold permission to use it;
• it does not infringe copyright, trademark, privacy or publicity rights;
• it is not unlawful, defamatory, or discriminatory;
• it does not depict another person without their consent, and does not include children without appropriate permission.

Do not upload images of other people — especially children — without their explicit permission. We may remove content that breaches this section.

Generated Snowflakes are produced for you under these terms. You may use, display, print and share your own Snowflake freely, including commercially, provided you do not misrepresent what it is (see section 3).

6. Acceptable use

You agree not to:

• use the Service for any unlawful purpose, or to facilitate illegal activity;
• upload malware, malicious code, or content that could harm the Service or other users;
• attempt to gain unauthorised access to the Service, its servers, or administrative functions, including by circumventing rate limits or authentication;
• probe, scan, or test the vulnerability of our systems without our written permission;
• scrape, harvest, or bulk-extract data or user profiles;
• resell, sublicense, or provide the Service to third parties as a standalone product;
• interfere with the Service’s operation, or overload it with automated requests;
• impersonate any person or organisation, or use the Service to harass or defraud others;
• reverse engineer, decompile, or attempt to extract source code, except to the extent that such restriction is prohibited by law.

We may suspend or terminate your access if you breach these terms, and we may cooperate with law enforcement where required.

7. Intellectual property

The Service — including its software, algorithms, Snowflake generation logic, lettered shadow system, visual design, trade marks, and this page — is owned by us or our licensors and is protected by intellectual property law.

We grant you a limited, revocable, non-exclusive, non-transferable licence to use the Service for your personal or internal business purposes, in line with these terms. No rights are granted by implication.

“HOME Wealth App”, “SALS”, the SALS Identity System and associated branding are trade marks of the operator. Using them other than to describe your use of the Service requires prior written permission.

8. No financial or professional advice

The Service and any information in it, including occupational gate letters and Lettered Shadows, are provided for identity and informational purposes only. Nothing we publish constitutes financial, investment, legal, tax, employment, career or professional advice.

Nothing in the Service is an offer, solicitation or recommendation to buy or sell any security, or to enter into any financial commitment. Always seek independent professional advice before acting.

9. Disclaimers and limitation of liability

The Service is provided “as is” and “as available”. To the fullest extent permitted by law, we disclaim all express and implied warranties, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

We do not warrant that the Service will be uninterrupted, error-free, or that generated Snowflakes will be unique across all users and all time, or that verification will detect every possible tampering.

10. Indemnity

You agree to indemnify and hold harmless the operator, its personnel and partners against any claim, demand, loss or expense (including reasonable legal fees) arising from your upload of content you do not own, your misuse of the Service, your breach of these terms, or your violation of anyone’s rights.

11. Governing law and changes to these terms

These terms are governed by the laws of the jurisdiction in which the operator is established, without regard to conflict-of-law principles. Nothing in these terms removes any right you have under the mandatory consumer protection laws of your country of residence.

Any dispute arising out of or in connection with these terms will be subject to the exclusive jurisdiction of the competent courts of that jurisdiction, save that we may seek injunctive relief in any appropriate jurisdiction to protect our intellectual property.

We may update these Terms from time to time. The “Last updated” date at the top of this page reflects the current version. If a change is material, we will make reasonable efforts to notify you. Continuing to use the Service after an update means you accept the revised terms.

12. Contact us

For any question about these Terms, our Privacy Policy, or to exercise a right described in section 8 of the Privacy Policy (including requesting access, correction, export or deletion of your data), contact us: