TWIG N BERRIES

Let's talk about your privates. Er, privacy. Yeah. Here's what SnapSmack and its creator knows about you and your site, and what it does with that. No legalese. No tricks. Just a straight account of how this works.

The short version

SnapSmack is software you install on your own server. Your blog, your posts, your visitors — that data lives on your machine and nowhere else. The SnapSmack project does not collect it, see it, or have any access to it.

Opt-in features — the spam protection network and the community forum — are the only ones that identify your site to us by name. SnapSmack does send two automatic pings: a version check when your installation looks for updates (so we can count installs and track which versions need support), and a counter ping when someone discovers the Thomas the Bear Easter egg. Both use pseudonymous hashed IDs. We get a count — not a name, not a URL, nothing that identifies you. Nothing is installed on your system by us. Nothing identifies you to us unless you choose to connect.

Your blog and your visitors

SnapSmack is self-hosted software. When someone visits your blog, comments on a post, or sends you a message through your site, that data goes to your server — not ours. We have no access to your posts, your images, your visitors, or your comment data.

What your blog collects from visitors, and what you do with that data, is your responsibility. You should have your own privacy policy if your site collects personal information from visitors. SnapSmack's administration panel includes a privacy policy field for exactly this reason.

When you opt into SMACK UP (spam protection)

SMACK UP is SnapSmack's voluntary spam protection network. Sites that join share information about bad actors — trolls and spammers — so the whole network can benefit. Here is exactly what gets shared and what does not.

What is transmitted to the central server:

  • Your site's URL. This is how the network identifies you. It is stored on the central server and visible to the network administrator.
  • SHA-256 hashes of IP addresses, email addresses, and browser fingerprints belonging to commenters you report. The hash is a one-way transformation — the original IP address or email cannot be recovered from it. The actual addresses never leave your server.
  • Your site's post count and age, used to calculate how much weight your reports carry. Newer or smaller sites carry less weight than established ones.
  • When you approve a flagged commenter, that approval is recorded as an allow-vote, which helps correct false positives across the network.

What is not shared:

  • Your visitors' actual IP addresses or email addresses — only hashes.
  • Your post content, images, or any other blog data.
  • Your admin credentials or API key (the key authenticates your site but is not stored in a readable form on the central server).

Other sites in the SMACK UP network cannot see your site's URL or your reporting history. That information is only visible to the network administrator (currently Sean McCormick, who runs Smack Central). What other sites receive from the network is threat scores for fingerprints — not a list of who reported them.

You can opt out of SMACK UP at any time in your admin settings. Opting out stops all further data transmission. Your site's registration record on the central server is retained but your weight is zeroed — you stop contributing to and receiving from the network.

SMACK UP also includes GOBSMACKED, a feature that analyses writing style to detect ban evasion. Read more below.

GOBSMACKED — writing fingerprinting (Tier 3 protection)

GOBSMACKED is an additional layer of spam protection built on top of SMACK UP. It exists for a specific reason: the developer of SnapSmack was personally cyberstalked by a troll for several years — one who evaded bans by rotating IP addresses, using disposable email accounts, and clearing browser fingerprints. GOBSMACKED is built to detect that kind of evasion, so that no one using SnapSmack has to go through the same thing.

The plain version: if you're a bad actor, we take your fingerprints and save them — we just don't write your name on them. We don't need to. You'll leave more, and we'll match them up.

Here is how it works and what it means for your blog's visitors.

What it does: When a commenter is banned on a SnapSmack blog that has SMACK UP enabled, the blog software analyses that commenter's previous comments and extracts a writing style fingerprint — a set of 25 numbers describing things like how often they use certain common words, their punctuation habits, average sentence length, and similar stylistic patterns. This is the same approach used in academic authorship analysis. The 25 numbers are then transmitted to Smack Central alongside the ban report.

What is not transmitted: The actual text of the comments never leaves your server. Only the 25 numeric values are sent. Smack Central has no record of what anyone wrote — only an abstract description of how they write.

What Smack Central does with it: The writing style fingerprints from all participating sites are periodically compared against each other. If a banned commenter shows up on a different site with a different IP address and a different email address, but writes in a recognisably similar style, Smack Central can flag that as a likely match and surface it for the network administrator to review. No automatic action is taken on a style match alone — it is a signal for human review, not an automatic ban.

Retention: Writing style fingerprints are stored for one year and then permanently deleted. They are used only to detect evasion of existing bans. They are not used for any other purpose and are not shared with any third party.

If your blog has SMACK UP enabled, you should disclose to your own visitors that when a commenter is banned, a writing style fingerprint derived from their comments may be transmitted to the SMACK CENTRAL network. The actual comment text is never transmitted — only the derived numeric fingerprint. You can copy and adapt the language above for your own privacy policy.

When you opt into Network Alert

Network Alert is SnapSmack's coordinated breach warning system. If Smack Central detects a file-integrity breach affecting multiple installations simultaneously — suggesting a coordinated attack rather than an isolated incident — it broadcasts a YELLOW alert to all opted-in sites. Participation is entirely voluntary. You can receive alerts without sending anything.

Receiving alerts (polling): If you opt in to receive, your site periodically checks snapsmack.ca for the current alert level. This is a one-way read — your site asks, Smack Central responds, nothing is transmitted about your site in the process.

Contributing breach reports: If you opt in to send, your site will transmit a report to Smack Central when your local SMACKBACK file integrity monitor detects a breach. Here is exactly what that report contains:

  • Your site's name and URL.
  • Your server's IP address.
  • A list of affected file paths and their SHA-256 checksums.
  • Timestamps.

No post content, no visitor data, no admin credentials are included.

Immediate push notifications: Enabling push notifications lets Smack Central contact your site directly the moment a coordinated breach is confirmed — instead of waiting for your site's next scheduled poll. When you enable this, your site registers with Smack Central by transmitting:

  • Your site's URL and name.
  • A push token — a randomly generated 64-character string created locally on your server. It is never derived from your URL or any identifying information. Smack Central stores this token to authenticate incoming pushes so no third party can spoof a network alert to your site.
  • The URL of your push endpoint (network-alert-push.php), which is where Smack Central delivers alerts.

To opt out of push notifications, turn off the toggle and save. Your site will send a deletion request to Smack Central on every admin page load until Smack Central confirms removal. You can verify removal by contacting [email protected].

When you opt into the community forum

The SnapSmack community forum is a place for site owners to talk to each other. When you connect your site to the forum:

  • Your site's URL and the display name you choose are visible to all forum participants. This is intentional — the forum is a community of site owners, and participants can see who they are talking to.
  • Posts and replies you make in the forum are visible to all participants.
  • Your SnapSmack version is shown on your posts so other participants can see whether a support issue is version-related.

You can disconnect your site from the forum at any time. When you do, or if you request it, your posts are anonymized rather than deleted — your display name, site URL, and identifying information are stripped, but the discussion thread stays intact so the support history remains useful to others. If a post contains a screenshot with sensitive site information visible, moderators can swap it for a pixelated version on request, or remove it entirely if it adds nothing to the discussion.

Version checks and install counting

When your SnapSmack installation checks for updates, it sends a brief ping to snapsmack.ca. This is how we count active installs and understand what versions are in the wild — useful for knowing how much support a given version might need. Here is what that ping contains:

  • A pseudonymous ID derived from your site's URL using a one-way hash. The original URL cannot be recovered from it.
  • Your installed version and update track.
  • If your install is a hub, the number of active spokes it manages (so the fleet is counted once, not once per site).

No site name, no traffic data, no content. If your install is a spoke in a multisite network, it skips the ping entirely — your hub's count already includes you.

Thomas the Bear (the Easter egg)

SnapSmack contains a hidden Easter egg called Thomas the Bear, a tribute to Noah Grey. When a visitor to your site discovers it, a single silent ping is sent to snapsmack.ca. Here is exactly what that ping contains:

  • A pseudonymous random ID generated when SnapSmack is installed, stored in your site's database. It is not derived from your site's URL or any identifying information and cannot be linked back to you or your site.
  • Which part of the Easter egg was triggered (the bears, or the Noah Grey dedication modal).
  • Whether this is the first time the Easter egg has been found in the visitor's current browser session.

Nothing else. No IP addresses, no site URL, no visitor data. We get a count. If you want to suppress the ping anyway, block outbound requests to snapsmack.ca at your firewall or web server — the Easter egg keeps working either way.

This website (snapsmack.ca)

This site does not use analytics, tracking pixels, or advertising scripts of any kind. Our web server access logs record the standard information any web server records — IP address, browser, referring page, page requested. We do not use that data for any purpose beyond diagnosing server problems.

There are no cookies on this site other than any your browser sets on its own.

Who runs this

SnapSmack is built and maintained by Sean McCormick. If you've read this far you've probably noticed that he's a right nutter, but he hopes that he's an honest one. He's also mostly harmless unless you're a jelly-filled doughnut. If that's the case, you should run (roll?) for your life. The Smack Central network server and the community forum are operated by Sean McCormick (mirror universe version). If you have questions about your data, want to request removal of your site's record, or just want to know something this policy does not cover, get in touch.

Contact:

Last updated: June 4, 2026