diff --git a/setup/start.sh b/setup/start.sh
index 4825fb201..d9540910c 100755
--- a/setup/start.sh
+++ b/setup/start.sh
@@ -37,12 +37,17 @@ find "${DATA_DIR}/box" -mindepth 1 -delete || true
 [[ ! -d "${DATA_DIR}/box" ]] && btrfs subvolume create "${DATA_DIR}/box"
 mkdir -p "${DATA_DIR}/box/appicons"
 mkdir -p "${DATA_DIR}/box/mail"
+mkdir -p "${DATA_DIR}/snapshots"
 
 mkdir -p "${CONFIG_DIR}/addons"
 mkdir -p "${CONFIG_DIR}/nginx/applications"
 mkdir -p "${CONFIG_DIR}/nginx/cert"
 mkdir -p "${CONFIG_DIR}/collectd/collectd.conf.d"
 
+# remove old snapshots. if we do want to keep this around, we will have to fix the chown -R below
+# which currently fails because these are readonly fs
+find "${DATA_DIR}/snapshots" -mindepth 1 -maxdepth 1 | xargs --no-run-if-empty btrfs subvolume delete
+
 set_progress "15" "Downloading restore data"
 if [[ -n "${arg_restore_url}" ]]; then
     echo "Downloading backup: ${arg_restore_url} and key: ${arg_restore_key}"
diff --git a/src/scripts/backupapp.sh b/src/scripts/backupapp.sh
index 27da0cdb0..ed08313e0 100755
--- a/src/scripts/backupapp.sh
+++ b/src/scripts/backupapp.sh
@@ -24,7 +24,7 @@ backup_url="$2"
 backup_key="$3"
 readonly now=$(date "+%Y-%m-%dT%H:%M:%S")
 readonly app_data_dir="${DATA_DIR}/${app_id}"
-readonly app_data_snapshot="${DATA_DIR}/${app_id}-${now}"
+readonly app_data_snapshot="${DATA_DIR}/snapshots/${app_id}-${now}"
 
 btrfs subvolume snapshot -r "${app_data_dir}" "${app_data_snapshot}"
 
diff --git a/src/scripts/backupbox.sh b/src/scripts/backupbox.sh
index 0e3f7392d..74f12efcb 100755
--- a/src/scripts/backupbox.sh
+++ b/src/scripts/backupbox.sh
@@ -21,7 +21,7 @@ backup_url="$1"
 backup_key="$2"
 now=$(date "+%Y-%m-%dT%H:%M:%S")
 BOX_DATA_DIR="${HOME}/data/box"
-box_snapshot_dir="${HOME}/data/box-${now}"
+box_snapshot_dir="${HOME}/data/snapshots/box-${now}"
 
 echo "Creating MySQL dump"
 mysqldump -u root -ppassword --single-transaction --routines --triggers box > "${BOX_DATA_DIR}/box.mysqldump"