Privacy Policy

1. Overview

1.1 NYDHEI LLC ("we," "us," or "our") operates the Nydhei mobile application (the "App"). This policy describes the information the App uses and the choices available to you. "You" means the person using the App.

1.2 Task and note content is encrypted on your device before it is synchronized. We do not hold the keys needed to read that content, and it is not included in the categories described below unless stated otherwise.

2. What's encrypted

2.1 The titles and text you write are end-to-end encrypted before they leave your device: task titles, descriptions, and subtasks; note titles and content; comments; category and tag names; and the names and structure of lists you create. We do not hold the keys needed to read any of this.

2.2 Organizational metadata is not encrypted, because our servers use it to sort, schedule, and sync your workspace: due dates and other timestamps, completion status, priority, recurrence settings, and which category, tag, or list an item is assigned to. This metadata never includes the words you write.

3. Information we collect

3.1 Information you provide: your email address, and, if you choose to add them, your name, username, phone number, and profile photo.

3.2 Information collected automatically: your sign-in provider identifier and encrypted task and note content synchronized across your devices. Crash and error diagnostics, such as device model, operating system version, and app version, are collected by default and can be turned off in Settings; our crash-reporting tool is configured not to attach your IP address to these reports. Our service providers may still log IP addresses as part of standard server operation, such as maintaining security and preventing abuse.

3.3 Information from third parties: if you sign in with Google or Apple, we receive the identifier and, where available, the name and profile photo associated with that account.

4. How we use information

4.1 We use this information to create and secure your account, synchronize your encrypted content across the devices you link, provide customer support, process subscriptions, and maintain the reliability and security of the App.

4.2 When a feature needs a device permission, such as calendar access, contacts, camera, photos, microphone, speech recognition, biometrics, or notifications, that permission is used only for its stated purpose. You can change permissions in your device settings.

5. How we share information

5.1 We share information with the following service providers, each engaged to perform a specific function on our behalf: Supabase (account authentication and encrypted content synchronization); Google Sign-In and Sign in with Apple (sign-in identity verification); RevenueCat (subscription and billing management); Sentry (crash and error diagnostics).

5.2 We do not sell your personal information, and we do not use the contents of your encrypted tasks and notes for advertising.

6. International data transfers

6.1 NYDHEI LLC is based in the United States, and the service providers listed above process information in the United States and other countries. Because task and note content is end-to-end encrypted, it is unintelligible to us and to our service providers, and its transfer does not expose its contents.

6.2 For account information that is not encrypted, such as your email address and profile details, we rely on our service providers' standard contractual clauses or equivalent safeguards where required by applicable law.

7. Law enforcement requests

7.1 Because Nydhei is end-to-end encrypted, we cannot decrypt or produce the contents of your tasks, notes, comments, or lists in response to a subpoena, court order, or other legal request. We do not hold the encryption keys.

7.2 If compelled by valid legal process, we can only provide the limited account metadata we possess, such as your email address, sign-in identifier, subscription status, and sync timestamps.

8. Data retention

8.1 If a subscription lapses, we send advance warning notices before any content is removed. Encrypted cloud content associated with a lapsed subscription may be removed from our servers after 12 months, and no sooner than 7 days after the final warning notice. Deleting your account from within the App removes your data immediately; a minimal record that an account was deleted is retained for audit purposes.

8.2 If you use Cloud Backup, your encrypted backup snapshot is tied to your account rather than your subscription, and is deleted when you delete your account.

8.3 Our infrastructure provider takes automated backups on a recurring cycle and retains them for up to 5 days. Residual encrypted copies of deleted data may persist in these backups for up to that period before being permanently overwritten.

9. Security

9.1 We use reasonable technical and organizational safeguards to protect information, including end-to-end encryption for task and note content. No system can guarantee absolute security.

10. Children's privacy

10.1 The App is not directed at children under 13, and we do not knowingly collect personal information from anyone under that age. If you believe a child has provided us with personal information, contact privacy@nydhei.com and we will delete it.

11. Your rights and choices

11.1 Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. You can delete your account from within the App at any time.

11.2 To exercise these rights, contact privacy@nydhei.com.

12. California residents

12.1 If you are a California resident, the CCPA and CPRA give you the right to know what personal information we collect, request its deletion or correction, and opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA and CPRA.

12.2 You will not receive discriminatory treatment for exercising these rights. To submit a request, email privacy@nydhei.com. We will respond within the time required by law.

13. European Economic Area, United Kingdom, and Switzerland residents

13.1 If you are located in the EEA, UK, or Switzerland, our legal basis for processing account information is performance of our contract with you in providing the App. Where diagnostics are optional, our basis is legitimate interest in keeping the App reliable.

13.2 You have the right to access, rectify, erase, restrict, or port your personal information, and the right to lodge a complaint with your local data protection supervisory authority. Requests can be sent to privacy@nydhei.com.

13.3 NYDHEI LLC has not appointed an EU or UK representative under GDPR Article 27 or the UK GDPR, as our processing is occasional, does not involve large-scale special category data, and is unlikely to pose a risk to your rights and freedoms.

14. Changes to this policy

14.1 We review this policy at least once every twelve months and may update it when our practices or legal requirements change. The effective date above identifies the version in force, and material changes will be communicated as required by applicable law.

15. Contact us

15.1 Questions about this policy can be sent to privacy@nydhei.com.