Privacy Policy

Last updated: October 26, 2026 · Applies to the Nivolo iOS app and nivolo.app

Nivolo is a habit and goal app built to be private by default. It has no cloud account system, analytics, advertising, or trackers. Almost everything you create lives only on your iPhone. This policy explains the exceptions in detail — what leaves your device, when, who processes it, how long it is kept, and what you can ask us to do about it.

1. Who we are

Nivolo is an independent iOS app made by Jack Dai. For the purposes of the GDPR, the developer is the data controller for the limited data described in this policy. There is no developer-hosted account system. A name, username, or email shown in your local app profile remains on your device and is not registered with us. An email submitted separately through the website launch form is kept only for that launch notice. You can reach us at support@nivolo.app.

This policy covers the Nivolo iOS app and the website at nivolo.app. It does not cover Apple's own services (the App Store, iCloud Backup, Apple ID), which are governed by Apple's privacy policy.

2. Data that stays on your device

Nivolo does not create a cloud account. Its onboarding and profile screens create a local identity on your iPhone only. The information below is stored in the app sandbox or an App Group container shared with the Nivolo home-screen widget. The AI exceptions are described in section 3: goal text and your reason leave the device only when you request a plan, and Plus weekly summary counts can be sent automatically.

Because this data lives on your device, it is included in your normal iPhone backup (iCloud or a computer), where it is handled under Apple's backup and encryption terms. Deleting the app deletes this data from your device; a backup you have already made may still contain a copy until that backup is deleted or overwritten.

3. Data sent for AI features

Nivolo has two AI features. They are part of the Nivolo Plus membership, and anyone can try the plan drafter a couple of times for free. The plan drafter sends data only when you tap to request it. For eligible Plus members, the weekly insight can run automatically as described below. Requests go over an encrypted HTTPS connection to our own server at api.nivolo.app (a Cloudflare Worker), carrying a short-lived token derived from the random app ID described above.

AI goal plan

When you ask Nivolo to draft a plan for a goal, the following is sent:

• The goal text you typed, your "why", and any specifics you added.
• A general category label for the goal icon (for example "Fitness" or "General").
• Your random app ID and a session identifier, so a redraft of the same goal counts once.
• If you are a Nivolo Plus member, Apple's signed record of your subscription (the StoreKit transaction the App Store gives the app). Our server checks Apple's signature on it to confirm the membership. It contains the product, the purchase and renewal dates, the App Store country, transaction identifiers and the price — never your name, Apple ID, email address or payment details.

This text is used once, to generate that plan, and is returned to your device. Please avoid typing anything you would not want processed by a third-party AI provider — health details, financial details, or other people's personal information — into a goal you send to the AI. Writing goals by hand instead sends nothing at all.

AI weekly insight

For Plus members with at least five logged actions, Nivolo automatically requests a weekly "Nivo's take" insight when the app opens or the language changes, if it has not already saved an insight for that week and language. This sends summary counts only — never your goal text or your name. Specifically: your current streak length, how many actions you logged this week and last week, your most active weekday, how many goals are active, how many goals you completed this week, your total Krill earned, and your language setting, together with the signed subscription record described above. The result is saved on your device.

What our server keeps

Our server does not store your goal text, does not log request bodies, and does not build a profile. It keeps only the small counters needed to stop abuse and to apply the free and Plus allowances (see retention):

• Against your random app ID: how many free plan drafts it has used, and the last couple of session identifiers.
• Against your network's IP address: how many new free drafts were started from that network today — this stops one device from resetting its free drafts by reinstalling.
• Against your subscription's transaction identifier (Plus only): how many plans were drafted today and insights written this week.
• Short per-minute request limits, held by Cloudflare's rate limiter.

Early Supporter icon

The Early Supporter icon and one numbered painting are awarded to the first 20 qualifying payments verified by our Cloudflare server, in the order they are received. Any paid membership tier qualifies; free trials, test purchases, Family Sharing access and launch-list signups do not reserve a place. The app sends an Apple-signed purchase record, authenticated with its random installation ID. Apple App Store Server Notifications can also report a payment directly, including when a free trial becomes paid while the app is closed. We verify Apple's signature, the app and product, production environment, purchaser ownership, positive payment amount and absence of a revocation. We keep only a SHA-256 hash of the winning subscription's original transaction identifier and its number from 1 to 20; the same number selects its painting. We do not store your Apple ID, name, email, goals or signed receipt in the award record. Renewals and repeat requests return the same award. The app saves a local copy for offline access; restoring an active winning subscription on another device recovers its number and painting. The keepsake remains after membership expires, and places are never reissued.

If a future version of the app adds a feature that transmits anything else, this policy will be updated before that version ships.

4. Third parties we rely on

These are the only companies that can come into contact with data related to your use of Nivolo. We have no advertising, attribution, analytics or crash-reporting SDKs in the app.

We do not sell, rent or trade personal information. We share it only with the service providers above as needed to run the feature you chose, or if legally compelled to do so.

5. What we never do

• No cloud accounts or passwords. The launch list is separate from the app and contains only voluntarily submitted email addresses.
• No analytics SDK, no attribution SDK, no advertising SDK, no ad network.
• No tracking across other apps or websites, and no use of the advertising identifier (IDFA). Nivolo will never show you an App Tracking Transparency prompt because it does not track.
• No sale or sharing of personal information, and no targeted advertising.
• No access to your location, contacts, photos, microphone, camera, calendar, or Health data.
• No profile-building, scoring, or automated decision-making that produces legal or similarly significant effects.
• No newsletter or ongoing email marketing. The launch list receives one launch message; support email is used only to answer you.

6. Permissions the app requests

Notifications. If you allow them, Nivolo schedules local notifications — reminders, streak warnings, and encouragement — directly on your device using iOS. They are composed on your phone and never pass through any server, so no one but you can see them. Turn them off any time in the app's settings or in iOS Settings.

Motion. Nivolo reads device motion so that falling pebbles and other on-screen elements react when you tilt your phone. Motion data is used only to animate the current screen; it is never recorded, stored, or transmitted. Declining this permission simply makes those animations static.

Home-screen widget. The Nivolo widget reads your streak and progress from a shared container on your device. Widget data stays on the device.

Rating prompt. The app may occasionally ask you to rate it using Apple's standard review prompt. Apple handles that entirely; we receive no information about whether or how you responded.

7. Purchases and memberships

All in-app purchases and subscriptions are processed by Apple through your Apple ID. We never see or handle your name, card number or billing address. The app receives subscription details from Apple to unlock Plus features. When a Plus member uses an AI plan or receives a weekly AI insight, the app sends Apple's signed subscription record to our server for verification, as described in section 3; the server does not keep the record.

Restoring purchases uses your Apple ID through Apple's servers. Managing or cancelling a subscription happens in your Apple ID settings, not with us. Refunds are handled by Apple.

8. How long data is kept

9. Legal bases (GDPR)

If you are in the EEA, the UK or Switzerland, we process the limited data described above on these bases:

• Performance of a contract — sending your goal text to generate the plan you asked for, and confirming and delivering the Nivolo Plus features you paid for.
• Legitimate interests — keeping the AI server available and preventing abuse and runaway costs through rate limiting and fair-use counters, using the least identifying methods we could find (a random ID, and counters on IP address and transaction identifier that expire within days).
• Consent — notifications and motion access, each of which you grant through an iOS prompt, and the separate website launch list when you choose to submit your email. You can withdraw at any time without losing the rest of the app.
• Legal obligation — where we are required to retain or disclose information by law.

10. International transfers

Cloudflare Workers run at edge locations worldwide, so an AI request or launch-list signup is typically handled near you; Anthropic processes AI request text on infrastructure in the United States, and launch-list notifications are delivered to a Google-hosted inbox. If you are in the EEA or the UK, this data may be transferred outside your region. These transfers rely on the providers' Standard Contractual Clauses and equivalent safeguards. App data described in section 2 never leaves your device.

11. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to withdraw consent, and to data portability. Here is how each one works in practice for an app with no cloud account system:

• Access and portability — app data is already in your possession, visible in the app. For a launch-list address, email us from that address and we can confirm the record we hold.
• Correction — you can edit or remove app profile details directly in the app; email us to correct a launch-list address.
• Deletion — deleting the app removes everything it stored. Email us from a launch-list address to have that record deleted. Our fair-use counters are keyed to a random ID, an IP address or a transaction identifier that we cannot link to you; most expire within days.
• Objection and restriction — you can avoid sending goal text by not requesting an AI plan. A paid Early Supporter check sends an Apple-signed purchase record with an authenticated random app ID. Apple can also send signed payment notifications directly. Eligible Plus members receive automatic weekly AI insights, and there is currently no separate in-app switch for them. Contact us to discuss an objection or restriction request.
• Withdrawing consent — turn off notifications or motion access in iOS Settings, or ask us to remove your launch-list email, at any time.
• Complaint — you may lodge a complaint with your local data protection authority. We would appreciate the chance to address it first.

Email support@nivolo.app to exercise any of these rights and we will respond within 30 days. For a launch-list request, write from the address you submitted so we can locate it safely.

12. California / US state rights

For California residents under the CCPA/CPRA, and residents of other US states with comparable laws: in the last twelve months we have collected the categories of identifiers (a voluntarily submitted launch-list email, a randomly generated app identifier, and an IP address held for short-lived rate limits), user content (the goal text you choose to submit to an AI feature), and commercial information (whether an Apple purchase is active, and — for Plus members using AI — Apple's signed subscription record, checked and then discarded). These are collected for the business purposes described in this policy and are not retained beyond the periods in section 8.

• We have not sold or shared personal information, and we do not use personal information for cross-context behavioral advertising. We do not knowingly sell the personal information of anyone under 16.
• We do not ask you to submit sensitive personal information. If you include sensitive details in an AI goal request, they are processed to generate the requested plan as described in section 3.
• You have the right to know, delete, and correct, and to not be discriminated against for exercising those rights. We offer no financial incentives for data.
• You may use an authorized agent to submit a request. Email us at the address below.

13. Children

Nivolo is a general-audience app and is not directed to children under 13 (or under 16 in the EEA and UK). We do not knowingly collect personal information from children. The birthday entered during onboarding is stored on the device solely to show a birthday theme and is never transmitted. If you believe a child submitted an email to the launch list or entered something into an AI feature that should be removed, email us and we will do what we can.

14. Security

• Your content lives inside the iOS app sandbox, protected by your device passcode and iOS file encryption.
• AI requests travel over TLS and are rate-limited per device and per network, so our server cannot be used as an open endpoint.
• Plus membership is confirmed on our server by checking Apple's cryptographic signature on your subscription record, so it cannot be faked by modifying the app.
• The key to our AI provider is held only on the server and is never shipped inside the app.
• There is no cloud account or password store. Launch-list addresses are kept in a separate, access-controlled Cloudflare store.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach ever affected data covered by this policy, we would post a notice on this page.

15. App Store privacy labels

Nivolo's App Store privacy label reports that data is not collected, or in the case of the optional AI features, that user content, identifiers and purchase information are not linked to your identity and are not used for tracking. This policy describes the same practices in full; if you ever spot a discrepancy between the two, please tell us and we will correct it.

16. This website

nivolo.app is hosted on Cloudflare. It sets no cookies and runs no analytics. The only form that stores personal information is the optional launch list: when you submit it, we keep the email address, submission time and the fact that it came from nivolo.app so we can send the one launch message.

Every file the site needs — fonts, scripts, images — is served from nivolo.app itself. There are no third-party CDNs, no externally hosted web fonts, and no embedded widgets, so visiting this site makes no request to any company other than our host.

As with any website, Cloudflare automatically processes technical connection data — your IP address, browser type and requested page — to serve the page and defend against abuse. The launch endpoint also uses a short per-IP rate limit to prevent automated spam; it does not add that IP address to the launch-list record.

17. Changes to this policy

We will update this page whenever our practices change, and always before shipping an app version that handles data differently. The "last updated" date at the top always reflects the current version. For material changes — anything that would newly send data off your device — we will also note the change inside the app.

18. Contact