Privacy Policy

1. Who is responsible

The controller of your personal data is the operator of Noli below. For anything about your data, write to Operator details will be published before public launch..

We are a small team and have not appointed a data protection officer, as we are not required to. Privacy questions go to the email above.

2. Data we process

• Account: your user ID, the email address and name you share through Sign in with Apple or Google (Apple may give us a relay email instead), sign-in tokens, language and the confirmation that you are 16 or older.
• Profile: username, display name, photo, bio, the interests you pick, who you follow and who you block.
• Content you share, import or upload: links you save, captions you paste, videos and images you post, comments, notes. To create a save we may process the video's caption, a transcript of its audio and public metadata (title, author, thumbnail) from official sources such as oEmbed. We don't download or keep other people's videos.
• Saves, Takeaways and Library: the recipes, workouts, tips and Takeaways generated for you, your categories, likes, saves and what you add to your Library.
• AI chat: the messages you send to the AI chat and its answers, so you can see your threads and plans later.
• Purchases: whether you have Noli Pro, which plan, its store, product ID and expiry, received from Apple or Google through RevenueCat. We never get your card or bank details.
• Instagram link: if you send Noli a video by Instagram direct message, your Instagram user ID and username, the shared message (link, caption or media reference) and a one-time link code (stored only as a hash). If you connect an account to import your own posts, an access token stored encrypted and never shown to the app.
• Reports and moderation: reports you make or receive, decisions, statements of reasons and appeals.
• Diagnostics (Sentry): crash and error reports with device model, OS and app version and technical logs. We filter out emails and tokens before sending.
• Product analytics (PostHog EU, only with consent): events such as "onboarding completed" or "takeaway saved", linked to your user ID, with non-personal properties like language or plan. No names, emails or message text. Session recording is off.
• Technical data: IP address and request data in server logs, used for security and rate limits.

3. Why we process it (legal bases)

Where we rely on legitimate interest, you can object (see your rights). Where we rely on consent, you can withdraw it any time in the app's settings; this doesn't affect processing before you withdrew it. We don't sell your data, show ads or use your content to train third-party AI models.

4. Who we share it with

We use these service providers. Processors act only on our instructions under a data processing agreement. Apple, Google and Meta act as independent controllers for their own services.

Content you make public is visible to other Noli users and to anyone with a share link. We may also disclose data to authorities when the law requires it.

5. Transfers outside the EU

We choose EU regions wherever a provider offers them. Some providers are based in the USA or may access data from there. In those cases we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses with additional safeguards. You can ask us for a copy of the relevant safeguards.

6. How long we keep it

• Account data and content: for as long as you have an account. You can delete single saves, notes or chats, or unlink Instagram, at any time.
• Raw inputs (captions, transcripts and Instagram messages used to create a save): deleted after 30 days. The finished save stays until you delete it.
• Account deletion: in the app (Settings → Account → Delete account). We delete your profile, content, saves, chats, videos and files, Instagram link and tokens, revoke Sign in with Apple, and ask RevenueCat and PostHog to delete your data. Everything is erased within 30 days. Encrypted backups rotate out on their normal schedule and are not restored except for disaster recovery.
• Diagnostics and logs: kept for a short period (typically up to 90 days).
• Moderation records and data we must keep by law (for example for authorities or legal claims): only as long as required.
• Purchase records are kept by Apple and Google under their own policies.

7. Your rights

Under the GDPR you have the right to:

• access your data and get a copy;
• rectify wrong data (most of it you can edit in the app);
• erasure ("right to be forgotten"), including by deleting your account in the app;
• restrict processing in certain cases;
• data portability: get the data you gave us in a machine-readable format (JSON);
• object to processing based on legitimate interest;
• withdraw consent at any time, for example to analytics in the app's settings;
• complain to a supervisory authority. In Slovakia that is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR). You can also complain in the EU country where you live or work.

To use your rights, email Operator details will be published before public launch. from the email linked to your account, or tell us your username. We reply within one month and may ask you to confirm your identity. It's free.

8. Age limit (16+)

Noli is for people aged 16 and over. We ask you to confirm your age when you sign up. If we learn we hold data of someone under 16, we delete the account. Parents can contact us at the privacy email above.

9. AI and automated processing

• AI models create Takeaways, saves, transcripts and categories, and answer chat messages. The AI treats video content as data, not instructions, and its output is only text shown to you.
• New content is automatically pre-screened for rule violations. When the result is uncertain, a person reviews it. Appeals are always handled by a person.
• The "For you" feed is personalised based on your interests and activity (see how our feeds work). "Following" is not.
• We don't make decisions about you based solely on automated processing that have legal or similarly significant effects (GDPR Art. 22).

10. Cookies on this website

This website uses only what is strictly necessary to work and to keep it secure. It sets no analytics, advertising or tracking cookies and loads no third-party trackers, so there is no cookie banner. Our hosting provider processes your IP address to deliver pages and protect against attacks. If we ever add optional cookies, we will ask first.

11. Security

We use encryption in transit (HTTPS) and at rest, access controls on every database table so users only see what they are allowed to, encrypted storage for third-party tokens, signed video links and minimal staff access. No system is perfectly secure; if a breach puts your rights at high risk, we will tell you and the authority as the law requires.

12. Changes to this policy

We will update this policy when our processing changes. For important changes we will tell you in the app or by email before they apply. The date at the top shows the latest version.

13. Contact

Privacy questions and requests: Operator details will be published before public launch.. See also our Terms of Use and Imprint.

This document is provided in English; translations may follow.