Privacy Policy

This Privacy Policy explains how [Company legal name] ("Nibl", "we", "us") handles information when you use the Nibl mobile app and the niblapp.com website (together, the "Service"). By using the Service you agree to this policy and to our Terms of Service.

The short version

What we collect

Account information

• Username and password. If you sign up with a username, we store your username and a securely hashed password (we never see or store your password in plain text).
• Email address or mobile number. When you create an account with a username, we ask for your email address or your mobile number and send a 6-digit code to confirm it's yours. Only you can see them; they're never shown on your profile. We use your email to send password-reset links and other messages about your account, and to let you sign in with your email instead of your username. We use your mobile number to text you a code if you forget your password. You can add or change both in Settings → Email & phone.
• Verification and reset codes. The 6-digit codes we send by email or text are stored only in hashed form, expire after 10 minutes and can be tried a limited number of times. We also record when codes, sign-ins with an email address and password-reset requests were made (and, for some, the IP address they came from) so we can limit abuse.
• Sign in with Apple or Google. If you use one of these, we receive the information the provider shares with us: an account identifier, your email address (with Apple, this may be a private relay address), and with Apple, your name if you choose to share it, which we use as your display name. We never receive your Apple or Google password.

Profile information

• Your username, display name, bio and profile photo (all optional except the username).
• Your settings: whether your account is private, your notification preferences, your weekly cooking goal, and your time zone (the app records your device's time zone so weekly streaks reset on your Monday).

Answers you give during onboarding and in Settings

• Cuisines and kinds of dishes you like, your cooking experience level, any dietary preferences, and any allergies or intolerances you choose to tell us about.
• How you heard about Nibl.

Dietary restrictions and allergies can be sensitive. They're optional, they are only visible to you, and we use them only to tailor what Nibl shows you (for example, to keep recipes with a listed allergen out of your suggestions). Earlier test versions of the app asked for a date of birth; the current app doesn't, and any birth date stored from those versions is only visible to you.

Content you post

• Dishes: photos, title, notes, the people you tag, and when you posted.
• Recipes: title, ingredients, steps, times, servings, difficulty, nutrition, tags, cover and step photos, and, for imported recipes, the source link and attribution.
• Custom tags: if you create a new tag for a recipe, the tag's name is added to Nibl's shared list of tags, which everyone can see and use. We keep a private record of who created it (to limit how many tags each person can add), which is deleted with your account; the tag name itself stays.
• Ratings and rankings: the bucket you pick for each dish ("Loved it", "It was okay", "Didn't like it"), your answers to the head-to-head comparisons, your personal ranked list and the 0–10 scores derived from it.
• Comments on dishes and recipes, and replies.
• Reports you submit about content or accounts, including the reason and any details you add.

Safety and moderation records

• The result of the automated safety check on each photo you upload (approved, pending or rejected).
• Reports other people make about you or your content, how we reviewed them, and any action we took, such as removing content or suspending your account (and when).

Activity on Nibl

• Who you follow and who follows you (including pending follow requests), and accounts you've blocked.
• Likes, saves, and celebrations of friends' milestones.
• Notifications we generate for you (for example, "maya liked your dish") and whether you've read them.
• Records we keep to prevent abuse, such as when you last looked up contacts or imported a recipe, so we can apply rate limits.

Device information

• Push notification token. If you allow notifications, we store your device's push token and platform (iOS or Android) so we can send you notifications.
• Technical logs. Like any online service, our hosting provider records technical information when the app talks to our servers, such as IP address, request time and error details. We use these logs to keep Nibl running and secure.
• Stored on your phone only. The app keeps some things on your device and doesn't send them to us: an unsent dish or recipe draft, dishes waiting to upload when you're offline, your onboarding progress, and small preferences (like whether you've seen the tutorial).

Permissions the app asks for

The app only asks when you use the feature, and you can say no or change your mind in your phone's settings.

• Camera and photo library: to take or choose photos of your dishes, recipes and profile, and to save share cards to your photos if you ask it to. Only the photos you pick are uploaded.
• Contacts: only if you use "Find friends from contacts" (see below).
• Notifications: to send you push notifications.

Nibl doesn't use your location.

How we use it

• To run Nibl: create your account, show your profile, publish your dishes and recipes, calculate your ranking and scores, build your feed, show recipe averages, keep your streak, and send the notifications you've turned on.
• To personalise what you see: Discover suggests recipes and people using your cuisines, dietary preferences, saved recipes and who you follow. Most of this ordering happens on your phone.
• To keep Nibl safe: check photos for inappropriate content before anyone else can see them, block objectionable text, review reports, remove content, suspend accounts that break our Terms, and apply rate limits.
• To support you: answer your emails and handle requests about your data.
• To meet legal obligations and enforce our Terms.

We don't use your information for advertising, and we don't use your content to train AI models. If you're in the EEA or UK, our legal bases are: performing our contract with you (running the Service), our legitimate interests (safety, security, improving Nibl), your consent (contacts, notifications, optional profile details, which you can withdraw at any time), and legal obligations.

Who can see what

Nibl is a social app, so much of what you post is meant to be seen. Here's who sees it:

If you block someone, neither of you can see the other's dishes, recipes or comments, and any follows between you are removed. Nibl administrators can see reported content and the information needed to review it.

When you share a dish, recipe or profile from the app, you choose where it goes (Messages, Instagram, etc.), and what you share is then subject to that app's privacy practices.

Service providers

We use a small number of companies to run Nibl. They process information on our behalf, under contracts that limit what they can do with it.

• Supabase (database, sign-in, file storage and server functions). Everything you store in Nibl lives here.
• OpenAI (photo safety checks). Before a photo is visible to anyone else, our server sends it to OpenAI's moderation service through a link that expires within minutes, to check for things like nudity or violence. Only the photo is sent, not your name or account details. Under OpenAI's API terms, data sent this way isn't used to train their models.
• Anthropic (recipe import). When you paste a recipe link, our server fetches that web page. If the page doesn't describe the recipe in a standard format, we send the page's text to Anthropic's Claude model to pull out the ingredients, times and servings. We send the page content, not your account details. Under Anthropic's commercial terms, this data isn't used to train their models.
• Expo, Apple and Google (push notifications). To deliver a notification we send your push token and the notification text (for example, "maya liked your dish") through Expo's push service to Apple Push Notification service or Google's Firebase Cloud Messaging.
• Resend (email). To send your sign-up code or a password-reset link, we send your email address and the message through Resend.
• Twilio (text messages). To text you a sign-up code or a password-reset code, we send your mobile number and the message through Twilio.
• Apple and Google sign-in, if you choose them, as described above.
• Vercel hosts this website. Like any web host, it processes visitors' IP addresses to serve pages. This website has no cookies, analytics or trackers.

We may also disclose information if required by law, to protect the safety of people using Nibl or the public, or as part of a merger, acquisition or sale of assets (in which case we'll tell you before your information becomes subject to a different privacy policy).

Finding friends from contacts

"Find friends from contacts" is optional, and we explain it in the app before your phone asks for permission.

• On your phone, the app reads the email addresses in your contacts, tidies them (lowercase, no spaces) and turns each into a one-way SHA-256 hash.
• Only those hashes are sent to our server. The server compares them with hashes of Nibl members' sign-in email addresses and returns the members who match. The hashes you send are not stored. We only keep a record of when you looked up contacts and how many, so we can limit how often it's used.
• Contact names and phone numbers never leave your phone. The app uses them to show who you could invite, and if you tap Invite, it opens Messages or your email app with a pre-written invitation that you send yourself.
• Your contacts' email addresses are never uploaded, and we don't contact your contacts.

Because other members can do the same, someone who has your sign-in email address in their contacts can find your Nibl account this way. The email you gave us at sign-up (or in Settings) is matched too. Phone numbers aren't used for matching.

No ads, no tracking, no selling

• Nibl shows no ads and contains no advertising or analytics SDKs.
• We don't track you across apps or websites owned by other companies, and we don't use your device's advertising identifier.
• We don't sell your personal information, and we don't "share" it for cross-context behavioral advertising (as those terms are used in California law).

How long we keep it

• Your account and content: for as long as your account exists. Things you delete in the app (a dish, a comment, a like, a save) are removed from the database straight away.
• Photos: photos that fail our safety check are deleted. When you replace a dish's photos or delete a dish, the old files can remain in our storage, unreadable by others, until your account is deleted.
• Recipe imports: the facts we extract from a recipe page (title, ingredients, times, servings, source and attribution) are cached by link so the next person to import it gets it straight away. That cache isn't linked to you.
• Rate-limit records (contact lookups, recipe imports, custom tags) are deleted with your account.
• Verification codes and sign-in / reset request records: codes stop working after 10 minutes. The records of when codes and requests were made, including IP addresses, are kept for up to [code and request log retention period].
• Server logs are kept by our hosting provider for a limited period ([log retention period]).
• Legal holds: if the law requires us to keep specific information (for example, to answer a valid legal request, or after reporting child sexual abuse material to NCMEC), we keep it only as long as required.
• Backups: deleted data can remain in encrypted backups for up to [backup retention period] before it's overwritten.

Deleting your account

You can delete your account at any time in the app: Profile → Settings → Delete account. If you can't use the app, see niblapp.com/delete-account. Deletion is immediate and permanent. It removes your account, profile, dishes, recipes, photos, comments, likes, saves, rankings, follows, notifications and push tokens.

One exception: if other people have posted their own dishes of one of your recipes, each of them keeps a copy of that recipe (its title, ingredients, steps, tags and times, without your photos) so their dishes don't disappear. Those copies belong to them. Reports other people made about your content may be kept for safety and legal purposes. See Delete your account for the details.

Your choices and rights

• Edit your profile, food preferences and notification settings in the app at any time.
• Make your account private in Settings, so only followers you approve see your dishes, recipes, scores and saves.
• Turn off contacts, camera, photos or notification access in your phone's settings.
• Delete anything you've posted, or your whole account.
• Ask us for a copy of your information, to correct it, or to delete it, by emailing support@niblapp.com. We'll need to confirm the account is yours.

Depending on where you live (for example the EEA, the UK, California and other US states), you may have additional rights: to access, correct, delete or port your information, to object to or restrict certain uses, and to withdraw consent. You also have the right not to be treated differently for using these rights, and the right to complain to your local data protection authority. Email us to use any of them; we'll answer within the time the law requires (usually 30 days).

Children

Nibl is not for children. You must be at least 13 years old to use it (and older where your country requires it). We don't knowingly collect information from children under 13. If you believe a child under 13 has an account, email support@niblapp.com and we'll delete it. See our Child Safety Standards for how we prevent and respond to child exploitation.

Security

We protect your information with encryption in transit (HTTPS), hashed passwords, private photo storage that only signed-in people with permission can read through short-lived links, and database rules that enforce who can see what on the server, not just in the app. No system is perfectly secure, so please use a strong, unique password. If we learn of a breach that affects you, we'll notify you as the law requires.

Where your data is stored

Nibl's data is stored in [data region, e.g. the United States]. If you use Nibl from elsewhere, your information will be transferred to and processed there, and our providers may process it in other countries. Where the law requires, we rely on safeguards such as the European Commission's Standard Contractual Clauses for these transfers.

Changes to this policy

We'll update this page when our practices change and change the "Last updated" date above. If a change is significant, we'll tell you in the app before it takes effect.

Contact us

Questions or requests: support@niblapp.com
[Company legal name], [Company mailing address]