Who is responsible for your data
Nuglet is responsible for the personal data described in this policy and acts as its controller. You can contact us about privacy or exercise your rights using the address at the end of this policy.
What we collect
The information we handle depends on how you use Nuglet.
We do not ask you to send payment card details to Nuglet support. Payment details are handled by the payment provider or app store you use.
- Account and profile data, such as your email address, handle, account identifiers, language, and sign-in information.
- Learning activity, such as Nuglets viewed or completed, Shelf contents, quiz and practice activity, review activity, and preferences.
- Subscription and entitlement data, such as product, purchase platform, status, renewal state, and transaction identifiers. Full card details are handled by Stripe, Apple, or Google.
- Technical and security data, such as browser or device type, operating system, IP address, app version, diagnostic events, and security logs.
- Analytics and cookie data where permitted. On the web, optional product analytics are used only after your consent.
- Messages and information you provide when you contact support, request account deletion, or respond to a survey.
Why we use it and our legal bases
We use personal data only when we have a reason permitted by applicable law.
The legal basis depends on the data and context.
- Contract: to create and secure your account, provide lessons and Shelf access, manage subscriptions, and answer service requests.
- Legitimate interests: to keep Nuglet reliable and secure, prevent abuse, understand service performance, and improve the product without overriding your rights.
- Consent: for optional analytics, cookies, or communications where consent is required. You can withdraw consent at any time.
- Legal obligations: to keep records, respond to lawful requests, and meet tax, accounting, consumer, or security requirements.
Service providers and recipients
We use service providers to run Nuglet. These currently include Supabase for account and database services, Vercel for web hosting, Cloudflare for media delivery, Stripe for web billing, RevenueCat for subscription entitlement handling, Apple and Google for app-store purchases, Resend for service email, PostHog for product analytics, and Sentry for error monitoring. They process data under their own terms and our instructions where applicable. We may also disclose data when required by law, to protect users or the service, or as part of a business reorganisation with appropriate safeguards.
International data transfers
Some providers may process personal data outside your country. When data protection law requires it, we rely on an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism. You may contact us for more information about safeguards relevant to your data.
How long we keep data
Account, learning, and Shelf data are kept while your account remains open so the service and completed-content access can work. When you delete your account, we delete or de-identify associated service data, except for records we must keep for legal, accounting, fraud-prevention, dispute, or security purposes. Those limited records are kept only for the period required for that purpose. Copies may remain in protected backups until the normal backup cycle completes.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, object to, or receive a portable copy of your personal data. You may withdraw consent without affecting earlier lawful processing. You may also complain to the data protection authority where you live, work, or believe a violation occurred. Contact us to make a request. We may need to verify your identity first.
Account deletion
You can start account deletion from Account in the Nuglet app or website. If you cannot sign in, email us from the address connected to your account. Deleting your Nuglet account does not cancel an Apple or Google Play subscription, which must be cancelled with that store.
How we protect data
We use technical and organisational measures designed to protect personal data, including access controls and encrypted connections. No online service can guarantee absolute security. Please use a strong password, keep sign-in details private, and contact us if you suspect unauthorised account use.
Children
Nuglet is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has provided personal data, contact us so we can investigate and delete it where appropriate.
Changes to this policy
We may update this policy as Nuglet or the law changes. We will update the date on this page and provide additional notice when a change materially affects your rights or how we use personal data.
Contact us
Contact us with privacy questions, rights requests, or complaints. Please do not include your password or payment card details.
support@nuglet.app