Privacy policy
This policy explains what personal data Nonyere collects, why, who helps us process it, how long we keep it, and the rights you have. It describes how the app actually works today.
In short. We collect what we need to run your account, show your moments to the people you choose, and keep Nonyere safe. We don't show ads and we don't sell or share your data for advertising. Photos and clips have their location data removed before they leave your phone. Enclaves are private to their members, but they are not end-to-end encrypted: our safety staff can review content when it's reported or when the law requires it.
Who we are
Nonyere is run by Ikeniile Nexus Ltd, a company registered in Ireland (number 820515), whose registered address is 77 Lower Camden Street, Dublin, Ireland. We are the "controller" of your personal data under the EU General Data Protection Regulation (GDPR).
For anything about your data, write to [email protected], or use Settings › Privacy & data in the app.
What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Your email address | To sign you in with a one-time code and to contact you about your account. There are no passwords. | Contract |
| Your name, username, bio and interests | Your profile, which people you connect with can see. Interests help Discover suggest spaces and Home show posts on topics you chose; they never rank people. | Contract |
| Confirmation that you are 16 or older | To keep Nonyere for adults and older teens. We record that you confirmed, not your date of birth. | Legal obligation; contract |
| Photos, clips (and their sound) and text you share, with captions, corrections and comments | To show them to the people and Enclaves you chose, and nobody else. | Contract |
| Capture records: when the capture session started, a fingerprint (SHA-256) of the file, its format and size | To show an honest label about how a photo or clip was made. | Contract; legitimate interest in preventing misleading media |
| Connections, Enclave memberships and roles, subscriptions, blocks and mutes | To decide who can see what, and to keep blocked people away from you. | Contract |
| Private acknowledgements you send | So the person who posted can see them. There are no public totals. | Contract |
| Devices and sessions: the kind of phone, app version, when you signed in and were last active, and the network address of each sign-in | To keep your account secure and let you sign out lost devices (Settings › Account › Sessions & devices). | Legitimate interest in account security |
| A notification token, only if you turn notifications on | To deliver notifications to your phone. | Consent (you turn them on) |
| Reports, appeals and moderation decisions | To review reports, act under our community guidelines, and handle appeals. | Legitimate interest in a safe service; legal obligation |
| Crash reports and two start-up timings | To find and fix faults. They carry no name, email, user id or network address, and text is removed from them. | Legitimate interest in a working app |
| Usage statistics, only if you turn them on | A fixed list of events (for example "finished sign-up") with a random id, to understand whether Nonyere is useful. Never your posts, names or email. | Consent |
| Privacy requests and support messages | To answer you and to show we did. | Legal obligation; legitimate interest |
What we don't collect: your location (removed from photos and clips before upload), your contacts, your phone number, your photo library (Nonyere can't open it), payment details (nothing on Nonyere costs money today), or identity documents.
Permissions on your phone: the camera, when you first take a photo or clip; the microphone, only for sound in clips (you can record without sound); and notifications, only if you turn them on in Settings.
Who can see what
- Your posts go only to the audience you chose: your connections, one or more Enclaves, or both. Nothing on Nonyere is public, except Broadcast channels that have been approved to publish.
- Enclaves are visible only to their members. A listed Enclave shows its name, description and topic in Discover; a hidden one shows nothing to non-members.
- Media links are created fresh for each viewer after checking they're allowed to see the post, and stop working after about a minute.
- Your profile can be found by people who know your exact username, but only if you turn that on.
- Nonyere staff who handle safety can see reported content and the case around it. Every time a staff member opens a case, a queue or a request, it is recorded. Enclaves are not end-to-end encrypted, so we can technically read their content; we only look when there's a report, a legal requirement or a security need.
Automated checks
We check new posts and comments automatically for obvious spam (for example many links, or the same text posted again and again) and refuse them before they're shared. Other automated checks only flag content for a person to review. No automated system suspends or restricts your account; a person makes every such decision, and you can appeal it.
Home orders posts from people and spaces you chose, using how recently they were posted, your own recent interactions with the person, and the topics you picked. It never uses other people's reactions, comment counts, watch time or anything you haven't chosen.
Who helps us
We use these service providers ("processors"). They handle data only on our instructions, to provide their service to us.
| Provider | What it does for us | Data it handles | Where |
|---|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | Everything the app stores | Ireland (EU) |
| Resend | Sends sign-in codes by email | Your email address and the code | EU sending region |
| Google Firebase Cloud Messaging | Delivers notifications to Android and iPhone | The notification token and the notification text, which by default is only "New activity on Nonyere" | Google's global network |
| Sentry | Crash and fault reports | Crash details with personal data removed | Frankfurt (EU) |
| PostHog | Usage statistics, only if you turn them on | Listed events with a random id | EU |
| Cloudflare | Hosts this website and forwards email to our support address | Your network address when you visit this site; messages you send us | Global network |
Some of these companies are based in the United States. Where personal data may be accessed from outside the European Economic Area, we rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses, under each provider's data processing terms.
If you turn on notification previews, the notification text names the person or space involved (for example "Ada would like to connect"). With previews off, which is the default, it says only "New activity on Nonyere".
We may also share data when the law requires it, for example with the police under a valid legal order, or to report child sexual abuse material to the appropriate authorities.
How long we keep data
| Data | Kept for |
|---|---|
| Your account, profile, posts, comments, photos and clips | Until you delete them or your account |
| A post or comment you withdraw (within 15 minutes of sharing) | Hidden from everyone else at once; deleted with your account |
| Uploads you start but never share | Deleted automatically within a few hours |
| Notifications | 90 days |
| Rate-limit counters (used to slow down abuse) | 7 days |
| Security and moderation history that no longer names anyone, after an account is deleted | 2 years, except records of staff actions |
| Reports, moderation cases, decisions and appeals | Kept while we take legal advice on the right period; we'll publish it here. After you delete your account they are no longer linked to you. |
| A protected copy of content reported for child safety | While the case needs it, then 30 days after our staff release it |
| A record that you asked for deletion and that we did it | Kept to show we honoured the request; it holds a one-way code, not your id |
| Crash reports | Deleted automatically by our crash-reporting provider after its retention period |
Backups: our hosting plan currently has no scheduled database backups, so deleted data isn't kept in backup copies. If we move to a plan with daily backups, they expire after 7 days, and we'll update this policy.
Your rights
You have these rights under the GDPR. Most of them work directly in the app.
| Right | How |
|---|---|
| See and get a copy of your data | Settings › Privacy & data › Download a copy of my data gives you everything as a file you can keep or take elsewhere. |
| Correct your data | Edit your profile in the app. For anything else, Settings › Privacy & data › Ask for a correction or raise an objection. |
| Delete your data | Settings › Session › Delete account. See how deletion works. |
| Object or ask us to limit how we use your data | Settings › Privacy & data › Ask for a correction or raise an objection, or email us. |
| Withdraw consent | Turn off usage statistics or notifications in Settings at any time. |
| Complain | To your local data protection authority. In Ireland that is the Data Protection Commission (dataprotection.ie). |
We answer privacy requests within one month. If you write to us by email, write from the address on your Nonyere account; we may ask you to confirm the request from that address before we act on it.
Age
Nonyere is for people aged 16 and over. When you sign up, you confirm you are 16 or older. If we learn that someone younger has an account, we delete it.
Security
- All traffic between the app and our servers is encrypted (HTTPS only).
- Photos and clips are stored privately; each viewer gets a link that works for about a minute.
- Who can see each post is checked by our servers on every request, never by the app alone.
- Staff access is limited by role, recorded, and can require a second sign-in step.
Found a security problem? Tell us at [email protected].
This website
This website uses no cookies, no analytics and no tracking, and loads nothing from other companies. Our host, Cloudflare, processes your network address to deliver the pages and protect the site.
Changes to this policy
If we change this policy in a way that matters, we'll tell you in the app before the change takes effect. The date at the top shows the latest version.