Your rights & your data

Privacy Policy

Last updated: 2026-11-07. This policy covers the nofeed website and app. The website provides product information, guides and links to the app store.

Who is responsible

Operator legal name: [DOĞRULANMADI]. Registered address: [DOĞRULANMADI]. Contact: privacy@nofeed.app.

Your social accounts stay separate

Social websites load directly in an on-device WKWebView or Android WebView. We never collect, store or transmit your social-media usernames, passwords, session cookies, two-factor codes, messages, comments, search terms or feed content to our servers or analytics providers. Filtering hides interface elements locally. Social services still receive your connection and activity directly, under their own terms and privacy policies.

Website data

This static website has no registration or email-collection form and does not connect to an app account database. Optional website analytics are described below. If you choose to email support or request data deletion, we use the contact information and details you send only to handle that request. Vercel and network providers process connection data to deliver the site and may retain operational logs under their own policies.

App data

• Supabase: account email or sign-in provider identifier, synced filter preferences, rule versions and referral records if you enable those features. Social account data is excluded.
• RevenueCat: a pseudonymous app customer identifier, subscription entitlements, product and transaction records, trial and renewal status. Apple or Google processes store payments. We do not receive full payment-card details.
• PostHog: optional anonymous aggregate app events, such as onboarding completion or a filter setting change. No social URLs, account identifiers, content or free text. Device usage statistics otherwise stay on device. No social-webview session replay, screen recording or keystroke recording.
• Sentry: app crash diagnostics, stack traces and limited app/OS context, with sensitive payloads, social URLs and content excluded. This website does not initialize Sentry or RevenueCat.

Analytics and browser storage

Website analytics are declined by default. Before permission, the PostHog SDK is not loaded and no analytics events or feature-flag requests are sent. After permission, it sends an explicit page-category event with a temporary in-memory identifier. URLs, query strings, referrers and form values are excluded. Cookieless fallback is configured, but a declined or withdrawn choice stops collection entirely. No replay, autocapture or advertising pixels are enabled. The browser stores only your analytics preference for this site; use “Analytics preferences” in the footer to change it. Do Not Track and Global Privacy Control are treated as a decline.

Device permissions

Optional iOS Screen Time permissions are intended to shield selected native apps using system-managed tokens. An optional Android Accessibility guard detects short-video UI identifiers and acts locally; it must not record or transmit screen text or keyboard input. Neither permission authorizes collection of social content. You can revoke permissions in system settings.

Purposes, rights and legal grounds

We use consent for optional analytics; contract necessity for requested accounts, sync and subscription access; and legitimate interests for narrowly scoped security and abuse prevention, subject to applicable law. Where required, billing records are retained for legal obligations. You may request access, correction, export, restriction, objection or deletion and withdraw consent without affecting earlier lawful processing. We do not sell personal information, use it for targeted advertising, or make automated decisions with legal or similarly significant effects.

Retention and security

Support correspondence is retained only as needed to resolve requests and meet applicable legal obligations. App account data is kept while needed to provide the account, then removed on a verified request unless retention is legally required. Provider backups and legally required store transaction records may outlast deletion from active systems. Exact provider regions, backup lifetimes and diagnostic retention periods are [DOĞRULANMADI] and require operator confirmation. Server-side secrets, database access restrictions and minimal payloads reduce exposure; no system can guarantee absolute security.

International transfers and children

Our infrastructure providers may process data outside your country. Applicable transfer safeguards, provider regions and any representative details require operator confirmation. The service is intended for people able to consent under local law, not children below the applicable digital-consent age. Contact us if a child has provided data so we can investigate and remove it where required.

Requests and changes

Follow data deletion instructions or contact the privacy address above. We may request proportionate account verification; never send a social password or identity document unless a separately justified secure process has been agreed. You may complain to your local data-protection authority. Material changes will be described here and, where required, notified before they take effect.

Provider references, accessed 2026-11-07: Supabase, RevenueCat, PostHog, Sentry, Vercel. Implementation details are our design commitments, not provider guarantees.