1. Who we are, and who this applies to
Nolies ("we," "us," "our") operates the Nolies app and website — anonymous messaging, reels, social cards, and a coin economy for premium features. Nolies is for people 18 and older, and we don't knowingly collect data from anyone younger. This policy explains what we collect across all of it, why, who we share it with, and your rights over it.
2. Information we collect
What you give us directly:
- Account info: username, email, password (hashed, never stored in plain text)
- Profile info: display name, avatar, and bio
- Content: messages you send or receive, reels, comments, and social cards you create
- Photos and audio you upload or record
- Payment info for coin and premium purchases, processed by Apple/Google's in-app purchase systems — we never see or store your card details
- Anything you send us directly: support requests, feedback, appeals
What we collect automatically:
- Device info (model, OS version, a device identifier) and IP address — used for security, abuse prevention, and to enforce bans (see Section 6)
- Approximate location derived from IP (country/city level) for anonymous messages — never precise GPS
- App usage and crash data, via Google Analytics for Firebase and Crashlytics
- App events such as install, app open, sign-up, and purchase, sent to Google and Meta to measure our own ad campaigns (see Section 4a)
- Your device's advertising identifier (Android Advertising ID or, on iOS, IDFA) — only as described in Section 4a
- A push-notification token, if you enable notifications
What we deliberately do not collect or keep:
- Government ID or identity documents of any kind.
- Precise GPS location, ever.
- Payment card numbers — Apple and Google handle that entirely.
3. How we use it
- Run the app: deliver messages, load your feed, process purchases
- Keep it safe: automated scam/spam/harassment detection, device and IP-based ban enforcement, fraud prevention
- Improve the product: aggregated usage analytics
- Measure our advertising: see which of our ads on Google and Meta lead to installs, sign-ups, and purchases (Section 4a)
- Talk to you: respond to support requests, send service notifications (such as new messages and replies)
- Meet our legal obligations: respond to lawful requests, report child exploitation material to NCMEC as required by law
We never share the content of your messages with advertisers, and we do not sell your personal information.
4. Who we share it with
We use a small, named set of service providers to run Nolies — we don't sell your data, and we don't share it beyond what's needed to operate these services:
- Firebase (Google): push notifications, crash reporting, and analytics (Google Analytics for Firebase)
- Google AdMob: shows ads in the app (unless you've gone ad-free)
- Google Ads: measures the performance of our own ads on Google, using the app events described in Section 4a
- Meta Platforms (Facebook/Instagram): measures the performance of our own ads on Facebook and Instagram via the Meta SDK, using the app events described in Section 4a
- Apple / Google: process in-app purchases; we receive confirmation of a purchase, never your card details
Beyond these, we share information only when legally required (a valid court order, or to report child exploitation to NCMEC), or with your explicit consent.
4a. Advertising, measurement, and your choices
We advertise Nolies on Google and on Meta's apps (Facebook and Instagram). To know whether those ads work, the app sends a small set of events — install/app open, sign-up, completed tutorial, purchases and coin spends (with value and currency), shares, messages sent or received, and card exports — to Google Analytics for Firebase and to Meta's App Events SDK, along with basic device info and, where permitted, your advertising identifier. These events never include the content of your messages, your email address, or your username; they may include our own internal numeric account ID so that the same person is not counted twice.
- In the EEA, UK, and Switzerland, you're asked for consent when you first open the app. If you don't consent, nothing is sent to Meta, and Google receives no advertising or personalization signals. You can change your choice at any time in Settings › Privacy options.
- On iOS, your advertising identifier (IDFA) is used only if you allow tracking in Apple's App Tracking Transparency prompt. If you don't, Google and Meta can still measure ad results in aggregate through Apple's privacy-preserving SKAdNetwork, without identifying you.
- On Android, you can reset or delete your advertising ID at any time in your device's Settings › Privacy › Ads.
How Google and Meta handle this data is covered by their own policies: How Google uses information from apps that use its services and Meta Privacy Policy.
5. Data security
Passwords are hashed with bcrypt. Sensitive on-device data (like your Private Vault, if you use it) is encrypted locally. We apply standard technical and access-control safeguards across our systems. No method of transmission or storage is 100% secure, and we won't claim otherwise — if anything relevant to your account is affected by a security incident, we'll notify you.
6. Device and IP data — why we keep it, specifically
Unlike most of what's in this policy, device identifiers and IP addresses aren't collected to serve you better content — they exist so that a banned account can't just create a new one on the same phone. This is the mechanism behind our device-ban enforcement, and it's why removing this data isn't offered as a standalone opt-out the way marketing analytics might be.
7. Data retention
- Account and content data: kept while your account is active
- Device/IP abuse-prevention records: retained after account deletion specifically to keep a ban effective — see Section 9
- Deleted-account data: purged or anonymized within 30 days of a confirmed deletion request, except what Section 9 covers
8. Your rights
Depending on where you live (including under GDPR and CCPA), you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Delete your account and associated data
- Export your data
- Withdraw consent for advertising measurement (Section 4a)
- Opt out of non-essential communications
9. Deleting your account
Request deletion from Settings in the app, or by emailing privacy@nolies.xyz. We'll purge or anonymize your account, profile, messages, and uploaded content. Two narrow exceptions: content already reported for review may be retained briefly to complete that review, and the device/IP records described in Section 6 are kept specifically so a ban survives account deletion, consistent with the safety purpose they exist for in the first place.
10. Children
Nolies is not for anyone under 18. Every account must confirm they're 18 or older at sign-up. If we learn that an account belongs to someone under 18, we delete it along with its data. If you believe a minor is using Nolies, email safety@nolies.xyz.
11. Cookies (website)
Our website uses essential cookies to keep you logged into the admin/dashboard areas, and analytics cookies to understand site usage. You can control cookies through your browser settings.
12. Changes to this policy
We'll update the "Last updated" date above and, for material changes, notify you in-app before they take effect.
13. Contact us
Privacy questions or requests: privacy@nolies.xyz
Safety concerns: safety@nolies.xyz