Privacy Policy

1. The short version

• The apps have no advertising or behaviour analytics SDK. They do not build an advertising profile. An optional, scrubbed crash report is sent only after you choose to send it. The marketing website separately uses cookieless Vercel Web Analytics, described below.
• On-device mode keeps chats on your Mac. What you type and show the pet is processed locally. Model downloads and update checks still make ordinary network requests.
• Bring-your-own-key mode talks straight to your provider. Your requests go directly from your device to the AI provider you chose. We never see them.
• Managed AI uses our cloud service. Messages pass through without being logged or stored, while account, entitlement, device-security, purchase, and usage records are stored as described in section 6.
• The iOS app automatically creates an anonymous cloud account so its trial, Sparks, StoreKit subscription, and device entitlement can work. You can delete that account in Settings.
• Your pet state and history stay on your device unless a feature explicitly says it syncs or sends content.
• Mac screen awareness is off by default and only active if you turn it on.

2. Who we are & how to contact us

Nibbii is made and operated by Ashneil Lanelle, a UK-based sole trader ("Nibbii", "we", "us", "our"). For anything in this policy, including privacy requests, email hello@nibbii.pet, or write to us at 315 Wilmslow Road, Manchester M14 6XS, United Kingdom.

For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), we are the "controller" of the limited personal data described in the "What our servers handle" section. In on-device and bring-your-own-key modes, your data stays on your device or goes to a provider you chose, and we do not receive or control it.

3. The three AI modes and what leaves your Mac in each

Nibbii's chat is powered by real AI, and you choose the "brain". The mode you pick decides what, if anything, leaves your computer.

(a) On-device

The AI runs entirely on your Mac (Apple Silicon required). Chat, any screen "glances", and the pet's background memory all happen locally. Nothing you type or show it leaves your device. A few background requests still go out: the AI model files download from Hugging Face (that request carries the public name of the model and, as with any download, your IP address, with no account attached), and the app checks updates.nibbii.pet for a new version about once a day. If you switch them on, optional local weather and now-playing album art are fetched too. Section 8 lists who receives what.

(b) Bring your own key

You supply your own API key for a provider you choose and configure, for example Venice AI, Anthropic, or any OpenAI-compatible endpoint. Your requests go directly from your Mac to that provider, over an encrypted connection, authenticated with your key. Nibbii's servers are not involved and we never see the contents. What you send and how the provider handles it is governed by your agreement with that provider (see "Your own AI provider").

Note: only the Venice provider is used for optional screen "glances" and the pet's background memory reflection. If you select Anthropic or a custom endpoint, only chat text is sent, and screenshots are never sent to them.

(c) Managed AI plan (optional, paid)

If you'd rather not manage a key, you can subscribe to our Managed AI plan. Your chat messages (and, only if you turn on screen glances, an occasional screenshot) are sent to our backend at api.nibbii.pet, which forwards them to Venice AI on your behalf using our key. Your message and image contents pass through our server in memory only. They are never written to a log or a database. We record only the number of tokens used, so we can meter your plan. See "What our servers handle" for the full detail.

4. Data stored on your Mac

Almost everything Nibbii knows about you lives on your own computer, under ~/Library/Application Support/NotchPal/, in files readable only by your macOS user account. This includes:

• Your pet's memory ("facts"): things you tell it (your name, projects, preferences, and so on), capped at 200 facts. You can view, pin, edit, and delete these in the Memories screen at any time.
• Chat history: your most recent conversations (currently the latest 50).
• Pet state & settings: your pet's name, species, personality, level, cosmetics, chosen world, and app preferences.
• Your API keys: stored securely. Keys you enter for built-in provider options (such as Anthropic or OpenAI) are kept in the macOS Keychain; your Venice key, custom-endpoint key, and Managed device token are kept in files locked to your user account so the app doesn't have to prompt you on every message.

Screenshots are never saved to disk. When a screen glance happens (only in the modes you enabled), the image is built in memory, downscaled, sent, and discarded.

You are in control: the app's Memories screen lets you clear the running "moment" log, and a factory reset ("Danger Zone" in settings) deletes your pet, conversations, and all stored keys and tokens, returning the app to a clean state.

5. Screen & system awareness

Nibbii can optionally react to what you're doing. This is built as a ladder, and every rung above the default is something you choose to switch on:

• Off: the pet ignores everything around it.
• App-aware (default): it knows only the name of the app in front (e.g. "Safari"). This needs no special permission.
• Interactive: with macOS Accessibility permission, it can read on-screen structure (the position of windows and controls) so it can perch on things. It reads layout, never pixels.
• Insightful: with macOS Screen Recording permission, it can take an occasional screenshot to comment on what you're working on. This is the only level at which an image of your screen can be captured.

How this works with your AI brain: in on-device mode, everything above stays on your Mac. If you use a cloud brain (Venice or the Managed plan) with ambient comments switched on, the pet composes its spoken remarks in the cloud, so a short text description of your current context (such as the name of the app in front and a brief activity hint) is sent to generate the line, and the higher the awareness level, the more context is included. An actual image of your screen is only ever captured and sent at the Insightful level.

A screenshot is only ever captured and sent when you are at the Insightful level and have ambient comments switched on, and only to Venice (in bring-your-own-key mode) or to our backend (on the Managed plan). Nibbii's own windows are excluded, and it automatically skips password and two-factor managers and finance apps so they are never captured.

Other device signals

• Now playing / music: the pet reacts to audio by reading "now playing" info (track, artist, play state) locally on your Mac. This never leaves your device.
• Local weather (optional): if you turn it on, your location coordinates (which may be precise if you choose "Use my location") or a city name you type are sent to Open-Meteo to fetch a forecast. No account or identifier is attached, and your location is not stored or shared beyond that lookup.
• Notifications (optional): if you enable reminders, Nibbii uses macOS notifications. These are generated on your device.

6. What our servers handle

Our app backend is a Cloudflare Worker with a database behind api.nibbii.pet. It runs Managed AI, anonymous iOS accounts, device verification, entitlements, Sparks, account recovery, and purchase linking.

Content is not logged or stored

When we forward a Managed AI chat or screenshot to Venice, the content passes through our server in memory and is discarded immediately. It is not written to our database or application logs. We retain token-usage totals so we can meter Sparks.

Account and service records

Depending on the platform and features you use, our database may hold:

• an anonymous account ID, created automatically by the iOS app, and any email identity you later choose to link;
• your Stripe customer record and Nibbii licence key for direct Mac purchases;
• Apple StoreKit records needed to verify and restore iOS purchases, including product and original transaction identifiers, subscription status, and the period already credited;
• device-security records, including one-way hashes of access tokens and App Attest key identifiers, App Attest public keys and counters, device labels, and last-seen timestamps;
• your Sparks balance and metering log: token counts, timestamps, and cost, but no message content;
• short-lived verification, recovery, rate-limit, and anti-abuse records.

App Attest and DeviceCheck

On iOS, Apple App Attest proves that requests come from a genuine copy of Nibbii, and Apple DeviceCheck helps prevent the one-time welcome trial being claimed repeatedly after reinstalling. Nibbii sends Apple an attestation or DeviceCheck token and receives verification state. Our backend stores hashed or public verification material rather than the raw credential. Apple keeps the DeviceCheck anti-abuse bits for the device under its own service rules.

Account deletion

In iOS Settings you can delete the cloud account and its linked identities, devices, Sparks, metering history, purchase links, entitlements, pending recovery records, and App Attest server records. Local pet data is separate and remains until you use “Erase all data”. Deleting the Nibbii account does not cancel an Apple or Stripe subscription; cancel billing with that provider first.

Crash reports (optional)

If Nibbii offers to send a crash report, nothing is sent unless you agree. The app posts a scrubbed summary such as crash type, signal, a small number of function names, app and OS versions, and an unrelated per-install identifier. Home-folder paths, UUIDs, and memory addresses are stripped first. We group reports by signature to fix bugs.

We do not store payment-card details or Managed AI message and screenshot content. Some security endpoints briefly process IP addresses to curb abuse; those rate-limit records are swept after their short window.

7. Payments

Direct Mac and web purchases are handled by Stripe. We receive an email address, customer ID, and purchase or subscription status, but not your complete card details. Stripe processes data under its own privacy policy.

iOS subscriptions are purchased through Apple StoreKit. Apple handles your payment method. Nibbii receives signed transaction information such as the product ID, original transaction ID, purchase and expiry dates, and subscription status so we can provide and restore the entitlement.

8. Third parties & subprocessors

Depending on how you use Nibbii, these services may be involved. We share only what each one needs.

App updates are delivered through Sparkle from updates.nibbii.pet. The check carries the app version and ordinary request metadata. Album artwork may be fetched from the media source's servers.

9. Your own AI provider (bring-your-own-key)

When you bring your own key, you have a direct relationship with that provider (Venice, Anthropic, OpenAI, OpenRouter, a local server, or whatever you configure). Your requests go to them, not to us, and their handling of your data is governed by their privacy policy and terms, so please review those. Some Venice models labelled "anonymized" relay your request onward to another provider with your identity stripped; if privacy is your priority, choose your model accordingly.

10. Legal bases for processing

Where we act as controller, we rely on:

• Performance of a contract: to create and operate accounts, verify purchases, provide entitlements, forward Managed AI requests, and run paid plans.
• Legitimate interests: to meter usage, prevent repeat-trial and payment abuse, secure the service, diagnose crashes, and understand aggregate website traffic through privacy-focused analytics.
• Consent: for optional features you switch on, such as screen glances, local weather, and sending a crash report. You can withdraw consent by turning the feature off.
• Legal obligation: to retain tax, accounting, and transaction records where required.

11. Data retention

• On your Mac or iPhone: local pet data stays until you erase it in the app or remove the app, subject to operating-system backup behaviour.
• Cloud account data: kept while the account is active. iOS users can delete it in Settings; other users can email us. We remove account-linked records except information we must retain or may lawfully keep for tax, accounting, security, fraud prevention, or dispute handling.
• Apple and Stripe billing records: retained by those providers and, where applicable, by us for the periods required to administer purchases and meet legal duties.
• DeviceCheck: Apple may retain the device's anti-abuse bit across reinstall and account deletion under Apple's service rules.
• Vercel Web Analytics: the visitor hash resets after 24 hours. Aggregate page-view reporting is retained according to the Vercel plan and account settings.

12. Your rights

Under UK data protection law you may have rights to access, correct, delete, restrict, object, receive a portable copy, and withdraw consent. On iOS, Settings includes separate controls to delete the cloud account and erase local app data. You can also email hello@nibbii.pet; we normally respond within one month. Some records may remain where law permits or requires retention, including billing, tax, security, and fraud-prevention records.

If you're unhappy with our response, you can complain to the UK Information Commissioner's Office at ico.org.uk.

13. International transfers

Some of the providers above (for example Venice AI, Stripe, and Cloudflare) may process data outside the United Kingdom. Where that happens, we rely on appropriate safeguards, such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses, so that your data keeps a comparable level of protection. You can ask us for more detail about these safeguards, or a copy where one is available, by emailing hello@nibbii.pet.

14. Children

Nibbii isn't directed at children. You must be at least 13 to use it, and if you're under 18 you should have a parent or guardian's permission before making any purchase. We don't knowingly collect data from children under 13; if you believe a child has provided us data, contact us and we'll delete it.

15. Security

We use platform Keychain storage where appropriate, encrypted TLS connections, one-way hashes for device access tokens, Apple App Attest and DeviceCheck on iOS, and cryptographic verification for payment events. Local files use operating-system access controls. No system is perfectly secure, but keeping most pet data on your device reduces what our service needs to hold.

16. Changes to this policy

If we change how Nibbii handles data, for example when we enable a new feature, we'll update this page and change the effective date at the top. Significant changes will be highlighted here.

17. Contact

Questions, requests, or concerns? Email hello@nibbii.pet and we'll help. You can also write to us at 315 Wilmslow Road, Manchester M14 6XS, United Kingdom.