Privacy Policy

This Policy explains how Nifftly Labs Inc ("Nifftly", "we", "us") collects, uses, and shares information when you use the Nifftly website and app (the "Service"). By using Nifftly you agree to this Policy.

Information we collect

• Account: your name, email address, and a securely hashed password.
• Usage & chat history: the prompts you submit, the AI responses generated, the model you choose, and your Niff activity. If you're signed in, your conversations are saved to your account so you can revisit them — you can delete any conversation, or your entire account, at any time.
• Payments: if you buy a Niff pack or subscribe to Pro, payment is processed by Stripe. We do not see or store your full card number; we keep a customer reference and your plan and Niff balance.
• Advertising: ads keep Nifftly free. On the website we use Google AdSense and Google Ad Manager (including rewarded ads); in the mobile app we use Google AdMob (rewarded ads). These partners may set cookies and process device/advertising identifiers, coarse location, and broad, aggregated interest categories to serve, cap, and measure ads. We never share your name, email, or the contents of your prompts with advertisers.
• Device & log data: IP address, browser/device type, and timestamps, used for security and abuse prevention.
• Cookies & local storage: we store a session token and preferences in your browser to run the Service. Where ads are shown, Google and its partners may also set advertising and measurement cookies; in the EEA/UK these load only after you consent (see “Advertising & your privacy choices”).

How we use information

• Provide and operate the Service, authenticate you, and meter free, earned and purchased Niffs.
• Process payments and manage subscriptions and Niff purchases.
• Serve and limit optional rewarded ads and verify ad rewards.
• Prevent fraud and abuse, enforce our Terms, and keep the Service secure.
• Comply with legal obligations and improve the Service.

AI model providers

To answer your prompt, we send it (together with earlier messages from that same conversation, for context, unless you turn this off in your account settings) to the third-party model you select — from OpenAI, Anthropic, Perplexity, or Google (Gemini) — which handles it under its own terms and privacy practices. Except where content is shared for the development purposes described below, the provider processes your prompt on our behalf as our service provider. We do not use your prompts to train our own models.

Use of your content to improve AI providers' services. Some AI providers may use the content you submit and the responses you receive to develop and improve their own services, including training their models and for related research, evaluation, and testing. In particular, we participate in OpenAI's content-sharing program, under which content we designate may be used by OpenAI for these development purposes. For that content, the provider acts as an independent data controller under its own terms and privacy policy (not as our service provider), and that use is separate from the retention, security, and other commitments that otherwise apply to your information under this Policy.

Please do not submit information you would not want used this way. Do not enter sensitive, confidential, or proprietary information; health information that constitutes Protected Health Information under HIPAA; or personal information about a child under 13 (or the applicable age of digital consent where you live) as a prompt. By submitting a prompt you confirm you have the rights and permissions needed to provide it for the purposes above, and, where your prompt includes information about other people, that you have given any required notices and obtained any required consents.

How we share information

We share information only with service providers that help us run Nifftly and as required by law:

• Cloudflare (hosting, database, and security), Stripe (payment processing), Google (AdSense & Ad Manager on the web, AdMob in the app, and Gemini as an AI provider), the other AI providers above (OpenAI, Anthropic, Perplexity), and our email provider for transactional messages.
• To comply with law, enforce our Terms, or protect rights and safety.
• In a merger, acquisition, or sale of assets, subject to this Policy.

We do not sell your personal information.

Advertising & your privacy choices

Ads are matched to broad, aggregated interest topics (e.g., education, home improvement) — never to your name, profile, or message contents. You can turn off personalized ads using our cookie banner (you may still see non-personalized ads), and you can reset or limit ad personalization in your device or Google Ads settings. See our Cookie Notice for the specific cookies and identifiers used.

EEA, UK & Switzerland: we and Google rely on your consent to set advertising/measurement cookies and to show personalized ads. You're asked to consent through a Google-certified consent tool on your first visit; you can change or withdraw consent anytime, and if you decline you'll still see non-personalized ads. Our legal bases are consent (ads), contract performance (running the Service), legitimate interests (security, fraud prevention), and legal obligation.

United States: depending on your state (California CCPA/CPRA, plus Colorado, Connecticut, Virginia, Texas, and others), you can opt out of targeted advertising and of the “sale” or “sharing” of personal information. We do not sell your personal information for money, we honor the Global Privacy Control (GPC) browser signal as a valid opt-out, and you can turn off personalized ads with the cookie banner or by emailing us.

Data retention & security

We keep account and usage data for as long as your account is active and as needed for legal, accounting, and fraud-prevention purposes. Passwords are stored only as salted hashes; data is transmitted over HTTPS. No method is 100% secure, but we take reasonable measures to protect your information.

Your rights

• Access / correct / delete: you can delete your account and associated data in the app (Delete account) or by emailing [email protected].
• California (CCPA/CPRA): rights to know, delete, correct, and to opt out of sale/sharing and targeted advertising. We do not sell personal information. Use "Your Privacy Choices" or email us.
• EEA/UK (GDPR), where applicable: rights of access, rectification, erasure, restriction, portability, and objection; our legal bases are contract performance, legitimate interests, consent (ads), and legal obligation.

Children

Nifftly is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact [email protected] and we will delete it.

Changes & contact

We may update this Policy and will revise the date above. Questions or requests: Nifftly Labs Inc, 1201 J St Ste 200, Sacramento, CA 95814 · [email protected] · (530) 920-6618.