NooliNooli Privacy Policy
Effective date: October 25, 2026
This policy explains what personal data Nooli collects, why, who it is shared with, how long it is kept and what rights you have. It covers the Nooli iOS app, the website nooli-app.com and the Nooli connector for AI assistants at mcp.nooli-app.com (together, "Nooli").
1. Who is responsible for your data
Nooli is run by Anton Khalitov, a private individual based in Israel ("we", "us"). We are the controller of your personal data.
Contact for any privacy question or request: support@nooli-app.com.
2. What we collect and why
| Data | Where it comes from | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Account: email address. With Sign in with Apple: your Apple user identifier, the email Apple shares (it may be an Apple private relay address) and your name if you choose to share it | You, Apple | Create your account, sign you in, send sign-in codes | Contract |
| Profile: username, display name, bio, avatar | You | Show your profile in the app and next to decks you publish | Contract |
| Your library: folders, decks, cards (text and images), starred cards | You | Store your decks and sync them across your devices | Contract |
| Study history: when you answered each card, your answer grade, study mode and session times | The app | Schedule reviews, sync progress across devices, show your statistics | Contract |
| Devices: a random device identifier created by the app, last sync time and sync position | The app | Sync your library correctly on each device | Contract |
| Publications: decks you publish, every published version, review status and moderation decisions | You, our moderators | Show your deck to other people, review it, keep a record of what was published | Contract; legitimate interest in keeping Nooli safe |
| Search index of public decks: a numeric representation (embedding) of a published deck's text | Computed from published decks | Let people find public decks by meaning | Legitimate interest in providing search |
| AI generation input: files (PDF, photos, Word, PowerPoint), text and instructions you send to create or edit a deck with AI | You | Generate the cards you asked for. We do not store these files after the request is finished | Contract |
| Reports: the reason, your comment, your name and email, your account if you are signed in, the reported version of the deck or profile, and a keyed hash of your IP address | You | Review the report, reply to you, prevent report spam | Legitimate interest in moderating content; legal obligations to handle notices |
| Support emails sent to support@ or copyright@nooli-app.com | You | Answer you | Legitimate interest; contract |
| AI assistant connection: an encrypted authorization grant when you connect Nooli to an AI assistant | You | Let the assistant read and change your library at your request | Contract |
| Technical logs: IP address, device and browser type, request times and errors | Our hosting providers | Keep Nooli secure and working, investigate errors and abuse | Legitimate interest in security |
| App usage and crashes: app instance identifier, device model, OS version, country, app events and crash reports | The app, through Google Firebase Analytics and Crashlytics | Find and fix crashes, understand which features are used | Legitimate interest in improving Nooli |
We do not:
- sell your personal data or share it for advertising;
- show ads, track you across other companies' apps and websites, or use analytics or tracking cookies on the website;
- use your decks, cards or uploaded files to train AI models.
The website uses no cookies. The sign-in page of the AI assistant connector uses one strictly necessary cookie that keeps your sign-in session for up to 15 minutes.
3. What other people can see
- Your profile (username, display name, bio, avatar) is visible to other Nooli users and can be found by username search.
- Your private library is visible only to you.
- A deck published to the catalog is reviewed by our moderators and then shown to everyone, including in search engines, with your username as the author.
- A deck shared by link is available to anyone who has the link. It is hidden from the catalog and search engines.
- When someone saves your published deck, they get their own copy. If you later delete the publication or your account, people who saved the deck keep their copy for personal study.
4. Who we share data with
We use the following service providers. They process data only on our instructions.
| Provider | What it does for Nooli | Where data is processed |
|---|---|---|
| Supabase (on Amazon Web Services) | Database, sign-in, file storage, server functions | Ireland (EU) |
| Cloudflare | Website, AI assistant connector, email routing for our domain | Global network |
| Resend | Sends sign-in code emails | EU (Ireland); Resend is a US company |
| Google (Gmail) | Mailbox where support@ and copyright@ emails arrive | USA and other countries |
| Nebius | AI models: search index for public decks, AI deck generation. Nebius does not keep the text after processing and does not use it to train models | EU (Finland) |
| Telegram | Our moderators' chat: published deck versions sent for review and incoming reports, including the reporter's name and email | Telegram servers worldwide |
| Google (Firebase Analytics, Crashlytics) | App usage statistics and crash reports | USA and other countries |
| Apple | Sign in with Apple, app distribution through the App Store and TestFlight | USA and other countries |
AI assistants you connect yourself (for example Claude by Anthropic or ChatGPT by OpenAI) are not our service providers. When you ask an assistant to work with Nooli, the decks and cards it reads are sent to that assistant under its own privacy policy.
We may also disclose data if the law requires it, to respond to a valid request from a public authority, or to protect the rights and safety of users and Nooli.
5. International transfers
We are based in Israel, and our providers process data in the EU, the USA and other countries, which may be outside your country. The European Commission recognizes Israel as providing an adequate level of data protection. For providers outside the European Economic Area we rely on the protections in their data processing terms: the EU-US Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses.
6. How long we keep data
- Account, profile, library, study history and devices: as long as your account exists. They are deleted when you delete your account.
- Cards, decks and folders you delete: removed from all your devices at once. On the server they stay in a deleted state so that sync works on your other devices, and are erased after 30 days or when you delete your account, whichever comes first.
- Published decks: until you delete the publication or your account. Copies saved by other users remain with them.
- Reports and moderation records: while the report is being reviewed and up to one year after, so that we can handle appeals and requests from authorities.
- AI generation input: not stored by us or by Nebius after the request.
- Support emails: as long as needed to answer you, and no longer than 2 years.
- App usage statistics: events are kept for 2 months; data linked to your app installation is deleted 2 months after you last use the app. After that only aggregated reports remain.
- Crash reports: 90 days.
- Technical logs: kept by our providers for a limited period, usually from a few days up to 30 days.
7. Deleting your account
You can delete your account by writing to support@nooli-app.com from the email address of your account.
Deletion erases your account, profile, library, images, study history and devices. Your publications are deleted; people who saved your published decks keep their own copies. Reports you filed are kept without a link to your account for the period in section 6.
8. Your rights
Depending on where you live, you have the right to:
- access your data and get a copy;
- correct inaccurate data;
- delete your data;
- restrict or object to processing, including processing based on legitimate interest;
- receive your data in a portable format;
- withdraw consent where we rely on consent;
- complain to a data protection authority in your country. In Israel, this is the Privacy Protection Authority; in Russia, Roskomnadzor.
You can change your profile and library in the app at any time. For any other request, write to support@nooli-app.com from the email address of your account. We may ask you to confirm that the account is yours. We answer within one month, or sooner where your local law requires it.
9. Children
Nooli is not intended for children under 13. If you are under the age at which you can consent to data processing in your country, you need permission from a parent or guardian. If we learn that a child under 13 has created an account, we will delete it. Parents can contact us at support@nooli-app.com.
10. Security
Data is encrypted in transit. Your library is stored in a database that the app can access only through functions that check who you are. Avatars and card images are kept in private storage. Authorization grants for AI assistants are stored encrypted. No system is perfectly secure, so please keep access to your email and Apple ID safe.
11. Additional information for users in Russia
This section is published to meet Federal Law No. 152-FZ "On Personal Data".
- Data subjects: users of Nooli and people who send us reports or emails.
- Legal bases: performance of the agreement with you (the Terms of Use), our legitimate interests, and legal obligations (Article 6 of 152-FZ).
- Actions with data: collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer (provision, access), depersonalization, blocking, deletion and destruction, using automated means.
- Cross-border transfer: the operator is in Israel, and data is stored and processed outside Russia by the providers in section 4.
- Destruction: when the retention period in section 6 ends or you withdraw consent or request deletion, the data is destroyed within 30 days unless the law requires us to keep it.
12. Changes to this policy
When we change this policy, we publish the new version on this page with a new effective date. If the changes are significant, we will also tell you in the app or by email before they take effect.
13. Contact
Anton Khalitov, Israel
Email: support@nooli-app.com