Nodd Privacy Policy
Last updated: 2026-11-08
This policy explains how blipdrop ("we") handles information in the Nodd app and API (the "Service"). The Service has no ads and does not track you. If this English text differs from the Japanese version, the Japanese version prevails.
1. Message bodies
Images attached to a message are handled the same way as the body.
- Our servers receive the body over HTTPS and hold it in an encrypted queue while it is processed. During this step our servers can read the body
- The body is encrypted to each recipient device's public key and stored as ciphertext. The private key stays on the device and is not available to the server
- Ciphertext is deleted when the device receives it. Anything not received is deleted when the delivery window ends (24 hours on Free, 90 days on Team)
- Readable history stays only on receiving devices. Message history is not stored on the server, including on Team plans
Failed delivery jobs, including their bodies, may stay in an encrypted queue for up to 14 days for investigation and redelivery.
The Service is not end-to-end encrypted. Do not put passwords, API keys, or other secrets in messages.
2. Information we hold
| Apple sign-in identifier | Collected at sign-in to identify you. We do not request your email address |
|---|---|
| Display name | The name Apple provides or the name you set. Visible to members of your workspace |
| Workspaces and channels | Names, visibility, members, roles, and notification settings |
| Device information | Device public key, push token, and App Attest data, used for delivery and abuse prevention |
| Device identifier | A random ID the app creates in the device Keychain and sends when you create a free workspace. The server stores only a keyed hash, not the ID itself. Used to prevent repeat free plan creation from the same device with another Apple ID |
| Quiet hours | Start and end times and the time zone offset for each device, used to keep notifications silent during those hours |
| Send keys | A hash, the last four characters, the name, the last-used time, and monthly message counts for each key. We do not store the key itself |
| Heartbeats | The job name, interval and grace seconds, the time of the last report, the next due time, and whether reports have stopped. Used to tell you when a job stops reporting |
| Message details | Information other than the title and body (message ID, type, source, times, option IDs, metadata), plus the responder's name, the response, its signature, assignees, and reactions. Used to return results and share team status |
| Secret answers | A value entered when the sender asks for a secret. The device encrypts it to the sender's key, so the server cannot read it. The ciphertext is deleted when the sender receives it, or after 10 minutes. It is not kept on the device either |
| Text added to responses | Rejection reasons and answers the sender asked for (up to 200 characters). Stored on the server with the response and returned as written to the sending program and any registered URL. Not encrypted to devices |
| Callback URLs | URLs registered on a channel |
| Reports | Who reported, the target (a notification, send key, or member), the reason, and any note. If the reporter chooses to attach the notification's content, we also receive its title and body and store them where our staff can read them. Used to review and act on reports |
| Blocks | Send keys and members you have blocked. Used to stop delivering their notifications to your devices |
| Purchase records | Plan, expiry, and Apple-signed transaction data. We do not receive your payment card details |
| Audit logs and usage | Who changed what and when (without message bodies), and monthly message counts |
| Free plan usage record | The keyed hash of the device identifier and this month's message count. Kept after closing a workspace or deleting your account so that recreating them does not reset the monthly limit |
| Operational logs | Logs for troubleshooting, including message and channel IDs and error details, without message bodies |
Metadata is not encrypted to devices. Senders should not put secrets or personal data in metadata.
The camera is used to scan QR codes, and images are not saved. Face ID data stays on your device and never reaches us.
3. How we use information
- To deliver notifications, pass responses, and support team sharing
- To verify users and devices and prevent abuse
- To apply plans and manage usage
- To investigate failures and improve the Service
- To answer your inquiries
- To review reports and act on use that violates our terms
4. Who can see it, and sharing
- Notifications reach the devices of channel members. Workspace owners and admins can manage settings of channels they have not joined, but cannot read message bodies
- Responses, rejection reasons, and responder names go to the sending program and to any registered URL. The operator of that URL decides how it is handled
- We do not provide your information to third parties except as required by law, and we never share it for advertising or sale
- The Service uses Amazon Web Services (Tokyo region) and Apple's push notification, sign-in, App Attest, and in-app purchase services
5. Retention
| Message ciphertext | Until received, and at most until the delivery window ends (24 hours or 90 days) |
|---|---|
| Message details, rejection reasons, monthly counts (including per key counts) | 100 days |
| Audit logs | 400 days |
| Reports | 180 days |
| Blocks | Until you unblock or delete your account |
| Free plan usage record | 40 days |
| Keyed hash of the device identifier | 40 days. It remains for this period after you delete your account |
| Quiet hours | Until the device is removed or you delete your account |
| Heartbeats | Until the heartbeat is stopped |
| Operational logs | 30 days |
| Polling events for responses | 7 days |
| Database recovery backups | 35 days |
Account information is kept until you delete your account.
6. Deletion
Delete your account in the app under Settings > Delete account. Owners of workspaces with other members choose to transfer ownership or close the workspace on the deletion screen.
Deletion removes your user, device, and membership records and revokes your Apple sign-in token. Workspaces you own are closed and their send keys stop working. Names of those workspaces, channels, and keys, along with heartbeats and audit logs, are also removed. We keep only the mapping that stops a purchase from being reused, which does not identify a person. For the Free plan we keep only the keyed hash of the device identifier and this month's message count, for 40 days. Notification metadata, including the responder's display name and reason, cannot be removed individually and is deleted after the period above. Audit logs of workspaces that still have other members are also deleted after their period.
Deleting your account does not cancel a subscription. Cancel it in your App Store account settings. On-device history is removed when you delete the app.
7. Security
Data is encrypted in transit and at rest. Send keys are stored as hashes, and important operations are verified with device key signatures.
8. Children
The Service is for developers and teams and is not directed at children under 13.
9. Changes
We will announce changes on this page or in the Service.