Nota privacy policy

Nota (“Nota”, “we”, “us”, or “our”) is a shared-ledger app for small groups, made in Sweden. This policy explains what information the app handles, why, where it is stored, and the choices you have. It applies to the Nota iOS app (the “App”).

The guiding principle is simple: Nota collects the minimum needed to keep a shared ledger in sync between the people in your group, and nothing else. There are no ads, no trackers, and we never sell your data.

1. Who we are

Nota is made by Nils Anton Viktor Larsson, Malmö, Sweden, under the name NAVL. He is the data controller for the personal data described here. For any privacy question or request, contactinfo@navl.dev.

2. Information we handle

2a. Account information

You sign in with Sign in with Apple, Sign in with Google, or an email magic link. From this we receive and store:

• Email address — to identify your account and send the magic-link sign-in. If you use Sign in with Apple’s “Hide My Email”, we only ever see Apple’s private relay address.
• A user identifier issued by the sign-in provider — to keep you signed in and tie you to your groups.
• Display name and avatar emoji (optional) — which you set inside the App so others in your group can recognise you.

We do not receive your Apple or Google password, and we do not access your contacts, calendars, or photos.

2b. Ledger content you create

This is the data that makes the App work. It is shared with the other members of any group you join, because a shared ledger is the point:

• Groups you create or join, and their membership.
• Transactions — amounts, currency, who paid, how a cost is split, and any title or note you add.
• Payments and settle-ups between members.
• Currency preferences and settlement schedules.

Everyone in a group can see that group’s transactions, payments, and members. Only invite someone you intend to share this with.

2c. Device and technical data

• Push notification token — if you enable notifications, Apple issues a device token we store so we can send settle-up reminders and activity alerts through the Apple Push Notification service.
• Camera — used only, in the moment, to scan a group invite QR code. Camera images are never stored or transmitted.
• On-device settings — your display-currency choice and a cache of historic exchange rates are stored locally on your device so balances render offline. This never leaves your phone.

3. What we do not collect

• No advertising identifiers and no third-party ad networks.
• No third-party analytics or behavioural tracking SDKs.
• No location data.
• No selling or renting of personal data — ever.

4. Where your data is stored

Account and ledger data are stored in our backend hosted on Supabase (a managed PostgreSQL platform), protected by row-level security so a request only ever returns rows from a group the signed-in account belongs to. Sign-in is handled by Apple, Google, and Supabase Auth. Push notifications are delivered by Apple. These providers act as processors handling data on our behalf.

5. Legal basis for processing

Under the GDPR, we process your data to perform the service you asked for (keeping your shared ledger in sync) and on the basis of our legitimate interest in operating and securing the App. Push notifications rely on the consent you give in the iOS permission prompt, which you can withdraw at any time in iOS Settings.

6. Retention and deletion

Ledger entries are kept for as long as your group needs them so history and closed cycles stay reconstructible; individual items are soft-deleted rather than erased so balances remain correct for everyone.

You can delete your account at any time from Settings inside the App. This removes your account and personal profile. Shared ledger entries you contributed may be retained in anonymised form where needed to keep other members’ balances accurate. To request full erasure, email info@navl.dev.

7. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, object to or restrict processing, and request a copy of your data in a portable format. You may also lodge a complaint with your local supervisory authority (in Sweden, the IMY). To exercise any right, contactinfo@navl.dev.

8. Children

Nota is not directed to children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect their data.

9. Changes to this policy

If this policy changes materially, we will update the date above and, where appropriate, notify you in the App.

10. Contact

Questions about this policy or your data? Email info@navl.dev.