Privacy policy

Effective date: November 7, 2026 · Last updated: November 9, 2026

This policy explains what personal data the navl.dev website processes, why, and what rights you have. It covers every page on navl.dev, including the app pages. The apps themselves have their own privacy policies:Nota, Stark, Yanufi and TastePad.

The short version: no cookies, no ads, no tracking across sites, and no profiles of you. We collect as little as we can to run the site and understand roughly how it is used.

1. Who is responsible

NAVL is an independent product studio run by Nils Anton Viktor Larsson in Sweden. He is the data controller for this website, referred to below as “we” or “us”. You can reach us atinfo@navl.dev.

2. What we collect and why

When you visit the site

The site is hosted by Vercel. Like any web server, it receives technical information with every request: your IP address, browser and device type, the page you asked for, the referring page and the time.

Vercel also uses your IP address to work out which country you are in. We use only that country, and only for analytics, as described below.

  • Purpose: delivering pages to you, keeping the site secure and stopping abuse.
  • Legal basis: our legitimate interest in running a working, secure website (GDPR Art. 6(1)(f)).
  • Retention: request logs are kept by Vercel for a short period, normally no more than 30 days.

Analytics

We use PostHog, hosted in the EU, to count page views and a few named interactions: App Store button clicks, contact link clicks and use of the interactive demos. We do not record other clicks, scrolling or what you type. PostHog also measures how fast each page loads, and if something on a page breaks, it records the error message, the page and your browser type so we can fix it.

Analytics are set up to be as unintrusive as possible:

  • Cookieless mode: nothing is stored on your device for analytics.
  • No names, email addresses or account details are collected, and no user profiles are created.
  • Visits are counted with a hash of your IP address, browser and a secret value that changes every day. The hash cannot be reversed, cannot be linked across days and cannot follow you to other websites.
  • To see which countries visitors come from, our host Vercel looks up your country from your IP address when a page loads. Only the two-letter country code, such as SE for Sweden, is sent with the analytics. We do not record your city or any more precise location, and your IP address is not stored in analytics.
  • No session recordings, heatmaps, click tracking or screenshots. Text on the page is never captured.
  • If your browser sends a Do Not Track signal, no analytics are sent at all.
  • Purpose: understanding which pages and apps people are interested in, and finding bugs.
  • Legal basis: our legitimate interest in improving the site (GDPR Art. 6(1)(f)). We have weighed this against your privacy and kept the data to a minimum.
  • Retention: analytics events are deleted after at most 12 months.

Exchange rates in the Nota demo

The settle-up demo on the Nota page fetches current exchange rates fromFrankfurter, a free public API. Your browser makes that request directly, so Frankfurter receives your IP address and browser type, as any website would. No other data is sent, and nothing you enter in the demo leaves your browser.

When you email us

If you write to info@navl.dev, we receive your email address, your name if you include it and whatever you write.

  • Purpose: answering you and helping with your question, bug report or idea.
  • Legal basis: our legitimate interest in replying to messages (GDPR Art. 6(1)(f)).
  • Retention: kept while the conversation is active, then deleted within 24 months unless we need it for a legal claim.

3. Cookies and storage on your device

The site sets no cookies and uses no local storage.

It stores one entry in your browser’s session storage, navl-mark-drawn, so the logo animation plays once per visit instead of on every page. It contains no personal data, is never sent to us and is deleted automatically when you close the tab.

4. Who we share data with

We never sell your data or use it for advertising. We share it only with the services that run the site:

  • Vercel Inc. (USA): website hosting and delivery, and the country lookup used for analytics.
  • PostHog Inc. (USA, data stored in the EU): analytics and error reports.
  • Cloudflare Inc. (USA): receives email sent to info@navl.dev and forwards it to our inbox. Cloudflare passes messages on without keeping a copy.
  • Google LLC (USA): Gmail stores the email we receive and the replies we send.

The Nota page also loads exchange rates from Frankfurter, as described above.

These providers process data on our behalf under data processing agreements and may not use it for their own purposes. We may also disclose data if the law requires it.

5. Transfers outside the EU

Some of the services we use are run by companies based in the United States:

  • Vercel may process request data in the United States.
  • Cloudflare may process email in the United States while forwarding it.
  • Google may store email in Gmail in the United States.
  • PostHog stores analytics data in the EU (Frankfurt), but as a US company it may access that data from the United States, for example for support and maintenance.

These transfers are covered by the EU–US Data Privacy Framework, which all four companies are certified under, and by the European Commission’s Standard Contractual Clauses in their data processing agreements.

6. Your rights

Under the GDPR you have the right to:

  • get a copy of the personal data we hold about you;
  • have incorrect data corrected;
  • have your data deleted;
  • restrict how we use your data;
  • object to processing based on our legitimate interest, including analytics;
  • receive your data in a portable format, where that applies.

Email info@navl.dev to use any of these rights. We answer within one month. Because analytics are cookieless and do not identify you, we usually cannot link analytics data to a specific person. To opt out of analytics entirely, turn on Do Not Track in your browser or use a content blocker.

If you think we handle your data incorrectly, you can complain to the Swedish Authority for Privacy Protection (IMY) or the data protection authority where you live. We would appreciate the chance to sort it out with you first.

7. Children

The site is not aimed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, contact us and we will delete it.

8. Other websites

The site links to the App Store, LinkedIn and other websites. When you follow those links, their own privacy policies apply, not this one.

9. Changes to this policy

We update this policy when the site or the services behind it change. The date at the top always shows the latest version. For significant changes, we will make a note of it on this page.

10. Contact

Questions about this policy or your data? Email info@navl.dev. See also our terms of use.