Privacy Policy

Data Controller

NoFi Diary is operated by NoFi Diary, based in Italy, acting as Data Controller for the processing described in this policy.

Contact: privacy@nofidiary.com · Italy

Age and children's privacy

NoFi is intended for people aged 16 or older and is not designed or marketed specifically for children. The current release has no account system. The age requirement does not replace any protections or requirements that apply to minors under local law.

Your diary content

NoFi may contain photographs, images, audio recordings, text, diary pages, canvas renders, visual decorations, Memory Boxes, and NoFi content you receive or import. This content is stored primarily on your device.

• No NoFi cloud or automatic synchronisation to NoFi servers
• No use of memories for advertising or profiling
• No use of private diary content to train AI models

Behavioural analytics inside the application

The current NoFi app does not use behavioural analytics, Firebase Analytics, advertising trackers, or profiling tools. NoFi does not monitor which memories you open or what you create to build a behavioural profile. Website services are addressed separately below.

Device permissions

NoFi asks for permissions only when a feature needs them. Camera access lets you take a photograph at your request. Microphone access lets you record a voice note. Wi-Fi or Nearby devices access enables direct memory transfers.

Some Android or device-manufacturer versions may require location permission for Wi-Fi Direct or nearby discovery. NoFi does not use this permission to collect, store, or transmit your precise location.

Nearby transfers

A Nearby transfer goes from Device A through a local Wi-Fi Direct connection to Device B. It is peer-to-peer, starts only when you choose, uses no intermediate NoFi server, and leaves no server-side copy with NoFi.

Diagnostics and crashes

NoFi contains no Firebase Crashlytics or other crash-reporting SDK. Google Play or Android may provide Android Vitals under their own services and settings. NoFi does not deliberately send diary content to a diagnostics system.

Backup

NoFi provides no cloud backup. Private content is excluded from automatic Android backup under the app's implemented configuration. Backup or export occurs only when you intentionally request it and choose a destination; NoFi keeps no copy of the archive. Exported archives are not represented as encrypted unless that protection is expressly provided by the app.

Export and sharing

After you export or share content, it may be processed by Android, Google Drive, Google Photos, social networks, messaging apps, or another storage provider you select. NoFi does not upload it automatically. Later synchronisation depends on the settings of the service or app you chose.

Website services

The website uses Vercel Web Analytics and Vercel Speed Insights to measure aggregated traffic, acquisition, selected product-interest events, and real-world performance. These services do not use third-party advertising cookies and are not used to identify a person, build cross-session profiles, or connect website activity to diary use.

Custom events are deliberately limited to download or store intent and meaningful interactions with the public memory gallery. Event properties use low-cardinality context such as page, CTA placement, destination, or interaction type; they must not contain names, contact details, diary content, user IDs, device IDs, installation IDs, or individual tokens. Campaign links may use UTM parameters to identify a source or initiative, never a person.

Support communications

When you contact NoFi voluntarily, we may receive your email address, your name if supplied, your message, and technical information you choose to include. Please do not send private photographs or audio unless they are necessary for support.

Legal bases

Where GDPR applies, relevant legal bases may include performing services you request, compliance with legal obligations, legitimate interests where appropriate, and consent where legally required.

Sharing of personal data

NoFi does not sell personal data or diary content and does not provide private diary content to advertisers. Infrastructure providers used to operate the website are different from apps or services to which you deliberately export content.

International data transfers

Website infrastructure providers may process technical data in countries outside your own. Where this occurs, transfers are handled according to applicable data-protection law and the provider's verified safeguards. We do not claim a particular transfer mechanism unless it has been confirmed for the service in use.

Retention

Local diary content remains on your device until you delete it, erase the app's storage, or uninstall the app, subject to the device's actual behaviour. Support communications are retained only as needed to handle the request and meet applicable obligations. Technical website data follows the configuration and retention rules of the service that processes it.

Security

NoFi minimises how much information needs to leave your device. We use proportionate measures for information we do process, but no device, transfer, or software can be guaranteed absolutely secure or immune from loss.

Your rights

Where applicable, you may request access, rectification, erasure, restriction, objection, portability, or withdrawal of consent, and you may complain to a supervisory authority, including the Garante per la protezione dei dati personali in Italy. Contact us using the details above.

NoFi cannot access, provide, edit, or delete on your behalf a memory that exists only on your device and is not held by NoFi.

Future services

The current release has no cloud accounts, public profiles, public feed, or NoFi community. If accounts, cloud sync, or community functions are introduced, this policy will be reviewed before they are activated.

Changes to this policy

We may update this policy when the product, website, or law changes. The date above identifies the current version.