This policy explains exactly what Nailly stores, where it lives, why we need it, and what never leaves your phone. It is written to be read, not skimmed.
Your account
Nailly requires an account: your email address, a password, and a display name (customers) or salon name (artists). We use them to sign you in, keep your work safe, and let artists and clients recognise each other.
Passwords are never visible to us — they are stored as secure one-way hashes by our authentication provider. New passwords are checked against public lists of leaked passwords, purely to protect your account; the password itself is not shared.
What syncs to your account
Your creative and activity data — designs, saved looks, boards, drafts, posts, chats, booking records, moments, profile details (name, city, area) and settings — is stored on your device and backed up to your account on our servers, so it survives a lost phone and follows you to a new one.
Our servers are operated with an established cloud infrastructure provider in the United States. Your data is protected by per-account access rules: only your signed-in account can read or write your data.
What never leaves your phone
Photos of your hands (for try-on), your profile photo, and photos you add to a portfolio stay on your device. They are not uploaded by the app — a photo only leaves your phone when you yourself share or send it.
Location
If you grant location access, we use one GPS reading to determine your city, so we can show artists and salons you can actually reach. You can also just type your city instead — location permission is never required.
Your city and area are part of your profile and are included in your account backup. Nearby salons are looked up by sending approximate coordinates to the OpenStreetMap Overpass service; that request contains no account or identity information.
Clipboard (invite codes)
Nailly never reads your clipboard on its own. The only clipboard access is the “Paste from clipboard” button in the link-your-artist sheet, which runs once, in direct response to your tap, to fill in the invite code. Clipboard contents are never stored or transmitted.
Camera, photo library & calendar
Camera and photo library access are used solely so you can capture or pick photos for try-on, inspiration colours, and portfolios.
For artists, calendar access (optional) is used to add booked appointments to your own calendar. We never read your existing events.
Notifications
All notifications are generated locally on your device (appointment reminders, refill reminders, new-look nudges). You can switch each category off in Settings → Notifications.
Membership & payments
Membership payments are processed by the app marketplace you installed Nailly from, under your existing account there. Nailly never sees or stores your card details. Manage or cancel your subscription in that marketplace’s subscription settings.
The free week & fair use
Every account starts with a free week. To keep that fair, we record the date your email first started a trial, keyed to a one-way cryptographic fingerprint of the email (the readable address is not kept in that record).
This fingerprint record survives account deletion — it is the one thing that does — so a free week cannot be restarted by deleting and re-creating an account. It contains no name, no readable email, and nothing about what you did in the app.
What we do NOT do
No advertising. No sale of personal data. No third-party analytics trackers. No reading of your contacts or messages. No AI training on your content.
Deleting your account & data
Settings → Delete account & all data permanently deletes your account on our servers — profile, backup, everything — and then erases all data on the device. If the servers cannot be reached, nothing is deleted anywhere, so you are never left half-deleted.
Two records remain after deletion: the trial-date fingerprint described above (fraud prevention), and any reports you filed about other content — kept for moderation history, but anonymised so they no longer point to you.
Children
Nailly is not directed at children under 13, and we do not knowingly collect personal information from them.
Changes & contact
If this policy changes, the new version appears here with a new date.
Questions or requests: yelmastafi@gmail.com