NaillyThis policy explains exactly what Nailly stores, where it lives, why we need it, and what never leaves your phone. It is written to be read, not skimmed.
Your account
Nailly requires an account: your email address, a password, and a display name (customers) or salon name (artists). We use them to sign you in, keep your work safe, and let artists and clients recognise each other.
Passwords are never visible to us — they are stored as secure one-way hashes by our authentication provider. New passwords are checked against public lists of leaked passwords, purely to protect your account; the password itself is not shared.
What syncs to your account
Your creative and activity data — designs, saved looks, boards, drafts, posts, chats, booking records, moments, profile details (name, city, area) and settings — is stored on your device and backed up to your account on our servers, so it survives a lost phone and follows you to a new one.
Our servers are operated with an established cloud infrastructure provider. Your data is protected by per-account access rules: only your signed-in account can read or write your data.
What never leaves your phone
Your profile photo and any photos you add to a portfolio stay on your device. They are not uploaded to our servers in the background — a photo only leaves your phone when you yourself choose to share, post, or send it.
Location
If you grant location access, we use one reading to determine your city, so we can show artists and salons you can actually reach. You can also just type your city instead — location permission is never required.
Your city and area are part of your profile and are included in your account backup. Nearby salons are looked up by sending approximate coordinates to the OpenStreetMap Overpass service; that request contains no account or identity information.
Clipboard (invite codes)
Nailly never reads your clipboard on its own. The only clipboard access is the “Paste from clipboard” button in the link-your-artist sheet, which runs once, in direct response to your tap, to fill in the invite code. Clipboard contents are never stored or transmitted.
Camera, photo library & calendar
Camera and photo library access are used only when you choose to take or pick a photo — to post a look, pull colours from an inspiration photo, or set your profile or portfolio picture. We never open the camera or read your library in the background.
For artists, calendar access (optional) is used to add booked appointments to your own calendar. We never read your existing events.
Notifications
All notifications are generated locally on your device (appointment reminders, refill reminders, new-look nudges). You can switch each category off in Settings → Notifications.
Membership & payments
Membership payments are processed by the app marketplace you installed Nailly from, under your existing account there. Nailly never sees or stores your card details. Manage or cancel your subscription in that marketplace’s subscription settings.
To unlock membership on your devices and check whether a subscription is active, we use a subscription-management provider (RevenueCat). It receives an app-specific account identifier and your purchase and subscription status — not your name, your email, or your payment-card details. It is a payments tool, not an advertising or analytics service.
The free week & fair use
Every account starts with a free week. To keep that fair, we record the date your email first started a trial, keyed to a one-way cryptographic fingerprint of the email (the readable address is not kept in that record).
This fingerprint record survives account deletion — it is the one thing that does — so a free week cannot be restarted by deleting and re-creating an account. It contains no name, no readable email, and nothing about what you did in the app.
What we do NOT do
In the app: no advertising, no advertising or analytics trackers, no sale of personal data, no reading of your contacts or messages, no AI training on your content.
On this website only (getnailly.com), two measurement tools run: Vercel Web Analytics (page views, no cookies, no personal identifiers) and, because we advertise Nailly in ChatGPT, an advertising-measurement pixel from OpenAI. The OpenAI pixel counts that a visit came from a ChatGPT ad and whether it led to a tap on the App Store link. It receives standard web-request data such as your IP address, browser and the page you are on, and may set a cookie; it does not receive anything from inside the app, and the app itself does not load it. You can block it with any content or tracker blocker without affecting the site.
Crash & error reports
To find and fix crashes and bugs, Nailly sends anonymous crash and error reports to a diagnostics provider (Sentry). A report describes what went wrong — the error, the screen it happened on, and the app and device version — and is configured to carry NO personal data: no name, email, or IP address, no photos, and none of the content of your designs or chats. Nailly never records your screen.
Deleting your account & data
Settings → Delete account & all data permanently deletes your account on our servers — profile, backup, everything — and then erases all data on the device. If the servers cannot be reached, nothing is deleted anywhere, so you are never left half-deleted.
Two records remain after deletion: the trial-date fingerprint described above (fraud prevention), and any reports you filed about other content — kept for moderation history, but anonymised so they no longer point to you.
Your rights
Wherever you live, you can see the data on your account (it is all visible in the app), correct it in your profile and settings, export it by contacting us, and delete all of it at any time from Settings. If your country gives you further data-protection rights, we honour those too — just write to us.
Children
Nailly is for people aged 13 and older — or the higher minimum age set by the law of your country. It is not directed at children under that age, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
Changes & contact
If this policy changes, the new version appears here with a new date.
Questions or requests: getnailly@gmail.com