Privacy notice

Niblet is owned and operated by Comma Collective Pvt. Ltd., a privately owned company in Singapore. In this notice, “Niblet”, “we”, and “us” mean Comma Collective Pvt. Ltd. We are responsible for deciding why and how personal information is used for the Niblet services.

This notice covers heyniblet.com, cloud.heyniblet.com, the waitlist and early believer reservation, Niblet accounts, the dashboard, browser-based device setup, supported firmware, and the Niblet Cloud service. A third-party website, data provider, application, or community forum has its own notice.

We collect only the information needed for the part of Niblet you choose to use:

• Waitlist and email: your email address, confirmation state, reservation choice, delivery timestamps, and any delivery error needed to send the message.
• Accounts: your name, email address, a password hash when you use a password, or the Google or Apple account identifier used to sign you in. Apple may provide a private relay address when you choose to hide your email. We also keep short-lived session, sign-in, and password-recovery security records.
• Displays: a device identifier and name, hardware profile, credential hashes, firmware release, brightness, last contact time, installed apps, their order and timing, and configuration you choose to save.
• Rendering and delivery: generated display assets, render state, errors, and the request information needed to deliver the correct rotation to the correct display.
• Usage and performance: when analytics are enabled, information such as pages and features used, approximate device and browser details, referral source, session events, performance measurements, and errors.
• Support: the message and contact details you send when you ask us for help.
• Reservations: Stripe checkout and payment identifiers and payment status. Stripe, not Niblet, receives and stores your card details.

Our servers and network providers may also process ordinary technical information such as IP address, request path, time, browser type, and security signals when needed to serve the site, diagnose a problem, or prevent abuse.

Your Wi-Fi name and password go from the setup browser or mobile client directly to the display. They are saved on the display after a successful connection and are not sent to Niblet Cloud.

We do not store your plain-text account password, payment-card number, Google access or refresh tokens, or the Apple identity token used to verify a sign-in. For an Apple account, we keep the Apple refresh token encrypted so we can revoke that authorization when you delete the Niblet account. Google sign-in requests only basic identity information needed to authenticate you; it does not ask for Gmail, Drive, Calendar, contacts, or other Google service access. Apple sign-in requests only your name and email and lets you use Apple's private email relay.

We may use analytics services to understand how the website and product are used, measure performance, and find errors. We do not sell personal information, share it for cross-context behavioural advertising, or use analytics to make consequential automated decisions about you.

We use account, display, app, and session information to provide the service you ask for: create an account, connect a display, render a chosen app, deliver a rotation, remember settings, and keep the service secure. Where data-protection law requires a legal basis, this is generally necessary to perform our agreement with you or to take steps you request before entering it.

We use waitlist information with your consent. You can withdraw from the waitlist by contacting us. We process reservation and transaction information to handle your request, prevent fraud, and meet accounting or legal duties.

Limited request, error, and security information is used for our legitimate interests in operating, protecting, and improving Niblet. We do not use that basis to create advertising profiles. Where the law requires consent for a new use, we will ask before starting it.

Niblet uses an HttpOnly session cookie when you sign in on the web. The current web session expires after 12 hours. Native clients keep short-lived access tokens and rotating refresh tokens in the operating system's secure storage. Google sign-in uses a short-lived security cookie and server record. Apple sign-in uses a short-lived, single-use server nonce. These records prevent callbacks or identity tokens from being replayed against another session.

The public website stores preferences, such as dismissal of the Tidbyt migration announcement, in your browser. Cloudflare Turnstile may process a challenge token, IP address, and browser or request signals to distinguish people from automated abuse.

Analytics services may use cookies, local storage, or similar identifiers to measure usage, performance, and errors. Before enabling non-essential analytics where consent is required, we will provide an appropriate choice and identify the material providers in this notice or a linked cookie notice.

An app may need a location, symbol, team, account, API key, or another setting to produce the screen you requested. Ordinary app configuration is stored with the installation. Do not place a password or secret in an ordinary field unless Niblet explicitly marks that field for protected credential handling.

Some apps request data from an outside service, such as a weather, transit, sports, or market provider. That provider receives the information required for its request and applies its own privacy terms. We show the relevant provider and configuration on the app setup page where practical.

Applications are treated as untrusted code and rendered inside constrained, versioned network and runtime boundaries. That reduces access; it does not replace the outside provider’s privacy notice.

We share information with service providers only for the work they perform for us:

• Cloudflare provides bot protection and firmware object storage.
• Stripe hosts reservation checkout and processes payment.
• Postmark sends confirmation and transactional email.
• Google provides optional account authentication.
• Apple provides optional account authentication in the iOS app.
• Infrastructure and database providers, including Hetzner, host the application and its operational data.
• Analytics and error-monitoring providers may process limited usage, device, performance, and diagnostic information when those tools are enabled. We will identify material providers before or when they begin processing personal information for Niblet.

We may also disclose information when the law requires it, to protect people or the service, or as part of a genuine business transfer subject to appropriate confidentiality and notice. We do not give customer data to an acquirer as an unrelated list for advertising.

These providers may process information in countries other than yours. Their published privacy terms and applicable transfer safeguards govern that processing.

We keep information for the shortest period that still lets us provide the requested service, protect it, and meet payment, accounting, fraud-prevention, or legal duties.

• Waitlist information remains until the launch communication is complete or you ask us to remove it. Reservation and payment records may remain longer where financial or legal record-keeping requires it.
• Account, display, installation, and app configuration remain while the account is active. Deleting an eligible personal account removes its account and device relationships from the active service. It does not automatically remove a separate waitlist or reservation record.
• Authentication state is short-lived: the current web session lasts 12 hours, Google sign-in state lasts about 10 minutes, an unused Apple nonce lasts about 5 minutes, and an unused password-reset token lasts 30 minutes. Native refresh sessions expire after 30 days and rotate when used. Revoked or expired security metadata may be held briefly for cleanup and abuse prevention.
• Operational logs and render errors remain only as long as reasonably needed to diagnose delivery, security, and reliability issues.
• Content-addressed app and render assets may remain after they are no longer referenced so they can be safely garbage-collected or reused without duplicating identical public output. Do not put personal information into an app image or field unless the app requires it.

You can sign out at any time and delete an eligible single-user account from the Account page. Because a waitlist or payment record has a different purpose, contact us if you also want that record removed. We may need to keep a limited transaction record where law, refunds, accounting, fraud prevention, or a dispute requires it.

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of personal information; object to certain uses; withdraw consent; or complain to a data-protection authority. These rights are not absolute, and we may need to verify that the request belongs to you.

Send a request to [email protected]. We will respond within the period required by the law that applies to you.

Passwords, session tokens, device tokens, API keys, email confirmation tokens, password-reset tokens, and enrollment tokens are stored as cryptographic hashes where the service only needs to verify them. Device enrollment and password recovery are short-lived, generated assets are addressed by checksum, and device and user routes enforce ownership boundaries.

We use administrative and technical measures appropriate to the information and the current service. No storage or transmission method is perfectly secure. If we learn of a personal-data breach, we will investigate and notify affected people or authorities when applicable law requires it.

Never send us a Wi-Fi password, recovery image containing credentials, private token, or payment-card number in a support message.

Niblet is not designed for a child to create an account or make a reservation independently. You must be at least 18, or the age of legal majority where you live, to create an account or enter a paid transaction without a parent or guardian. We do not knowingly collect personal information from a child in a way that requires parental consent. If you believe that has happened, contact us so we can review and remove it.

We will update this notice before using personal information for a materially different purpose. The date at the top shows the latest version. For a significant change, we will use a reasonable additional notice, such as an account message or email, when appropriate.

Questions, privacy requests, and concerns can be sent to [email protected]. Niblet is owned and operated by Comma Collective Pvt. Ltd., a privately owned company in Singapore. Any registered address or regional representative required for a particular market will be added here before it becomes applicable to the service.