Privacy notice

Niblet is owned and operated by Comma Collective Pvt. Ltd., a privately owned company in Singapore. In this notice, “Niblet”, “we”, and “us” mean Comma Collective Pvt. Ltd. We are responsible for deciding why and how personal information is used for the Niblet services.

This notice covers heyniblet.com, cloud.heyniblet.com, the waitlist and early believer reservation, Niblet accounts, the dashboard, mobile app, browser-based device setup, supported firmware, and the Niblet Cloud service. A third-party website, data provider, application, or community forum has its own notice.

We collect only the information needed for the part of Niblet you choose to use:

• Waitlist and email: your email address, confirmation state, reservation choice, delivery timestamps, and any delivery error needed to send the message.
• Accounts: your name, email address, a password hash when you use a password, or the Google or Apple account identifier used to sign you in. Apple may provide a private relay address when you choose to hide your email. We also keep short-lived session, sign-in, and password-recovery security records.
• Displays: a device identifier and name, hardware profile, credential hashes, firmware release, brightness, last contact time, installed apps, their order and timing, and configuration you choose to save. When you search for a place while setting up an app, we process the search text and save the coordinates, place label, and timezone you choose with that app.
• Selected photos and GIFs: when you choose an image for a Photo, GIF, or Slideshow app on the web or mobile app, we store only the item you select in your private Niblet media library so your display can show it. Choosing an image does not give Niblet access to your entire phone photo library. You can remove an upload when it is no longer used by a saved display app.
• Rendering and delivery: generated display assets, render state, errors, and the request information needed to deliver the correct rotation to the correct display.
• Usage and performance: when analytics are enabled, information such as pages and features used, approximate device and browser details, referral source, session events, performance measurements, and errors.
• Support: the message and contact details you send when you ask us for help. When you are signed in, live chat also receives your Niblet account ID, name, email, and current page so we can identify the conversation and understand where you need help.
• Reservations: Stripe checkout and payment identifiers and payment status. Stripe, not Niblet, receives and stores your card details.

Our servers and network providers may also process ordinary technical information such as IP address, request path, time, browser type, and security signals when needed to serve the site, diagnose a problem, or prevent abuse.

Your Wi-Fi name and password go from the setup browser or mobile client directly to the display. They are saved on the display after a successful connection and are not sent to Niblet Cloud.

We do not store your plain-text account password, payment-card number, Google access or refresh tokens, or the Apple identity token used to verify a sign-in. For an Apple account, we keep the Apple refresh token encrypted so we can revoke that authorization when you delete the Niblet account. Google sign-in requests only basic identity information needed to authenticate you; it does not ask for Gmail, Drive, Calendar, contacts, or other Google service access. Apple sign-in requests only your name and email and lets you use Apple's private email relay.

We may use analytics services to understand how the website and product are used, measure performance, and find errors. We do not sell personal information or use analytics to make consequential automated decisions about you. When advertising cookies are enabled, we share marketing-page visits, product views, checkout starts and confirmed purchases with Meta to measure and improve our advertising. When enabled at checkout, our server may send a confirmed purchase to Meta with the amount paid, order identifier, browser advertising identifiers and a one-way hash of the checkout email address. Meta may associate these events with your Meta account and use them for advertising under its own privacy policy.

We use account, display, app, and session information to provide the service you ask for: create an account, connect a display, render a chosen app, deliver a rotation, remember settings, and keep the service secure. Where data-protection law requires a legal basis, this is generally necessary to perform our agreement with you or to take steps you request before entering it.

We use waitlist information with your consent. You can withdraw from the waitlist by contacting us. We process reservation and transaction information to handle your request, prevent fraud, and meet accounting or legal duties.

Limited request, error, and security information is used for our legitimate interests in operating, protecting, and improving Niblet. We do not use that basis to create advertising profiles. Where the law requires consent for a new use, we will ask before starting it.

Niblet uses an HttpOnly session cookie when you sign in on the web. The current web session expires after 12 hours. Native clients keep short-lived access tokens and rotating refresh tokens in the operating system's secure storage. Google sign-in uses a short-lived security cookie and server record. Apple sign-in uses a short-lived, single-use server nonce. These records prevent callbacks or identity tokens from being replayed against another session.

The public website stores preferences, such as dismissal of the Tidbyt migration announcement, in your browser. Cloudflare Turnstile may process a challenge token, IP address, and browser or request signals to distinguish people from automated abuse. Crisp uses a website-specific chat session so a conversation can continue as you move between Niblet pages; we reset its local identity when the signed-in Niblet account changes or signs out.

We keep the first and latest source, medium, and campaign of a visit in a first party cookie for up to 30 days. When you place a preorder, we attach those fields to the order in Stripe and Shopify so we can understand which outreach led to it. We keep the referring domain and landing path, without the referring page query string.

Analytics services may use cookies, local storage, or similar identifiers to measure usage, performance, and errors. Before enabling non-essential analytics where consent is required, we will provide an appropriate choice and identify the material providers in this notice or a linked cookie notice.

Meta Pixel runs on our home, shop, preorder thank-you, app catalog and developers pages. For visitors identified as being in the United States, advertising cookies are enabled unless you opt out or your browser sends Global Privacy Control. Elsewhere, or when your region cannot be determined, we ask permission first. It may receive your IP address, browser details, page URL and referral information, cookie identifiers, selected product, quantity, currency and checkout value. We do not intentionally send account details, app settings or device credentials through the pixel, and do not enable automatic advanced matching.

You can turn advertising off using Advertising cookie preferences or Do not sell or share my personal information in the footer. We store your choice in your browser and honor Global Privacy Control by keeping the pixel off. Cloudflare provides a US-or-non-US region signal based on your connection so we can show the appropriate choice. This lookup does not return an IP address or precise location to our website. These advertising preferences do not change the settings of other services or automatically transfer to the checkout provider.

Stripe hosts our preorder checkout and processes your payment, contact and shipping details. Card details stay with Stripe. We send confirmed orders, customer details, shipping addresses and payment records to Shopify for order management and fulfillment. These providers have their own privacy settings. When Meta data sharing is enabled in Shopify, Shopify may send purchase events, order value and currency, and customer matching information such as your name, email address, phone number and location to Meta according to those choices. Meta can use this information to match your activity to a Meta account, measure advertising results and deliver relevant advertising on Facebook and Instagram, as described in Meta’s privacy policy.

An app may need a location, symbol, team, account, API key, or another setting to produce the screen you requested. Ordinary app configuration is stored with the installation. Do not place a password or secret in an ordinary field unless Niblet explicitly marks that field for protected credential handling.

Some apps request data from an outside service, such as a weather, transit, sports, or market provider. That provider receives the information required for its request and applies its own privacy terms. We show the relevant provider and configuration on the app setup page where practical.

Applications are treated as untrusted code and rendered inside constrained, versioned network and runtime boundaries. That reduces access; it does not replace the outside provider’s privacy notice.

We share information with the following service providers and advertising partners for the purposes described below:

• Cloudflare provides bot protection and firmware object storage.
• Meta provides advertising measurement when advertising cookies are enabled.
• Shopify hosts preorder checkout and order processing.
• Stripe hosts reservation checkout and processes payment.
• Postmark sends confirmation and transactional email.
• Loops stores opted-in audience details and provides lifecycle and marketing email tools.
• Crisp provides the website live chat and support inbox.
• PostHog provides product analytics and session diagnostics when analytics are enabled.
• Photon provides place search using OpenStreetMap data when you choose a location for an app. Niblet sends the search from its server rather than exposing your browser directly to the search service.
• Google provides optional account authentication and Google Analytics, which helps us understand website usage and performance.
• Apple provides optional account authentication in the iOS app.
• Infrastructure and database providers, including Hetzner, host the application and its operational data.
• Error-monitoring providers may process limited device, performance, and diagnostic information when those tools are enabled. We will identify material providers before or when they begin processing personal information for Niblet.

We may also disclose information when the law requires it, to protect people or the service, or as part of a genuine business transfer subject to appropriate confidentiality and notice. We do not give customer data to an acquirer as an unrelated list for advertising.

These providers may process information in countries other than yours. Their published privacy terms and applicable transfer safeguards govern that processing.

We keep information for the shortest period that still lets us provide the requested service, protect it, and meet payment, accounting, fraud-prevention, or legal duties.

• Waitlist information remains until the launch communication is complete or you ask us to remove it. Reservation and payment records may remain longer where financial or legal record-keeping requires it.
• Account, display, installation, and app configuration remain while the account is active. Deleting an eligible personal account removes its account and device relationships from the active service. It does not automatically remove a separate waitlist or reservation record.
• Authentication state is short-lived: the current web session lasts 12 hours, Google sign-in state lasts about 10 minutes, an unused Apple nonce lasts about 5 minutes, and an unused password-reset token lasts 30 minutes. Native refresh sessions expire after 30 days and rotate when used. Revoked or expired security metadata may be held briefly for cleanup and abuse prevention.
• Operational logs and render errors remain only as long as reasonably needed to diagnose delivery, security, and reliability issues.
• Content-addressed app and render assets may remain after they are no longer referenced so they can be safely garbage-collected or reused without duplicating identical public output. Do not put personal information into an app image or field unless the app requires it.

You can sign out at any time and delete an eligible single-user account from the Account page. Because a waitlist or payment record has a different purpose, contact us if you also want that record removed. We may need to keep a limited transaction record where law, refunds, accounting, fraud prevention, or a dispute requires it.

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of personal information; object to certain uses; withdraw consent; or complain to a data-protection authority. These rights are not absolute, and we may need to verify that the request belongs to you.

Send a request to [email protected]. We will respond within the period required by the law that applies to you.

Passwords, session tokens, device tokens, API keys, email confirmation tokens, password-reset tokens, and enrollment tokens are stored as cryptographic hashes where the service only needs to verify them. Device enrollment and password recovery are short-lived, generated assets are addressed by checksum, and device and user routes enforce ownership boundaries.

We use administrative and technical measures appropriate to the information and the current service. No storage or transmission method is perfectly secure. If we learn of a personal-data breach, we will investigate and notify affected people or authorities when applicable law requires it.

Never send us a Wi-Fi password, recovery image containing credentials, private token, or payment-card number in a support message.

Niblet is not designed for a child to create an account or make a reservation independently. You must be at least 18, or the age of legal majority where you live, to create an account or enter a paid transaction without a parent or guardian. We do not knowingly collect personal information from a child in a way that requires parental consent. If you believe that has happened, contact us so we can review and remove it.

We will update this notice before using personal information for a materially different purpose. The date at the top shows the latest version. For a significant change, we will use a reasonable additional notice, such as an account message or email, when appropriate.

Questions, privacy requests, and concerns can be sent to [email protected]. Niblet is owned and operated by Comma Collective Pvt. Ltd., a privately owned company in Singapore. Any registered address or regional representative required for a particular market will be added here before it becomes applicable to the service.