This Privacy Policy describes how Nab Ventures LLC ("nab.it", "we", "us") collects, uses, and discloses information when you use nab.it and related services (the "Service"). By using the Service, you agree to this policy.
What data we collect
- Account data: email address and display name when you register or sign in.
- Product content: nabs, notes, attachments, tags, reminders, and other information you create or store in the app.
- Operational data: the technical records our infrastructure providers keep to run and secure the Service — for example request logs and security events. We do not currently run any product analytics or behavioural event tracking, in the app or on this website. If that changes, we will update this policy before it does.
How we store and protect data
We host application data on Supabase (managed Postgres, authentication, and serverless backend functions). Our web properties are served and protected through Cloudflare. Data is protected with encryption in transit (TLS) and encryption at rest as provided by our infrastructure. An earlier version of the Service used Firebase / Firestore. That migration to Supabase is complete and no live traffic touches Firebase; the old project is retained, inactive, only as a rollback path and will be deleted once the migration is confirmed settled. Access is limited to authorized personnel and systems for operations, security, and support.
Third-party services
- Supabase — database, authentication, and the serverless functions that power the Service's backend.
- Cloudflare — content delivery, hosting, and edge security (for example DDoS and bot protection) for our web properties.
- Stripe — payment processing and subscription billing when you purchase a paid plan. Stripe receives billing-related information as needed to process payments.
- Anthropic — optional AI-powered features (for example Reflect) when you choose to use them; your prompts and related content may be sent to Anthropic to generate responses.
- Google — Google Calendar, only if you choose to connect that integration. Google's privacy policy also applies to information processed by Google.
- Resend — transactional email delivery (for example sign-in codes, notifications).
Google user data
nab.it does not offer sign-in with Google. The only way to sign in is a one-time code sent to your email address, so we never receive a Google profile, name, or profile picture for authentication.
Google user data reaches nab.it only if you explicitly connect the Google Calendar integration.
That connection requests two read-only scopes —
calendar.readonly and calendar.events.readonly — which let the app
display your existing events alongside your day. nab.it cannot create, edit, or delete anything
in your Google Calendar, and requests no access to contacts, Drive, or email. Your Google
credentials are stored encrypted. You can revoke nab.it's access at any time from your
Google Account permissions page, and
deleting your nab.it account revokes them too; an in-app disconnect control is on the way.
nab.it does not transfer Google user data to third parties and does not use it for AI model
training.
Cookies and similar technologies
We use cookies and similar technologies for essential purposes, including: session and authentication security; preferences (for example theme and language). We set no analytics or advertising cookies, and we do not sell your personal data.
Your rights
Depending on your location, you may have the right to access your personal data, request deletion, and export data where the product provides export tools. You may contact us using the email below to exercise these rights. We will respond within a reasonable period as required by applicable law.
Data retention
While your account is active, we retain the product data you store in nab.it so the Service can function. When you delete your account, we delete or irreversibly anonymize personal data within 30 days, except where a longer retention period is required by law or for legitimate security or fraud-prevention purposes. Security-related audit logs may be kept for up to 365 days where needed for compliance and abuse prevention, then removed. Database backups follow our hosting providers' retention policies (Supabase and Cloudflare).
Public marketing pages do not currently use Google Analytics or any other third-party analytics script — only essential cookies (session, authentication security, theme and language preferences) are set. If that changes, we will update this policy first and any new analytics will only load after you consent.
GDPR (EEA/UK)
If the GDPR applies, you may have rights including access, rectification, erasure ("right to be forgotten"), restriction of processing, objection, and data portability. You may lodge a complaint with your local supervisory authority. Our lawful bases may include contract, legitimate interests (for example security and product improvement), and consent where required.
LFPDPPP (Mexico)
If you are located in Mexico, the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) applies to our processing of your personal data. The party responsible ("responsable") for your data is Nab Ventures LLC, reachable at info@nab.it.com for any privacy request.
Purposes. Primary purposes, necessary to provide the Service: creating and operating your account, storing and syncing your content, authentication, billing for paid plans, and customer support. Secondary purposes, which you may opt out of without affecting the Service: improvement communications. (We run no product analytics today; if we ever add any, it will be a secondary purpose you can opt out of.) To opt out of secondary purposes, email us at the address above.
ARCO rights. You have the right to Access your personal data, request its Rectification if inaccurate, request its Cancellation (deletion) when it is no longer necessary, and Oppose certain processing. To exercise any ARCO right, email info@nab.it.com with your request; we will respond within the timeframes established by the LFPDPPP. You may also revoke any consent previously given, subject to legal or contractual limitations.
If you believe your rights under the LFPDPPP have not been respected, you may file a complaint with INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales) at home.inai.org.mx.
Children
The Service is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact us and we will take appropriate steps to delete it.
Changes
We may update this Privacy Policy from time to time. We will post the updated policy on this page and, where appropriate, notify you by email or in-product notice.
Contact
Nab Ventures LLC — Privacy inquiries: info@nab.it.com