Privacy

Who we are

Viaduct Industries Limited is responsible for the personal data described here. We’re registered in England & Wales, company no. 15728702, at 3rd Floor, 86–90 Paul Street, London, EC2A 4NE. For anything about your data, email [email protected].

Your Nifty data

Your notes, people, tasks, projects, documents and calendars are stored on your own computer or server. We don’t receive, store or have access to them.

If you connect Nifty to an AI model, a calendar feed or another service, Nifty talks to it directly. What that service receives, and what it does with it, is up to its own privacy policy.

Nifty Plus makes two exceptions. Emails you forward to your Nifty address, and items other apps send through the Send to Nifty API, pass through our service on their way to your Nifty, as Forwarded emails and sent items explains. With Remote, the traffic between your devices and your Nifty passes through our service encrypted, so we can’t read it.

What we collect

When you buy

Stripe takes your payment. We receive your name, email address, billing country or address (to work out tax), what you bought and what you paid. Your card details go to Stripe, never to us.

We use these to issue your licence key and email it to you, resend it if you lose it, handle refunds and support, and keep the records tax law requires. Your key contains your name and email address, so Nifty can show who it’s licensed to. We keep a record of each key we issue.

We keep purchase records for six years after the end of the tax year of your purchase, as UK tax law requires, and your key’s record for as long as you might need it resent.

The mailing list

If you sign up, we keep your email address so we can tell you when we add something worth knowing about. Every email has a link to unsubscribe, and we keep your address until you do.

Error reports

When something goes wrong, Nifty can send the error to our team so we know exactly what happened and can get it fixed. Reports don’t include your notes or anything else you keep in Nifty, or your name, username or email address.

A report holds the error and when it happened, where in Nifty’s code it happened, Nifty’s version, your operating system and processor type and, in a browser, which browser. If the desktop app’s own server stops, it also holds the last few lines that server printed. Before a report leaves your device, Nifty takes out personal details such as quoted text, email and web addresses, your home folder’s name, IP addresses and long numbers, and our relay does it again. What a report holds has the full list.

On full releases, error reports are off unless you turn them on in About Nifty or the desktop app’s settings. Beta versions always send them. Your IP address reaches us with each report, as with any internet request; we use it only to limit how many reports arrive, and don’t store it. We keep reports only as long as they help us fix problems.

Update checks

Nifty checks thenifty.app for new versions and downloads them from there. These requests may show which version and platform you’re on. They don’t include your licence key or anything about you, but like any internet request they carry your IP address.

Our websites

There are no analytics, ads or tracking cookies on our websites, including the help. This site remembers whether you chose light or dark and which currency you prefer in your own browser, and never sends them to us. Our host, Cloudflare, uses your IP address to deliver the sites and keep them secure, and tells this site which country you’re in so it can show your currency.

When you email us

If you email us, we keep the conversation so we can help you, and for as long as it’s useful for that.

Forwarded emails and sent items

With Nifty Plus, you can forward emails to your own Nifty address. Our service receives each email, checks its size and sender, and encrypts it straight away with a key that only your copy of Nifty has. We can’t read it while it waits. Your Nifty collects it within minutes, and we delete it then, or after 7 days if it isn’t collected.

We keep your address, the senders you allow, and when each waiting email arrived and how big it is. We don’t log who sent an email, who it was to or what it says.

With the Send to Nifty API, apps you give a token to can send tasks, notes, events, documents and emails to your Nifty. Our service checks each item and encrypts it in the same way. If an app sends a link to a file rather than the file, our service downloads it from that link, then encrypts it.

For each token, we keep the name you give it, a fingerprint of it rather than the token itself, its last four characters, and when it was last used. We also keep any key an app sends to avoid sending something twice (for 7 days), and for each item its kind, its size, when it arrived and what became of it (for 30 days after it’s collected or expires). We don’t log what an item says, or the links apps send.

Remote

With Nifty Plus, Remote lets your own devices reach your Nifty through our service. Your Nifty and your devices encrypt everything they send each other, so we can’t read it. Our service only passes it on.

To do that, we keep your Nifty’s Remote address, which copy of Nifty it belongs to, the time its current connection runs out, a fingerprint of each paired device’s pass (so we can turn away devices you’ve revoked), and how much has passed through this month (for the fair-use limit). Like any internet connection, ours sees your devices’ and your Nifty’s IP addresses and when they connect. We use them only to deliver the traffic and limit abuse, and don’t store them. Because each device has its own pass, our service can tell your devices apart, but never what they send.

When you pair a device, we keep a fingerprint of its code, and the Remote address it leads to, until the code expires a few minutes later.

Within 31 days of your Nifty’s last connection to Remote ending, we delete all of this except your Remote address and which copy of Nifty it belongs to. We keep those for as long as we run Remote, so that another copy of Nifty, such as one made from an old copy of your data, can’t take over the address and let a device you’ve revoked back in.

Why we’re allowed to use it

• To sell you a licence: we need your details to fulfil our contract with you.
• To provide Nifty Plus (forwarding, the Send to Nifty API, Unsplash searches and Remote): we need it to fulfil our contract with you.
• To keep tax records: the law requires it.
• The mailing list and error reports on full releases: you’ve agreed to them, and you can change your mind at any time.
• Error reports in betas, update checks and keeping the site secure: our legitimate interest in making Nifty work well and safely.

Who we share it with

We don’t sell your data or share it for advertising. We use these companies to run Nifty, and they handle your data on our instructions:

• Stripe: payments and tax. Stripe also uses payment details under its own privacy policy, for example to prevent fraud.
• Brevo: emailing your licence key and the mailing list.
• Cloudflare: hosting our websites, downloads, licence keys, error reports and Nifty Plus, including receiving forwarded emails and sent items, and relaying Remote.
• Sentry: storing error reports, in the European Union.

Some of them are based in, or use providers in, the United States. When your data leaves the UK, it’s protected by UK adequacy regulations or the standard contractual clauses the law approves.

We’ll also share data if the law requires us to.

Your rights

You can ask us for a copy of your data, or to correct it, delete it, limit how we use it or send it to you in a portable form. You can object to how we use it, and withdraw your consent at any time. Email [email protected]. We may need to keep purchase records for tax, and if we delete your key’s record we won’t be able to resend it.

If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office, or to the data protection authority where you live.

Changes to this policy

If we change how we handle your data, we’ll update this page and the date at the top.