Privacy Policy

Last updated: 12 November 2026. Applies to the “Nodbase” app on iPhone, its App Clip and the app’s website. This is a translation; the German version is authoritative.

In short

• Your network stays on your iPhone: contacts, notes, private ratings and imports never go to our server. The app also calculates your network strength only on your iPhone (section 3.17).
• The server only holds what you share with others or what connections, chats and calls technically need: your account, your card with profiles, pictures and videos, requests, connections, meetings, introductions, groups, shared goals, encrypted chat messages on their way to the recipient, your communities with their posts and what you write to us through “Support & Feedback”.
• Chats and calls are end-to-end encrypted. We can neither read nor hear them. Posts in communities are not end-to-end encrypted (section 3.15). Calls run through our own call servers, and the other person does not see your IP address.
• No tracking, no ads, no analytics tools, no selling of data. We only count totals: how many accounts there are and how many of them are active (section 12). For the website, Cloudflare shows us aggregated visitor numbers (section 14).
• You can delete your account in the app at any time.

1. Who is responsible

Controller under the General Data Protection Regulation (GDPR):

Ben Schwöbel
Am Wallstadter Bahnhof 25
68259 Mannheim, Deutschland
Email: support@nodbase.app

“Nodbase” is run by Ben Schwöbel (“we”). The operator is a private individual, not a company. For any privacy question, reach us at support@nodbase.app.

2. What stays only on your iPhone

The app stores this data only on your device. It does not go to our server, and we cannot see it:

• Your network: people and their details (for example role, company, city, how you know each other, what someone can help with, what someone is looking for), contact channels, relationships between people, notes and your history (when you last contacted whom).
• Private ratings: how close you want to keep someone (“Keep in Touch”). Only your app calculates and shows this. For your network strength, see section 3.17.
• Your goals: they stay on your iPhone unless you explicitly share a goal with your network (section 3.13).
• Imported contacts: from your iPhone contacts (only the people you choose are added) or added by you yourself.
• Quick Capture: screenshots and shared content you capture with a shortcut, the Action button, Visual Intelligence, Siri or “Add to Network” (Share). The iPhone recognises the text itself and evaluates it on the device (section 3.12).
• Speech: what you tell the app or dictate as a note is turned into text by on-device speech recognition. The app explicitly requests on-device recognition.
• Your chat history and your call list: messages, received pictures, videos, voice messages and files, your private folder, drafts and the notes about calls (“Call · 12 min”, “Missed call”).
• Settings, for example the app lock with Face ID.
• Several accounts on one iPhone: This data belongs to the account it was created with. If you sign out and another account signs in on the same iPhone, that account only sees its own data. Yours stays protected on the iPhone and is back when you sign in again. You can remove it completely by deleting your account (section 10) or deleting the app from your iPhone. Only device settings, such as the appearance, apply to every account on this iPhone.

How this data is protected: the app encrypts it on the device. The keys are kept in the iOS keychain, for this device only, and are not synced. The files can only be read while your iPhone is unlocked and are excluded from iCloud and computer backups. This also means a new iPhone starts empty. Beforehand you can export your network as a CSV file (Settings › Data & Storage › Export Network).

Data about other people in your network is processed by you for your personal use. We do not receive it. Please handle it with care.

3. What is on our server

Our server is hosted by Supabase and runs in a data centre in the EU (Ireland). The data is kept in a protected area of the database. It can only be read and written through our server functions, and each of them checks who is signed in and what that person may see. For calls there are separate call servers (section 3.14).

3.1 Account

• With email: your email address, your password (only as a secure hash, never in plain text), whether your address is confirmed, when you registered and last signed in, and your sessions.
• With Apple: an identifier Apple creates for our app and the email address Apple gives us (if you wish, an anonymous relay address from Apple). Apple only shares your name the first time you sign in. The app keeps it on your iPhone and does not send it to the server.
• With Google: your Google identifier, your email address and what Google sends along at sign-in (name and the address of your profile picture). These details are kept by the sign-in service with your account.
• We send confirmation and password codes by email. A code is valid for one hour.
• When registering, you confirm that you are at least 16 years old and accept the Terms of Use. We record which version you accepted and when, and whether you confirmed your age through Apple or with your own statement. No date of birth is stored. We store your account’s age level (16 or 18) and where it comes from. It decides whether you can see 18+ communities.

3.2 Card, profiles, pictures and videos

• Your card and your further profiles (for example business or personal), with exactly the details you release: name, role, company or project, city, about, interests, what you are looking for, languages, education, career, phone number, contact email, website, links, profiles on other services (for example Instagram, LinkedIn, TikTok or Snapchat), and up to twelve custom fields.
• Up to 13 pictures and videos per profile: up to three posts with up to four pictures or videos each, and one landscape video. Pictures as JPEG of at most 2 MB, videos as MP4 of at most 3 minutes and 50 MB, with a cover picture. The server measures the length of every uploaded video itself. Before uploading, your iPhone removes the location and other metadata from videos.
• Pictures and videos are kept in storage that can be fetched without signing in via their exact address. The address contains a random folder name, not your user ID, and can neither be guessed nor listed. But anyone who knows the address, for example because they saw your profile, can fetch the picture or video until you delete it. If you delete your account, the server removes your pictures and videos shortly afterwards, usually within an hour. Until then they can still be fetched via their address. If you hide the pictures of a card, the app takes them off that card; once no card shows them, it deletes them from the server.
• “For Your Network”: one sentence per profile of at most 90 characters (an older sentence of up to 140 characters stays until you change it). It is kept on our server and goes only to confirmed connections, meaning people you are connected with in the app who received this profile from you. Anyone who only has your link or QR code does not see it, not in the App Clip, the preview or a contact file either. On your connections’ iPhones it is kept encrypted in their network and helps their search, there on the device. If you disconnect or one of you blocks the other, it disappears from the other iPhone at its next sync. A device that never comes online again keeps its copy.
• What your connections see: the profile you show them, with its “For Your Network” sentence. What everyone else sees: nothing, unless they have your link or QR code (section 3.3).

3.3 Links, QR code and App Clip

• For every link and QR code we store a random code. It does not reveal your user ID.
• There are four kinds: the one-time link for one person, the link for several, the bio link and the QR code. Only a one-time link that has not been used yet connects without asking: the first person who confirms it is connected with you right away. After that it no longer opens. An unused one-time link is valid for 30 days. The link for several, the bio link and the QR code always send you a request that you have to accept; the link for several is valid for at most 30 requests and 14 days.
• You can withdraw a link for several and your bio link at any time (Share › Share Link › “Withdraw Link”), and replace your QR code (“Create New QR Code”). After that the old one no longer opens for anyone, and you get a new one. A one-time link is no longer valid after its first use.
• Anyone who opens your link or QR code with Nodbase sees the released profile including pictures and videos. If someone opens the link or QR code without Nodbase, nodbase.app only shows a general page with the way to the app. It does not read the code in the link and shows no details from your profile (section 14). Where the App Clip is available, it also shows a preview of the profile including pictures and videos, even without an account. So only share your link and QR code with people who should see your profile. Your “For Your Network” sentence is not part of it (section 3.2).
• We store who redeemed a link and when, and through which kind a request came.
• Moving up by inviting: If someone creates a new Nodbase account through your one-time link or multi-use link, we store for up to 30 days that this account came through your link (both accounts, the link and the day). Once you are connected and the new account is confirmed, we only keep that you have had your one move-up, and the month; your app then shows you Phase 2. This stays until you delete your account. We store no phase, no strength and no device identifier for this. Legal basis: contract (Art. 6(1)(b) GDPR).
• The App Clip stores an opened link on your iPhone so the app can pick it up after installation.

3.4 Requests, connections and blocks

• Requests: who asks whom, your message with it (at most 300 characters, readable by the recipient and our server), which profile you show, where the request came from (for example a link or QR code), the status (open, accepted, declined, disconnected) and the times. Whoever is declined is not told: to the sender a declined request looks like an open one until it expires 30 days after it was sent. Open requests nobody answers expire 30 days after they were sent; then we delete them.
• Connections and disconnections: who is connected with whom, since when, and who ended a connection when.
• Meetings: if you hold your iPhones together again as connections, we store that and when you met and which of you confirmed it (at most once every 12 hours), so the app can confirm the meeting for both of you. We delete these entries with your connection; when you meet again, we delete entries older than 365 days.
• Blocks: who blocked whom and since when. Someone you block no longer sees your profile and cannot send you requests, message you or call you. Blocking also ends your connection and any call in progress.

3.5 Introductions

When someone introduces you to another person, we store who introduces whom, the reason (at most 300 characters, readable by both of you and our server), your answers and the times. You only see each other’s name and line (for example “Role · Company”), no contact details. An introduction expires after 14 days.

3.6 Groups

For group chats we store the group title (readable by invitees and our server), who is a member, invited, has left or was removed, who invited whom, the roles (admin or member), the times and the group’s settings. The messages themselves are end-to-end encrypted (section 4).

3.7 Chats

• Content: your iPhone encrypts texts, pictures, videos, voice messages, files, locations (including live location), contacts, polls, appointments, tasks, moments, time capsules and link previews before they leave it. The server only sees encrypted data.
• What the server sees (metadata): who writes to whom (already known from your connection or group), when, the approximate size (rounded up), whether it is a message or a technical signal, how far you have read and whether you are typing (only if read receipts and the typing indicator are on), the timer, muted chats and, for time capsules, the time from which they can be opened.
• Time capsules: for each time capsule the server keeps an extra key and only hands it out from the opening time. On its own it opens nothing; the content stays end-to-end encrypted. With it, the server stores who created the time capsule and for which chat. It deletes the key 90 days after the opening time.
• Your chat device: a device ID, public keys, the push token for notifications and the call push token (section 3.14). The private keys never leave your iPhone. One chat device is active per account.
• How long: an encrypted message stays on the server until all recipient devices have fetched it, at most 30 days, and with a timer (1 hour, 24 hours, 7 days or 30 days) at most until it runs out. Encrypted files stay available until the message expires, at most 30 days. Scheduled messages wait encrypted until their time (at most 31 days ahead); after that the same limits apply.
• Live location: if you share your location live (15 minutes, 1 hour or 8 hours), your iPhone sends new positions as encrypted chat messages, also while the app is in the background, until the time is up or you stop sharing. The app takes back older positions as it goes, so usually only the newest one waits on the server.
• Technical helper data: details for safely retrying a send (7 days) and counters against spam (2 days).

3.8 Notifications (push)

So that you notice new chat messages, we store your iPhone’s push token. Our server sends the notification through the Apple Push Notification service (APNs). It only contains the generic text “New message”, technical identifiers and the encrypted content. Only your iPhone decrypts it and shows what you chose under Settings › Notifications › “Notification Preview”. When someone opens a room in a group, the others get a quiet notification (“… opened the room”); it too is an encrypted chat message with no further content, and you can turn it off per group. We send no marketing notifications. When you sign out, we remove the token.

3.9 Reports and moderation

• When you report someone or something, we store who reports, whom or what you report (person, profile, link, request, introduction, group, message or a call), the reason, your note (at most 500 characters) and the time. If you report from a call or room, we note that on the report.
• We also store a snapshot of what you reported, as far as our server can read it anyway: for example the card with its picture addresses and the “For Your Network” sentence you received from that person, the message of a request, the reason for an introduction or the group title. This lets us review the report even if the content was changed in the meantime.
• When you report from a chat, you can include up to five of the latest messages. Your iPhone decrypts them for this and sends them in plain text. We can then read these messages; everything else in the chat stays encrypted. Pictures, videos, voice messages and files are never included; we only learn that a message contained one. You decide whether to include messages.
• Calls are not recorded. A report about a call therefore contains only your description and, if you wish, messages from the chat.
• We are notified of new reports and review them. The notification contains only the report’s identifier, reason, type and time, no names and no content. The reported person does not learn who reported them.
• If we suspend an account, we store which account, the reason, since when and until when. A suspended account can no longer send requests or messages, and nobody sees its card.
• If you delete a suspended account, we keep a check value (hash) of your email address and, if you signed in with Apple, of your Apple identifier, not the address itself, until the suspension ends, for at most 12 months. If someone signs up again with it, the new account is suspended until the same time. This way a suspension cannot be dodged with a new account. Legal basis: legitimate interest (Art. 6(1)(f) GDPR), a safe service for everyone.
• We inform you by email to your account address about any decision that affects your account or your content.

3.10 Protection against abuse

• Texts others see in plain text (fields of your card, the “For Your Network” sentence, shared goals, the message with a request, the reason for an introduction, group titles) are checked automatically by the server for clearly prohibited terms when saved. If the filter matches, the text is not saved and you can change it. The filter cannot check chats because they are encrypted.
• The server also checks the “For Your Network” sentence for contact details (links, @names, phone numbers, email addresses) and that it is written as a sentence, not as a list of keywords. You can change it at most 20 times a day.
• iOS can check pictures in chats and video in calls for nudity on the device and blur them if “Sensitive Content Warning” is on in your iPhone settings (Settings › Privacy & Security). The result never leaves your iPhone.
• Limits cap how many requests, messages, groups, introductions, calls and reports an account can send in a short time, for example at most 20 new requests a day. If someone declines your request, you are not told: to you it stays open until it expires 30 days after it was sent, and until then you cannot ask that person again, unless they send you a request themselves.

3.11 Technical logs

Running the server creates logs of requests to it, for example IP address, time, the interface called, the result and the app version, as well as sign-in events. We use them only to run the service, find errors and fend off attacks. Supabase deletes them automatically after a few days. For the logs of the call servers, see section 3.14.

3.12 Nodi and recognition on the device

• What for: when you talk about people, capture a profile or screenshot, or search your network, the app recognises who is meant and what you say about them (for example name, role, company, how you met) and suggests entries for your network or finds the people who fit.
• Where: only on your iPhone. For this the app uses Apple Intelligence on the device if your iPhone supports it and it is turned on, otherwise simple rules. Nothing leaves your iPhone for this: no text, no names, no answers (for loading the titles of shared links see section 5). There is no AI provider and no server involved, not even ours.
• What we store: nothing. The recognition counts nothing and writes nothing into logs on a server.
• Conversation with Nodi: in the Nodi tab, Nodi answers on iPhones with at least 8 GB of memory (iPhone 15 Pro and later, iOS 26.4 or later) with an AI language model that runs only on your iPhone; on other iPhones it answers with fixed rules, also only on the device. Your iPhone downloads the model (about 2.5 GB) once through Apple’s App Store; nothing from Nodbase is sent along, and you can delete it in Settings › Nodi. The conversation and what Nodi remembers from it are stored encrypted on your iPhone. Nodi does not read chats and sends nothing to a server, not to us either.
• Nodi’s memory: if you tell Nodi something about yourself it should remember (for example “Call me Ben”, “Keep answers short”, “Speak English with me” or what you’re working on), Nodi proposes it as an entry. It is only saved once you approve it. Under Settings › Nodi you can choose “Learn Automatically” instead: then Nodi itself saves what it learns about you that lasts (such as your name, where you live, your job, preferences or goals) and tells you in its answer each time what it remembered, with “Undo”. Nodi never saves information about health, religion or beliefs, political opinions, trade union membership, sex life or sexual orientation, ethnic origin or criminal offences on its own. The entries (at most 30, each at most 120 characters) are stored only on your iPhone, encrypted and separately for each account, and go neither into a backup nor to any server, not to us either. Nodi uses them only on the device for its answers. Under Settings › Nodi › “What Nodi Remembers” you can see, change and delete them, also all at once (“Forget Everything”); “forget that” in the conversation deletes at once. If you delete your account, the app deletes them too.

3.13 Shared goals

• A goal (for example “find a tax adviser in Mannheim”) only goes to our server if you turn on “Share with your network” for it. We then store its text (at most 160 characters) and when you shared it and last changed it. You can share at most 8 goals.
• Your connections can see it in the app under “Insights” while you are connected. Our server can read the text and checks it with the word filter (section 3.10).
• If you stop sharing or delete the goal, we remove it from the server.

3.14 Calls and rooms

With Nodbase you can call your connections (voice or video), enter a room in your groups, and share your screen during a call.

• Who can call you: only your connections (one to one) and members of your group (room). You do not need a phone number. Under Settings › Calls › “Calls From” you choose who may call you (“All Connections” or “No One”). You can mute calls from a person. Blocked people can never reach you. There are no random calls and no open rooms.
• Encrypted: audio, video and the shared screen are encrypted on your iPhone before they leave it. The keys exist only on the devices in the call. Our call servers only pass on encrypted packets and cannot open them. We can neither listen nor watch, and we record nothing: no software for recording or relaying conversations is set up on our call servers.
• Through our call servers: every call, including calls between two people, and every room runs through one of our call servers (the open-source software LiveKit, operated by ourselves, not a cloud service of LiveKit). Your iPhone connects only to that server, never directly to the other person’s iPhone. The other person therefore never sees your IP address. There is no switch for this; it always applies.
• What the call servers process: the IP addresses of the devices that connect; a random room name and, per device, a random identifier that is new for every call and every room session; when someone joins and leaves; whether audio, camera or screen is being sent and whether someone is muted; the amount of data transferred and a loudness value that travels in the header of the audio packets; and the details the call software itself sends when connecting (device type, iOS version and software version, for example “iPhone” and “iOS 27”). From the loudness value the server can tell who speaks when, but not what is said. In addition, short messages pass through the call server, with which the devices identify themselves to each other and exchange keys. These messages are encrypted with keys the call server does not have. Which account, device or group stands behind an identifier is known only to our server at Supabase (see below), not to the call server. The call server does not see names, account, device or group identifiers, content, audio or video.
• What our server at Supabase stores for calls: who calls whom (the connection), the time, the state (ringing, answered, declined, busy, missed, ended), the region of the call server, the room name and a random value from which the identifiers on the call server are made. For rooms: which group currently has an open room, which devices are in it right now and how many, and who is currently ringing all members. If an admin takes someone out of a room, the server remembers that for 15 minutes. Not stored: content, whether it was audio or video, the duration and names. We also store your iPhone’s call push token, your “Calls From” setting, the chats where you muted calls, the groups for which you turned off room notifications, and counters against abuse.
• Short-lived entries: a call rings for at most 60 seconds and lasts at most 8 hours. About 2 minutes after it ends the server deletes the entry; it cleans up every minute for this. A device counts as being in a room only while it keeps reporting (at most 75 seconds without a sign of life). We delete an empty room 6 hours after the last join. Abuse counters last at most one day. The call servers log only warnings and errors, never content, and delete their logs after one day. These logs may contain IP addresses.
• No call history on the server: the call list and the notes in the chat (“Call · 12 min”, “Missed call”) exist only on your iPhone: the notes in the encrypted chat storage, the call list in a file with iOS file protection, not in the backup. The caller’s app sends the “Missed call” note as an ordinary encrypted chat message (section 3.7). Nodbase calls appear in the call list of Apple’s Phone app only if you turn on Settings › Calls › “Show in Phone App”; it is off by default. If it is on, iOS may sync that list with your other devices through iCloud. Apple handles that.
• Call push via Apple: so that your iPhone rings even when the app is closed, our server sends a call push through the Apple Push Notification service (VoIP push). It contains technical identifiers (call, connection or group, caller, devices), times and the encrypted header of the invitation, but no name and no content. Apple learns that a call push went to your iPhone. Your iPhone reads the name on the Lock Screen from its own data.
• Where the call servers are: at Hetzner Online GmbH, in Helsinki (Finland) and in Ashburn (Virginia, USA). Which location a call uses is decided by the app of the person who calls or opens a room: it measures which location answers fastest and remembers only the region on the iPhone for 24 hours. Whoever is called or joins the room connects to the same server. If a location has a fault, a call can run through the other one. A call between people in Europe can therefore also run through the server in the USA. The same data arrives there as in Helsinki: audio, video and screen only encrypted, plus the technical details above, above all your IP address (for the transfer, see section 7). We will name further locations here before we use them.
• What the other person sees: the audio, video and shared screen you send. They do not see your IP address. Anyone in the call can still record it, for example with another device or iOS screen recording. The app cannot prevent that. Recording is only allowed with everyone’s consent (Community Guidelines).
• Protection: at most 30 calls per hour, at most 5 calls per hour to the same person and “Ring Everyone” at most 10 times per hour. In a call you can block and report the person (section 3.9). In video calls your iPhone can blur images showing nudity if “Sensitive Content Warning” is on in iOS. Only your iPhone checks this; none of it goes to us.
• Legal basis: contract (Art. 6(1)(b) GDPR) for the call, including the choice of location; legitimate interest (Art. 6(1)(f) GDPR) for the limits against abuse and the logs of the call servers, that is, for a safe and stable service. The app uses the camera and microphone only with your permission in iOS (section 5).

3.15 Communities

Communities are shared rooms for many people. Unlike chats, they are not end-to-end encrypted: our server can read their content so that moderators and we can enforce the rules and review reports. Everything is sent encrypted (TLS) and stored encrypted at Supabase in the EU (Ireland).

• What we store: the name, description, picture and settings of a community (for example 16+ or 18+, who may post, how long posts stay), its rooms and groups; your membership with role (creator, admin, moderator or member), state (requested, member, left, removed or banned) and when you joined, the profile you appear with there and whether you are visible under “People”; invitations, codes and join requests; your posts with text, pictures, replies, reactions and mentions; how far you have read; moderation measures (hide, time-out, remove, ban) in the community’s log.
• Who sees what: communities cannot be searched for. Only people with a code, a link or an invitation get in. Only members see posts and pictures. Under “People”, members see the others who are visible there, with the details of the profile each person chose for this community. Moderators see reports from their community, but not who reported.
• Reporting and moderation: if you report a community, a post or a member, we store the report as in section 3.9, with the community’s name and, for posts, the text, the author and up to 5 posts before it (from exclusive groups only the post itself). Only we see reports for urgent reasons (child safety, intimate images, violence).
• Protection: new members can post at most 10 times per hour and without links for their first 24 hours, and pictures only after 7 days. There are also counters against spam and a word filter.
• How long: posts as long as the community sets (30 days to 1 year or unlimited, 1 year by default); then the server deletes them with their pictures. With “Unlimited” they stay until the community is deleted or the author deletes them or their account. Membership and its state as long as the community exists or until you delete your account. Your posts go with your account. If the creator of a community leaves, another member takes over.
• Legal basis: contract (Art. 6(1)(b) GDPR) for the community, legitimate interest (Art. 6(1)(f) GDPR) for moderation and protection against abuse.

3.16 Support & Feedback

In the app you can write to us under Settings › Support & Feedback: a question, “Something isn’t working” or an idea.

• What we store: the kind of message, your text (at most 1,000 characters), your account, the time and whether we have settled the message. With “Something isn’t working”, if you leave “Include Technical Details” on, the app version, the iOS version and the device type (for example “iPhone17,1”) are added, nothing else: no device name, no location, no contacts. There are no attachments or screenshots. The message is not end-to-end encrypted so that we can read it; it is sent encrypted (TLS).
• What for: to answer your question, find a problem or consider your idea, and to handle appeals against an account suspension. If needed, we reply to your account’s email address; if you hid your address with “Sign in with Apple”, Apple forwards the reply to you. We are notified of a new message (section 6); the notification contains only its kind and time, never your text.
• Protection against abuse: at most 3 messages in 24 hours and 10 in 7 days per account, and the same text only once. A suspended account can write this way too, with the same limits.
• How long: until we have settled the message and 180 days after that. If you delete your account, we delete your support messages with it.
• Legal basis: contract (Art. 6(1)(b) GDPR); for the limits against abuse, legitimate interest (Art. 6(1)(f) GDPR).

3.17 Network strength

Network strength is optional and off by default. If you turn it on, the app calculates your phase, your bar, your circles and the brain only on your iPhone. While it is off, the app calculates none of this. None of it goes to our servers, and we cannot see your strength. The only exception is moving up by inviting (section 3.3).

• What the app uses while strength is on: whom you swapped cards with in person and in which weeks you met again (confirmed meetings, section 3.4), and also per contact and week the number of days on which you replied to each other in one-to-one chats. For this the app reads on your iPhone when messages were sent and by whom, your contact’s too, never the content. It also uses the phase of the phase card a connection shows you on their profile.
• What it becomes: every four weeks the app forms your closest (up to 10), close (up to 50) and wider circle (up to 150) from your contact. You can keep up to 5 people in your closest circle, and you can quietly take anyone out. Someone who shows you a higher phase card counts more. If someone in your circles grows stronger, shows you their phase card and you stay in touch, you grow with them; if a lot of this comes together, Nodi shows “tailwind” under Strength. Only you see your circles, phase and bar.
• Even while strength is off: the app remembers on your iPhone whom you swapped cards with in person and met again. It needs this for “Met”, “Keep in Touch”, your history and the brain, and it unlocks your phase cards from it (contract, Art. 6(1)(b) GDPR). It does not calculate meeting weeks, reply days, circles, tailwind or growing along then.
• What others see: others only see the card you show on your profile; you can also choose a lower one. A phase card shows that you have reached its phase; your connections’ apps use this, only on their iPhones. If you show none, nobody sees your phase. Which card you show is stored with your profile on our server (section 3.2).
• Where it is kept: the app stores reply days, meeting weeks, circles and your choices to keep people in a separate protected file on your iPhone, not in backups, with contacts only as a check value (hash). Reply days are kept for at most 12 weeks. Phase, history, cards and the notes of whom you are connected with are kept in the app’s settings and can end up in your iPhone backup. When you turn strength on, the app creates a key that only shows that it is on; it is kept in this iPhone’s keychain, without iCloud sync, and is never sent.
• Turning off and deleting: if you turn strength off, the app deletes what it counted from chats, the meeting weeks and the key. What you reached (phase, circles, your choices for the closest circle, phase cards) stays on your iPhone. If you delete your account, it deletes everything. If you only delete the app, iOS deletes its data too but may keep the key.
• Legal basis: your consent when you turn it on (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You withdraw it by turning strength off.
• Later: a part on our server that protects strength against fraud may be added later. We will then update this policy beforehand and tell you in the app, and it will only run if you turn it on yourself.

3.18 Invitations to special cards

We hand out special cards (for example the Black Card) ourselves, in a limited number per country. For this we may also note people who do not have a Nodbase account yet.

• What we store: name, one way to contact you (for example an email address or phone number), country, region and town size, where we know you from (source), whether you are of age, a note, the card and the state of the invitation (noted, invited, accepted, declined, expired, withdrawn) with the times. With the invitation come a random code for your invitation link and, once the invitation reaches you in the app, the link to your Nodbase account: because you opened the link or because your account's confirmed email address is exactly the contact we noted. Only authorised team members see the contact.
• What for: to decide whom we invite, and so that each card is given only once and only in the intended number.
• Where from: from our own research or from recommendations; we note the source. We use the details only for this invitation, for nothing else.
• How you learn about it: at the latest with the invitation. It comes by email or as a link that Ben Schwöbel sends you personally, with a reference to this section. If you already have an account, the app shows you the invitation with a reference to this privacy policy. You accept or decline in the app.
• How long: until 12 months after the decision, that is, after you accepted or declined, the invitation expired or we decided not to invite you. If you decline or object, we delete all details about you right then; all that remains, with no link to you, is that a place for this card was given in your country, so that each card is given only in the intended number, and we delete that too after 12 months. A daily clean-up run on the server deletes expired entries. If you accept, the card belongs to your account and stays like your card until the account is deleted (section 9).
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR), a fair and limited distribution. You can object at any time at support@nodbase.app (section 11); then we delete the entry.

4. End-to-end encryption and its limits

• Your iPhone creates its own keys. The private keys stay in this device’s keychain. Our server only knows the public keys.
• Each message is encrypted and signed on your iPhone for the recipients’ devices. Only those devices can open it. We hold no key and can neither read nor hand over content. The same applies to calls, with their own keys for each call (section 3.14).
• You can compare a chat’s security code with the other person (in the chat, tap the name at the top › Privacy › Encryption). In a call the app shows the same code.
• Limits: whoever receives a message can read, save, forward, photograph or report it. Anyone in a call can record it. For moments the app shows a notice when someone takes a screenshot, but it cannot prevent it. Metadata (sections 3.7 and 3.14) and group titles are not end-to-end encrypted. We can read reported messages that are included. If a device is unlocked or compromised, someone can see the content there.
• Link previews are loaded by the sender’s iPhone. The website learns its IP address, but not whom the link goes to.

5. Features and permissions on your iPhone

For some features iOS asks for your permission. You can change it at any time in the iPhone settings under “Nodbase”. Without it, only that feature does not work.

• Camera: scanning cards and contact QR codes (on the device), photos, videos and moments in chats (end-to-end encrypted) and video calls (section 3.14).
• Microphone and speech recognition: what you capture and notes become text on the device. Voice messages are recorded and sent encrypted only to the people you send them to. In a call your audio goes encrypted to the people in the call.
• Screen sharing: in a call you can share your screen. iOS asks first and shows an indicator while you share. The people in the call then see everything that appears on your screen, including notifications, encrypted. From iOS 27 you can choose whether to share only Nodbase or the whole screen; below iOS 27 the app shares only what you see in Nodbase. You can stop sharing at any time.
• Photos: you pick pictures and videos in the iOS picker; the app only sees those. To save to your library the app may only add, not read.
• Contacts: with your permission the app reads your iPhone contacts to show them to you for choosing. Only the people you choose are added. The permission is also needed to save a contact someone sends you in a chat to your iPhone contacts. We upload or match none of this.
• Location: only when you send your location in a chat, once or live for 15 minutes, 1 hour or 8 hours. The permission “While Using the App” is enough. With live location your iPhone keeps sending in the background until the time is up or you stop; iOS shows the blue location symbol meanwhile. The location goes encrypted to the chat. The camera also asks for your location when you add a place sticker; your iPhone looks up the place name through Apple’s map service. Otherwise the app never requests your location.
• Local network and Nearby Interaction: to swap your cards with iPhones nearby. The card goes directly and encrypted from iPhone to iPhone, without our server; the connection that follows is created by our server (section 3.4). If you are already connected and hold your iPhones together again, our server stores that and when you met (section 3.4). Calls may also ask for it.
• Face ID: for the app lock. iOS does the recognition; the app only learns whether unlocking worked.
• Notifications: push for new chat messages and rooms (section 3.8) and call pushes (section 3.14). Reminders such as “Keep in Touch”, “Later”, follow-ups and time capsules are scheduled by your iPhone itself.
• Calendar: you add appointments from a chat through the iOS window. The app gets no access to your calendar.
• Siri, Shortcuts, Action button and Live Activity: what you say to Siri is processed by Apple according to your Siri settings. The display in the Dynamic Island (“Nodi”) runs only on your iPhone.
• Translation: messages are translated on the device by Apple’s translation feature.
• Page titles and link previews: when you share or send a link, your iPhone loads the page to show its title and preview, without cookies. The website learns your IP address.
• Phone and FaceTime: if you choose Phone or FaceTime in “Quick talk?” or for a contact, Apple’s app opens. Those calls go through Apple or your mobile carrier, not through us.
• Export network: the CSV file is created on your iPhone and is not encrypted. You decide where it goes.

We only store or read information on your device where this is strictly necessary for the feature you use (Section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act).

6. Service providers and recipients

• Supabase Pte. Ltd. (Singapore), hosting: hosts and runs our server (database, file storage, sign-in, real-time connection, server functions) in the EU (Ireland), using data centres of Amazon Web Services. Supabase processes data on our behalf under Art. 28 GDPR. This is based on Supabase’s Data Processing Addendum, which forms part of the Supabase Terms of Service.
• Hetzner Online GmbH (Germany), hosting: rents us the call servers in Helsinki (Finland) and Ashburn (USA, section 3.14). For the location in the USA, Hetzner uses its subsidiary Hetzner US LLC and data centres of other providers there; our contractual partner remains Hetzner Online GmbH. Hetzner processes data on our behalf under Art. 28 GDPR and, for calls, only has access to encrypted conversation data and the technical details in section 3.14. The data processing agreement is in place.
• Software for calls: we run LiveKit (open source) on our own servers. There is no account with LiveKit, and LiveKit receives no data from us.
• Support emails (console): if you write to support@nodbase.app, Cloudflare, Inc. (USA) receives your email on our behalf through its Email Routing and Email Workers services and passes the sender, subject, text, the result of the sender check (SPF, DKIM, DMARC) and the name, type and approximate size of attachments to our database at Supabase in the EU. We do not store the attachments themselves. Only an authorised admin can read the email, and every access is logged. We use it only for support requests. We link it to an account only if the address matches exactly and the sender is verified. We send replies through Resend (see below). If our database is exceptionally unreachable, Cloudflare forwards the email to the operator's mailbox at Apple (iCloud) instead, so that it is not lost.
• Apple: Sign in with Apple, delivery of notifications and call pushes (APNs) and the App Store. Apple itself is responsible for the App Store, downloads and your Apple Account (Apple’s Privacy Policy). If you agreed in iOS to share analytics with app developers, we receive aggregated crash and usage reports from Apple that do not identify you.
• Google: only if you use “Sign in with Google”. Google learns that you sign in to Nodbase and gives us the details from section 3.1. Google itself is responsible for your Google Account.
• Notification of reports: so that we see new reports quickly, our server sends us a short message through the push service ntfy.sh to the operator’s iPhone. It contains only the report’s identifier, reason, type and time and the number of open reports, no names, user identifiers or content. We learn about new messages through “Support & Feedback” (section 3.16) the same way: only their kind and time, never the text.
• Email delivery: confirmation and password codes, replies to support emails, moderation messages and invitations to special cards (section 3.18) are sent for us by Resend (Plus Five Five, Inc., USA), sending from the EU (Ireland), on our behalf under Art. 28 GDPR.
• Website hosting: Cloudflare, Inc. (USA), through the Cloudflare Pages service. Cloudflare’s global network delivers the pages. Cloudflare acts on our behalf under Art. 28 GDPR.
• Other users: see what you share with them: your profile, your messages, your calls, your request or your reason for an introduction, shared goals, group titles and members.
• Authorities: only if we are legally obliged to, or if people’s life or safety is threatened, for example in the case of child sexual abuse material.

7. Transfers outside the EU

Our servers and databases are located in the EU. The exception is our call server in Ashburn (USA, section 3.14): Hetzner processes calls that run through it there. Audio, video and screen arrive there only end-to-end encrypted; readable are the technical details from section 3.14, above all IP addresses. Hetzner Online GmbH in Germany is our processor; for passing data to Hetzner US LLC, the EU Standard Contractual Clauses that Hetzner has concluded with it apply (Art. 46(2)(c) GDPR). Authorities in the USA may in some cases access data in the USA without you learning about it; they could not get at the content of a call there, because it is encrypted. Supabase Pte. Ltd. is based in Singapore, and access from outside the EU is possible for maintenance and support. We base this transfer on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR, Module Two), which form part of Supabase’s Data Processing Addendum. For Apple, the safeguards Apple describes in its Privacy Policy apply. Cloudflare (support emails, website) and Resend (email delivery) are companies in the USA; data may therefore also be processed outside the EU. This is based on the EU Standard Contractual Clauses in their data processing agreements (Art. 46(2)(c) GDPR) and, where the provider is certified under it, the EU-US Data Privacy Framework (Art. 45 GDPR).

8. Legal bases

• Contract (Art. 6(1)(b) GDPR): account, card, links, requests, connections, meetings, introductions, groups, shared goals, delivery of chats, calls and notifications, emails with codes and your support requests.
• Legitimate interest (Art. 6(1)(f) GDPR): security and protection against abuse, i.e. the word filter, limits (also for calls), reports, moderation, account suspensions, technical logs and enforcing our rules. Our interest is a safe service for all users. We also base on it the totals of active accounts (section 12), to run the service, and answering emails to support from people without an account, the check value after a suspended account is deleted (section 3.9) and invitations to special cards (section 3.18).
• Network strength: your consent when you turn it on (Art. 6(1)(a) GDPR, § 25(1) TDDDG); it is created only on your iPhone (section 3.17). Moving up by inviting is based on contract (section 3.3).
• Consent (Art. 6(1)(a) GDPR): optional permissions such as camera, microphone, location, contacts and notifications. You can withdraw them at any time in the iPhone settings. This applies from then on and does not affect what happened before.
• Legal obligation (Art. 6(1)(c) GDPR): for example information for authorities and duties under the Digital Services Act.

Without an email address or signing in with Apple or Google we cannot create an account. All details on your card are optional. We make no automated decisions under Art. 22 GDPR; your network strength is calculated only by the app on your iPhone. The word filter only rejects individual texts so you can change them.

9. How long we keep data

• Account, card, profiles, the “For Your Network” sentence, pictures, videos and links: until you change or delete them, at the latest until you delete your account. The server removes pictures, videos and files shortly afterwards, usually within an hour. An unused one-time link is valid for 30 days.
• Copies of your “For Your Network” sentence on your connections’ iPhones: as long as you are connected; after a disconnection or block, until the app there syncs next. A device that never comes online again keeps its copy.
• Shared goals: until you stop sharing, delete the goal or delete your account.
• Requests, connections, disconnections and blocks: as long as both accounts exist. We also keep declined requests that long so nobody can ask again at will after a no. Open requests nobody answers are deleted 30 days after they were sent.
• Invitation through your link (section 3.3): up to 30 days; your move-up by inviting: until your account is deleted.
• Meetings (section 3.4): as long as your connection exists; when you meet again, we delete entries older than 365 days.
• Introductions: expire after 14 days. The entry is kept after that, so the same introduction is not repeated over and over, until one of the accounts involved is deleted or we remove it because of a report.
• Groups: memberships until you leave or delete your account. After leaving or being removed, the entry stays for 30 more days so the remaining members can see it. A group continues for the remaining members.
• Communities (section 3.15): posts as long as the community sets (30 days to 1 year or unlimited, 1 year by default); memberships as long as the community exists or until you delete your account.
• Encrypted chat messages and files: messages until delivery, files until the message expires, each for at most 30 days; scheduled ones from their time (section 3.7).
• Keys of time capsules: until 90 days after the opening time (section 3.7).
• Push token and call push token: until you sign out, use a new chat device or delete your account.
• Calls (section 3.14): a call entry about 2 minutes beyond the end (ringing at most 60 seconds, call at most 8 hours); an empty room 6 hours after the last join; abuse counters at most one day; call server logs one day; no call history on the server. “Calls From” and muted chats until you change them or delete your account.
• Reports: until they are reviewed and 180 days after that. Longer only if we need them for proceedings or an authority requests them. If the reporting or the reported person deletes their account, the report stays without a link to that account until its deadline; the snapshot may still contain the name and the reported text.
• Account suspensions: while the suspension lasts. If we lift it, we delete the entry. A suspension with an end date stays as a record after it ends, until the account is deleted. The reason is also kept in the related report until that report’s deadline. If you delete a suspended account: the check value until the suspension ends, for at most 12 months (section 3.9).
• Network strength: only on your iPhone; reply days for at most 12 weeks; reply days and meeting weeks only while strength is on; everything else until you turn strength off or delete the app or your account (section 3.17).
• Invitations to special cards (section 3.18): until 12 months after the decision; if you decline or object, right then.
• Technical logs: a few days.
• Server backups: deleted data can remain there for about a week (at most 8 days) until the backup is overwritten.
• Messages through “Support & Feedback” (section 3.16): until we have settled them, then 180 days; with your account at once.
• Emails to support: until your request is settled, then at most 12 months, unless the law requires us to keep them. Emails marked as spam are deleted after 30 days. If we have linked an email to your account and you delete it, the email remains without that link until its period ends.

10. Deleting your account

In the app: You › Settings (gear) › Account › Delete Account › “Delete Account Permanently”.

• Your account is deleted immediately, with everything attached to it: sign-in data, card, profiles, the “For Your Network” sentence, links, requests, connections, meetings, blocks, introductions, group memberships, shared goals, chat devices with their keys and push tokens, your call settings, waiting and scheduled messages and your messages through “Support & Feedback”. The server removes your pictures, videos and files, including those of your posts in communities, shortly afterwards, usually within an hour. Then the app deletes everything on this iPhone.
• If you signed in with Apple, we ask Apple to revoke the link to your Apple Account at the same time. If that does not work, you can also stop using Sign in with Apple for Nodbase yourself in your Apple Account settings.
• What remains: messages already delivered stay on the recipients’ devices. Groups continue for the remaining members. Profile and group pictures of a community belong to the community and stay, even if you uploaded them. Reports remain until their deadline (section 9), without a link to your account, whether you reported or were reported. What others noted about you in their own network is on their devices; copies of your “For Your Network” sentence disappear there at their next sync. Backups expire after about a week (at most 8 days). If your account was suspended, a check value of your email address or Apple identifier stays until the suspension ends, for at most 12 months (section 3.9). If Apple told your iPhone that you are under 18, only that statement stays in this iPhone’s keychain (section 13).
• Without access to the app: write to support@nodbase.app from your account’s email address. We delete the account within one month.

11. Your rights

You have the right to:

• access your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR); you can change your card yourself at any time,
• erasure (Art. 17 GDPR); you can delete your account yourself at any time,
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR); you export your network yourself as CSV, and we send you the data on the server in a common format on request,
• withdraw consent with effect for the future (Art. 7(3) GDPR),
• lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in your country of residence or with the authority responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

Objection (Art. 21 GDPR): where we process data based on our legitimate interest, you can object at any time on grounds relating to your particular situation. We then stop, unless we have compelling legitimate grounds, such as protecting other users from abuse, or need the data for legal claims.

Just write to support@nodbase.app. So that we never hand someone else’s data to you, please write from your account’s email address or confirm your identity in another way. We reply within one month.

12. No tracking, no ads

The app contains no ads, no advertising identifiers and no tracking or analytics tools. It contains third-party software components only for calls (LiveKit and WebRTC, both open source) and for Nodi (llama.cpp, open source); they run in the app on your device, and the call components connect only to our own call servers (section 6). We do not track you across other companies’ apps and websites, build no advertising profiles and sell no data.

The app itself counts nothing about how you use it. On the server we count only totals from the time your session was last used: how many accounts there are, how many were active in the last 1, 7 and 30 days and how many join each week. Only we see these numbers, without names. If we later want to learn more from totals, we will update this policy first and tell you in the app.

13. Minimum age

Nodbase is for people aged 16 and over. If we learn that an account belongs to someone younger, we delete it. If the app uses the iOS age information, it only learns an age range, for example “16 or older”, never a date of birth. If Apple says you are under 16, or 16 to 17, the iPhone remembers only that, in this device’s keychain, even after the app is deleted, so that the age limit cannot be bypassed by reinstalling. “Under 16” does not go to our server. The level 16 to 17 or 18 and over is stored by the server with your account (section 3.1). If you are 16 or 17, you start out invisible under “People” in communities, and strangers cannot send you a request there. Where a law that requires parental consent through the App Store for minors applies to you (for example in Texas, USA), the app always asks Apple for the age range, and an account is created only if Apple confirms that you are 18 or older.

14. Our website

Our website sets no cookies, stores nothing on your device, loads no content from other providers and contains no analytics script. When you visit it, our hosting provider (Cloudflare, see section 6) processes technically necessary data such as IP address, time, page requested and browser, to deliver the site and protect it from attacks (Art. 6(1)(f) GDPR). From these server logs, Cloudflare automatically shows us aggregated visitor numbers, for example page views per day and the countries they come from. This needs no cookies and no script, and no profiles of individual visitors are created. We keep no individual access logs ourselves and do not retrieve any from Cloudflare. If someone opens a link to a card, an invitation or a community without Nodbase, the site only shows general information and the way to the app. It does not read the code in the link, requests nothing from our server and shows no details about the person who shared the link.

15. Changes

If the app or the law changes, we update this policy. We inform you in the app about material changes. The current version, which you find in the app and on our website, applies.

16. Contact

Questions, access, erasure or objection: support@nodbase.app
Post: Ben Schwöbel, Am Wallstadter Bahnhof 25, 68259 Mannheim, Deutschland