Privacy, plainly.

Your Google account basics (name, email and, if you set one, a profile photo), your polish collection (brands, shade names, finishes, barcodes, statuses, personal notes) and the photos you add to it, plus your app preferences (theme, sorting, display). If you use My Looks, we also store the manicures you log there: titles, notes, dates, the polishes in each look and their photos.

Everything is stored with Supabase (our database and file storage provider) in the United States, and the app runs on Vercel. Data travels encrypted. Your photos sit in a private bucket and are served through expiring signed links.

If you use NailPal from the European Union, the EEA or the UK, your data is processed in the United States. That transfer relies on appropriate safeguards, namely the Standard Contractual Clauses approved by the European Commission, through our providers’ data-processing terms.

If a data breach ever affects your personal information, we will notify you as the law requires.

You, and us: the people who run NailPal. Your collection, notes and photos are isolated to your account, so other users can never see them. We use them to run the app and, aggregated wherever possible, to understand usage and improve NailPal, and we never share them with anyone beyond the services that run NailPal, and never use them for ads.

We never sell your personal data: your name, email, photos, notes, or individual collection. The only thing we may ever sell is aggregated, anonymous reports about trends in brands, colors and finishes, always from groups large enough that no individual can be identified, and we never try to re-identify anyone.

One exception, by design: when you add a polish, its public catalog facts (brand, shade name, finishes, barcode) join a shared catalog that helps everyone autofill faster. Nothing personal travels with it: no name, no photos, no notes, no dates.

If you add a photo while brand and name are empty, that photo is sent to Anthropic (Claude) once, only to read the label, and is not used for anything else; the provider does not use it to train its models. When you scan an unknown barcode, only the number is sent to a public barcode database. Neither request includes who you are.

If you use Discover (a Premium feature), a summary of your collection (counts of brands, colors and finishes, with no name, notes, photos or email) is sent to Anthropic to personalize what you see there. It never identifies you and is not used to train its models.

Just two cookies of our own: the one that keeps you signed in, and a small preference cookie that remembers light or dark mode for signed-out visitors. No advertising or cross-site trackers. For traffic stats we use Vercel Analytics, which is cookieless; it derives an approximate location (country) and device type from your IP address without storing the IP. We also keep the country of your last visit, alongside our own in-app usage counts. All of it is used only to run and improve the app.

You can see the data we hold about you, correct it, export it, or have it deleted, and you can object to us using it to improve the app. Most of this is one click away: export and delete both live in Settings. For anything else, email us and we will help. If you’re in the EU, the EEA, the UK or California, these rights are yours by law, and we will never charge you or treat you differently for using them.

If you’re in the EU, the EEA or the UK and you think we’ve mishandled your data, you also have the right to lodge a complaint with your local data protection authority.

We store your data on two grounds: to give you the app you signed up for, and our legitimate interest in keeping it secure and making it better. We keep it for as long as your account exists. When you delete your account it is removed right away; residual copies in our providers’ encrypted backups clear on their normal cycle, and any usage figures we keep afterwards are aggregated or anonymized and cannot identify you.

NailPal is for people aged 13 or older, or older where local law requires it (for example, 16 in parts of the EU). It isn’t meant for children below that age, and we don’t knowingly collect their data.

Settings → Danger Zone → Delete Account removes your account, your collection and all your photos right away, and we can’t restore them afterwards. Residual copies in our providers’ encrypted backups clear on their normal cycle. You can export your collection as a CSV file at any time from Settings.

If you can’t sign in, or you’ve already removed the app, email support@nailpal.app from the address linked to your Google account and we will delete your account, your collection and your photos within 30 days. There is nothing to fill in and no reason to give.

Questions about your data: support@nailpal.app