Niello Privacy Policy ✦
Last updated: October 15, 2026
This Privacy Policy explains how the Niello application (provided by TacticSpace Tech, "we", "our", "us") collects, uses, shares, and protects your personal information, and the rights available to you under the applicable law in your jurisdiction.
We follow these basic principles: we collect only the minimum information needed to provide the Service; you can use the Service — including purchases and AI features — without registering a separate Niello account; the journals, stickers, and photos you create are stored on your own device (and, if you subscribe to Niello Pro and turn on iCloud sync, in your own iCloud private database); we do not sell your personal information; we do not share your information with any third party for targeted advertising; we do not use your content to train artificial intelligence models.
1. Information We Collect
Information you provide:
- Version 1.9 automatically creates a pseudonymous service account, without a separate Niello sign-in. Apple may request App Store authentication to verify the app or subscriptions. Earlier versions offering optional Sign in with Apple process the Apple user identifier when you use that sign-in; it is separate from the native account in version 1.9.
- The email address and name you choose to share when signing in (controlled by Apple at the time of sign-in);
- Your finished journals, stickers and photos are saved on your device and, if enabled with Niello Pro, in your private iCloud database. AI requests also involve temporary service-side processing as described below; this is separate from your saved journal library.
- Text, photos and instructions you actively submit to AI features, including Mochi, and the generated responses. To deliver queued results and recover interrupted requests, our services may temporarily retain task inputs, outputs and delivery state.
Information collected automatically:
- Account identifiers and information needed for device verification and account recovery, used for authentication, abuse prevention and subscription linking. Device credentials are stored securely by the operating system and are not advertising identifiers.
- Your monthly AI usage counts, associated with that identifier (for quota management);
- Anonymized application crash and basic performance data;
- Subscription transaction receipts provided by the Apple App Store.
On sensitive personal information
We process only photos you actively submit to a feature. AI generation sends the selected photo or text to the applicable service provider and may create temporary task copies. We do not upload your entire photo library or private iCloud journal library. Photos may contain sensitive personal information; submit only material you intend to have processed.
Information we do not collect
We do not collect your precise location, contacts, web browsing history, or any identifier used for cross-app or cross-site behavioral advertising.
Product usage analytics
To understand feature use and improve performance and stability, we use PostHog (EU Cloud, hosted in Frankfurt) to collect product-use events from the website and app:
- On the website: page views, CTA clicks, locale switches, scroll-section reach, 404 hits, and aggregated device/locale info.
- In the app: app launches, screen views, key actions (e.g. journal entry created, AI feature invoked, subscription paywall viewed), and aggregated performance / error data.
We have configured PostHog so that no person profile is created for anonymous users. We do not use this data to build behavioral profiles, target advertising, or share it with any third party for advertising purposes. You can opt out via your browser's Do Not Track setting on the website, and via Settings → Help improve Niello in the app.
2. How We Use Information
We use the information collected only for:
- Providing the core functionality of the Service;
- Preventing misuse, fraud, and security incidents;
- Communicating service-related matters with you (such as material policy changes or subscription issues);
- Conducting aggregated, de-identified analysis to improve the product.
3. Legal Bases for Processing
Depending on the applicable law in your jurisdiction, the legal bases on which we process your personal information may include:
- Contractual necessity: to perform our contractual obligations in providing the Service;
- Legitimate interests: to operate, improve, and protect the Service, provided such interests do not override your fundamental rights and freedoms;
- Your consent: for specific types of processing (such as optional personalization);
- Legal obligation: to comply with laws and regulations applicable to us.
4. Who We Share Information With
We use cloud services to process the requests and records needed for account verification, subscription synchronization, content delivery and security. When you use AI features, the text, photos and instructions you select are sent to the relevant AI provider to generate or edit content.
The Service Provider List identifies the providers, use cases, data types and privacy contacts. It forms part of this Policy. The providers involved depend on the features and services you use.
We send only information needed for the relevant feature, without granting access to your entire photo library or private iCloud journal library. We do not sell personal information, share it for targeted advertising, or use your content to train our own models. Provider processing and retention rules are set out in the applicable terms linked in the list.
Where separate notice or consent is required by law, we will follow the applicable requirements.
5. Automated Decision-Making
Mochi's content generation involves automated processing. Such automated processing does not produce decisions with legal or similarly significant effects on you. You may stop using AI features at any time without affecting other parts of the Service.
6. Security
- All client ↔ us ↔ third-party traffic is encrypted with TLS;
- Identity credentials are stored in the iOS Keychain (system-level hardware-backed encryption);
- Your core content is stored on your own device; if you turn on Pro iCloud sync, it is also stored in your own iCloud private database, accessible only by your Apple ID.
Although we use industry-standard security measures, no system is absolutely secure. To the extent permitted by applicable law, we are not responsible beyond the statutory limit for security incidents outside our reasonable control.
7. Data Retention
| Type | Retention |
|---|---|
| Account and device identifiers | Until you delete your data (in-app deletion or a request via the email below) |
| AI usage counts | Retained with the pseudonymous account for quota management, abuse prevention and billing records; deletion requests can be made through the app or the contact below |
| Temporary AI task content | Temporary inputs and outputs in the mainland China service expire after 48 hours and are removed by the cleanup service; copies saved on your device are unaffected |
| Encrypted backups | The mainland China service rotates the latest 14 daily encrypted backups, excluding image files. Temporary text and account records already in a backup remain until that backup rotates out |
| Upstream AI processing | Provider retention follows its applicable terms and privacy policy, separately from our task cleanup |
| Subscription state | Subscription period plus a reasonable audit window |
| Subscription synchronization records | Pending notifications are retained until resolved. Delivered temporary online copies are removed after 14 days; backups follow the rotation above. Necessary subscription and audit records follow their separate applicable retention periods |
| Email, name | Cleared upon sign-out or deletion request |
| Journal content | Stored on your device until you delete it; iCloud copies (Pro sync) are governed by Apple and your iCloud settings |
8. Your Rights
Subject to the applicable law in your jurisdiction (including but not limited to the GDPR, CCPA/CPRA, and PIPL), you may have all or some of the following rights:
- Access and obtain a copy: know how we process your information and receive a copy;
- Correction: request correction of inaccurate or incomplete information;
- Deletion: request the deletion of your personal information;
- Restrict processing: request that we restrict certain processing of your information;
- Data portability: receive your information in a machine-readable format;
- Withdraw consent: withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- Object: object to our processing of your information in specified circumstances;
- Non-discrimination: exercising the above rights will not result in differential treatment in the Service.
To exercise these rights, contact us via the email below; you can also delete your account and the associated server-side data directly in the app's Settings. We will respond within the timeframe required by applicable law. If you believe our processing infringes applicable law, you may also lodge a complaint with the competent supervisory authority in your jurisdiction.
9. Children
The Service is not directed to children under 13. In some jurisdictions (such as in EU member states and China) the corresponding minimum age may be 14 or 16; local law prevails. We do not knowingly collect personal information from children below the applicable minimum age. If you are a parent or legal guardian and believe that a child in your care provided us with personal information without your consent, contact us so we can address it.
10. Cross-Border Transfers
The Service is offered globally. In providing it, your information may be processed on servers outside your country or region.
Where applicable law requires it, we use appropriate contractual and technical safeguards (including but not limited to the EU Standard Contractual Clauses or other recognized transfer mechanisms) to keep such transfers lawful. In certain jurisdictions, if local law requires localized processing of, or restricts the export of, certain categories of personal information, we will accordingly use local service providers, or not offer the affected feature in that region.
11. Policy Changes
We may update this Policy from time to time. Material changes will be communicated through in-app notice and by updating the "Last updated" date above. Your continued use after changes take effect constitutes acceptance.
12. Contact
For questions about this Policy, our data practices, or to exercise your rights:
- Email: support@nielloai.com
- Operator: TacticSpace Tech