Privacy Policy
Last updated: 25 October 2026
The short version
- Without an account, Nitamur keeps your data on your own device. Nothing is sent to us.
- With an account, your data is also stored on a server in Ireland, so your devices stay in step.
- There is no advertising, no tracking and no analytics, and your data is never sold.
- You can export everything, and delete your account and its cloud data yourself, in Settings.
- The cloud copy is encrypted in transit and at rest, but not end-to-end encrypted. Don’t keep anything in Nitamur that you would not want stored on a server.
1. Who is responsible
Nitamur is a private, non-commercial project run by an individual in the Netherlands. It is not a company and nothing is sold. For any question about your data, write to .
2. What Nitamur stores, and why
On your device (always). Your tasks, notes, study material, whiteboards, progress and settings are saved in your browser’s storage, or in the Windows app’s data folder. Nitamur uses this storage only to run the app. It does not use advertising or tracking cookies, so there is no cookie banner.
In the cloud (only if you create an account).
| Data | Why |
|---|---|
| Your email address, and a scrambled (hashed) form of your password. If you use Google, your Google account’s identifier, email address, name and profile picture, which Google sends and are stored with your account. The password is never stored in readable form, and Google never gives us yours. | To create and secure your account and let you sign in. |
| Your Nitamur data: the same records and settings as on your device. | To keep your devices in step. This is the service you asked for. |
| Technical data such as your IP address and browser type, kept briefly in server logs. | To keep the service secure and stop abuse. |
Attached files and whiteboard images are uploaded too, so they reach your other devices. They are stored privately, so only you can open them. Photos are scaled down to at most about 2000 pixels before they are uploaded. Each account has 100 MB for files.
Legal basis (GDPR). Providing your account and sync is necessary to give you the service you asked for (Article 6(1)(b)). Security logs rest on our legitimate interest in keeping the service safe (Article 6(1)(f)).
3. Who else handles your data
These companies process data for Nitamur, only to run the service:
- Supabase: the database and sign-in. Your data is stored in Ireland (EU).
- Google: only if you choose “Continue with Google”.
- Resend: sends the confirmation and password-reset emails.
- Vercel: hosts the website and the Windows installer download. It sees your IP address when you visit, and when the Windows app checks for updates (at start-up and twice a day).
- Cloudflare: runs the domain name system for nitamur.com.
- Apple (iCloud Mail): handles the mailbox for the contact address, if you write to it.
Some of these providers are based in, or may process data in, the United States. They rely on the EU–US Data Privacy Framework or on standard contractual clauses. Your data is not sold, shared for advertising, or used to train AI.
4. How long it is kept
Data on your device stays there until you remove it. Cloud data is kept until you delete your account, which removes your account and all your records from the live database. Copies in the providers’ own backups, if any, expire on their schedule. Server logs are short-lived. If you write to the contact address, the message is kept only as long as needed to answer you.
5. Your rights
Under the GDPR you can ask to see your data, correct it, delete it, restrict or object to its use, and receive a copy in a common format.
- Copy: Settings → Data → Export JSON.
- Delete everything in the cloud: Settings → Account & sync → Delete account. Data on your own devices stays until you remove it.
- Anything else: write to . You get an answer within one month.
If you think your data is handled wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in your own country.
6. Security
Connections are encrypted. Each person’s cloud data is protected so that only their own account can read it. Even so, the cloud copy is not end-to-end encrypted, which means the person running the service could technically reach it through the database. Your data is not read, and only touched to run or repair the service. If a breach affecting you ever happens, you and the authority will be told as the law requires.
7. Children
Accounts are for people aged 16 and over. Younger people can use Nitamur without an account, since then nothing is sent to us.
8. Changes
If this policy changes in a way that matters, the date above changes, and signed-in users are told in the app before the change applies.