Privacy Policy

Version 1.0 · 2026-11-07

In one sentence: other users see only what you choose to show. Your email, phone number, username and photo are registered with us, and only authorised staff can open them, for safety and legal reasons.

1. Who is responsible

The data controller is nobody. ("we"). Data protection contact / DPO: dpo@nobaady.com. This policy applies to the nobody. app and this website.

2. What we collect

Data	Details	Why
Account ID and session token	An internal ID and a token that keeps you signed in	Run your account, prevent duplicate or banned accounts, security
Email and phone number	Required to register. Your email is confirmed with a code. Never shown to other users	Sign-in, account recovery, one person one account, keeping banned people out, safety and legal requests
Username and generated alias	A username you choose, and an alias we generate. You choose which one others see	Show you to other users; our team can always see both
Profile photo (optional)	A photo you upload or a symbol you pick. Uploaded photos are checked by our moderators before anyone else can see them. You can hide or remove your photo at any time	Show you to other users when you turn it on; moderation
Language and rooms	The app language and the rooms you open	Show you the right rooms and language
Messages	Text you send in The World, One-to-one and Trusted, with timestamps and the account IDs involved	Deliver the chat, moderation, safety, legal obligations
Voice messages	Recordings you send in a Trusted session. Your voice can identify you. Rooms and one-to-one chats do not accept voice	Deliver the session, safety, legal obligations
Reports and blocks	Who reported whom, the reason, and the reported messages	Enforce our rules, protect users, respond to authorities
Moderation records	Warnings, mutes, suspensions, bans and the audit log of moderator actions	Accountability, appeals, legal compliance
Subscription status	Whether Plus is active, plan and expiry, Trusted session purchases and bookings, and a store transaction identifier from Apple or Google	Unlock Plus features. We never receive your card number

We do not ask for your legal name, and we do not collect your contacts, precise location or payment card details. We do not sell personal data and we do not show third-party advertising.

3. Legal bases

We process data (a) to perform our contract with you (running the service and Plus); (b) to comply with legal obligations, including UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, UAE Federal Decree-Law No. 34 of 2021 on cybercrimes, the Saudi Personal Data Protection Law (PDPL) and other Gulf laws; (c) for our legitimate interests in security, fraud prevention and moderation, balanced against your rights; and (d) with your consent where the law requires it, such as optional analytics. You can withdraw consent at any time in settings.

4. What others see and what we see

What other users see. Your username or your generated alias, and your photo only if you turn it on. They never see your email, phone number, account ID, device or IP address.
What we hold. Your email, phone number, username, alias and photo are recorded on your account even when hidden, and our servers know which account and device sent each message. Access is limited to authorised staff and every access is logged. This is what allows reporting, blocking, bans and responding to lawful requests.
Messages in one-to-one and Trusted chats disappear from both screens when a chat ends. A limited safety log (account IDs, timestamps, and message content needed to investigate reports) is retained for the period in the table below, then deleted.
Encryption. Messages are encrypted in transit (TLS) and at rest. They are not end-to-end encrypted: our authorised staff can read any stored message, including messages in One-to-one chats and Trusted sessions, to review reports, investigate abuse, fraud or risk to someone's safety, enforce our Terms, or when required by law. Each access needs a written reason and is recorded in an audit log that cannot be edited. We do not read messages for advertising or any other purpose.

5. How long we keep data

Data	Retention
Email, phone number, username and photo	While your account exists; deleted within 30 days after you delete it. A keyed hash of the phone number is kept for banned accounts to stop re-registration
Rejected profile photos	Deleted after review, unless the law requires us to keep them
Public room messages (The World)	30 days, then deleted
One-to-one chats	Removed from both users' views when the chat ends; safety log kept 90 days
Trusted session messages and voice messages	Removed from views at session end; safety log kept 90 days
Reports, blocks and moderation records	12 months from closure of the case, longer if required for a legal proceeding
Account data after you delete your account	Deleted within 30 days; bans and CSAE-related records may be kept as hashes or minimal records to prevent re-registration and to meet legal duties
Subscription records	As long as required by tax and accounting law (typically 5 years in the UAE)

6. Who we share data with

Our moderation team, under access controls and audit logs, to review reports.
Service providers that host our servers, run our servers and database (Supabase) and send sign-in codes and safety alerts by email (Resend), under contracts that limit their use of data.
Apple and Google, which process payments. We only receive subscription status, not card data.
Law enforcement, courts and regulators when we receive a lawful request, when we are required to report (for example child sexual abuse material to NCMEC or the competent Gulf authority), or when necessary to prevent imminent harm.
A successor if our company is sold or merged, under the same protections.

7. Where data is stored and cross-border transfers

Our servers are located in Mumbai, India. If you use nobody. from a Gulf country, your data may be transferred to and processed in that region. Where required by the UAE PDPL (Federal Decree-Law 45/2021), the Saudi PDPL or other applicable laws, we rely on an adequacy decision, approved contractual safeguards, or your explicit consent, and we apply the same protections wherever the data is held.

8. Your rights

Subject to applicable law you may: access the personal data we hold about you; export it in a readable format by emailing dpo@nobaady.com; you can see your account details in Me → My data; correct your username, photo, email, phone number and settings; delete your account and data (Me → Delete account); object to or restrict certain processing; and withdraw consent. You may also complain to the UAE Data Office, the Saudi Data & AI Authority (SDAIA) or your local regulator. To exercise a right not available in-app, email dpo@nobaady.com from within the app so we can verify your account; we respond within 30 days.

9. Children

nobody. is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to a minor, we terminate it and delete its data, keeping only what the law requires. If you believe a minor is using nobody., tell us at safety@nobaady.com. See our Child Safety Standards.

10. Security

We use encryption in transit and at rest, access controls, audit logging of moderator actions, and regular reviews. No system is perfectly secure; if a breach affects your data we will notify you and the regulator as the law requires.

11. Changes

We will post updates here and notify you in the app of material changes at least 14 days before they take effect.

12. Contact

nobody.
Data protection / DPO: dpo@nobaady.com
Support: support@nobaady.com