In short
- Your notifications and messages are read on your phone. They leave it only when you use a Nifa AI feature, and then only the part that feature needs.
- Nifa AI runs on Anthropic's Claude models. What you send to it passes through Nifa's server to Anthropic to produce the answer. Nifa doesn't store your messages or your questions, and doesn't write them to its logs.
- If you use your own AI key instead, those requests go from your phone straight to the provider you chose: Nifa's server doesn't see them.
- Nifa's server keeps your account (anonymous unless you sign in), your credits, plan and purchases, your phone's push token for notifications, and usage numbers (which feature ran, how many tokens it used and what it cost), never the content.
- Free users can choose to watch a rewarded ad (Google AdMob) for credits. Nifa has no other ads, and never shows ads in notifications, on the lock screen or on any screen that shows your messages.
- We don't sell your data.
What stays on your phone
The notifications Nifa reads with Android's notification access, the conversations it shows you, your rules, replies, contacts' names and settings are kept in the app's private storage on your phone.
Nifa's on-phone features, such as sorting rules, fixed away replies and the on-phone scam shield, work without sending anything to anyone.
Nifa AI
When you use a Nifa AI feature (AI sorting, auto-replies, Ask Nifa and its Smart mode, errand replies, scam checks, checking a message before you send it, drafting a rule, the morning brief and answers from your message history), the app sends the text that feature needs to Nifa's server: for example the notifications being sorted, the conversation being answered, or your question. The server forwards it to Anthropic, which produces the answer, and returns the answer to the app.
Nifa's server doesn't store what you send or the answers it passes back. When your phone retries a request after a dropped connection, the server only remembers, for up to an hour, that the request was already charged, so the retry isn't charged twice.
Anthropic processes these requests as Nifa's service provider, under commercial terms that don't allow it to train its models on them. Anthropic may keep requests for a limited time for safety and abuse monitoring, as its own policies describe. With each request Nifa sends Anthropic an anonymous code derived from your account (never your email or name), so abuse can be told apart from ordinary use.
For every request the server records the feature, the model, the number of tokens, the cost and the credits charged. It uses these numbers for billing, the daily limits and to keep Nifa AI affordable.
AI can be wrong. Check what Nifa writes before you rely on it, especially replies it sends for you.
Reporting a reply
If you use "Report this reply", the app sends us the reply, the reason you chose and any context you decide to include, with your account id, so we can review it. We keep reports for up to 180 days, and delete them earlier if you delete your account.
Your own AI key
If you choose to use your own API key from an AI provider, Nifa sends those requests from your phone directly to that provider, and that provider's privacy policy applies. Your key and those requests don't go through Nifa's server.
Your account and sign-in
- Using Nifa doesn't need an account. The app creates an anonymous account for your install, identified by a random install id that our server keeps only as a keyed hash.
- If you sign in with Google or with your email address, we keep your email address, your name (from Google) and an identifier of your Google account, so your credits and plan follow you to a new phone. Sign-in codes are stored hashed and stop working after 10 minutes.
- When a new install signs in for the first time, the app asks Google Play Integrity whether the phone and the app are genuine. We use the answer only to decide whether the install gets welcome credits and can start the trial without a card.
- We note the country of your connection (looked up from your IP address, which we don't keep) to apply regional prices and the rules for rewarded ads, and the days on which you use the app, to count active users.
Credits, plans and purchases
Nifa Plus, Nifa Pro and credit packs are sold through Google Play, which handles payment: we never see your card or bank details. We receive what Google Play reports about each purchase (the product, its purchase token and order id, its state and your billing country) to give you the plan or credits, and we keep a ledger of your credits. Purchase and ledger records are kept for 7 years for tax and accounting, without your account id once you delete your account.
Rewarded ads
If you are not on a plan, you can choose to watch a rewarded ad from Google AdMob for credits. Where the law requires it (for example in the EEA, the UK and Switzerland), Google's consent form asks for your choices first. The Google Mobile Ads SDK collects the advertising ID, approximate location (from your IP address), app interactions and diagnostics to show and measure ads, as Google's privacy policy describes. Ad requests never contain your notifications or messages. When you finish an ad, AdMob tells our server, with your Nifa user id, so we can add the credit.
Notifications from Nifa
While Nifa's notifications are on, the app follows Nifa's news in your app's language (English or Arabic) through Google's Firebase Cloud Messaging, with or without an account. If your install has a Nifa account, anonymous or signed in, the app also sends our server its push token from Firebase Cloud Messaging, with the app's language and version. We keep them tied to your account and that install, only to send you notifications: news from Nifa, and messages about your account, such as credits or a plan from support. You can switch Nifa's notifications off in Android's settings at any time; the app then takes its token off our server.
We delete the token when you sign out on that phone or delete your account, and after 270 days unused.
Crash reports
If you turn crash reports on (they are off by default), the app sends the app and Android version, the phone model and the error's technical trace when Nifa crashes. Reports carry no account id. We keep them for 90 days.
Weather on the widget
If you add Nifa's home-screen widget, it shows the weather unless you turn that off (Settings → Weather on the widget). About once an hour the app asks Nifa's server for it. If you gave Nifa location access, the app sends the area of your phone's location from the last time you opened Nifa, rounded on the phone to about 10 km, and your phone names the place. Nifa never reads your location in the background. Otherwise the server takes the approximate area of your internet connection, which its host looks up from your IP address, and rounds it the same way. The server asks MET Norway's weather service for the forecast for that area; MET Norway sees only the rounded area, never your IP address. We don't keep your location or these requests.
Who processes your data
- Vercel runs Nifa's server, in the United States; Elestio hosts its database.
- Anthropic produces Nifa AI's answers.
- Google provides Google Play billing and Play Integrity, Sign in with Google, AdMob and Firebase Cloud Messaging, which delivers Nifa's notifications.
- MET Norway (the Norwegian Meteorological Institute) provides the widget's weather; it receives only an area about 10 km wide.
- Our email provider sends sign-in and account deletion codes.
How long we keep data
- Your account, credits and plan: until you delete your account.
- Sessions: until you sign out, or 90 days without use.
- Push tokens, with the app's language and version: until you sign out on that phone or delete your account, or 270 days unused.
- What you send to Nifa AI and its answers: not kept. A note that a request was already charged (so a retry isn't charged twice): up to an hour.
- The widget's weather requests and your connection's area: not kept.
- Usage numbers, purchases, the credit ledger and rewarded-ad records: 7 years, for tax and accounting, without your account id after you delete your account.
- Reported replies: up to 180 days. Crash reports: 90 days. Sign-in codes: deleted within a day of expiring. Rate-limit counters (with a keyed hash of your network, never your IP address): a few hours.
Your choices and rights
You can use Nifa without an account and without Nifa AI. You can delete your account at any time in the app (Settings → Account → Delete account) or on our website's account deletion page. To get a copy of your data, correct it or ask anything about it, email pocket@khuramimtiaz.com.
Children
Nifa isn't directed at children under 13, and we don't knowingly collect their data.
Changes
If we change this policy, we update this page and its date; for important changes we also tell you in the app.
Contact
Questions about privacy: email pocket@khuramimtiaz.com. Anything else: email pocket@khuramimtiaz.com.