Privacy Policy

Scope & our role

This Policy applies to Nappo’s app, website, and related support channels. Nappo’s service operator is the controller of personal information processed for these services. It does not cover external services you independently choose to visit.

We design collection around feature necessity. If information is not needed to run, secure, support, or legally maintain Nappo, we do not collect it.

Information used by Nappo

Camera, photo-library, and notification access occurs only after device permission. You can revoke access in device settings, though the related feature may stop working.

Please crop uploads to the hand and nails. Do not include faces, documents, addresses, health information, or bystanders unless genuinely necessary and authorized.

Why we use information

• Provide accounts, profiles, uploads, generation, virtual try-on, feeds, search, challenges, messages, likes, saves, and notifications.
• Process purchases, restore entitlements, track credits, and prevent billing fraud.
• Keep the Service safe, detect abuse, investigate reports, enforce rules, and protect rights.
• Debug crashes, measure feature reliability, and improve user experience using minimized or aggregated signals.
• Respond to support requests and meet legal obligations.

Depending on where you live, processing relies on performance of our contract, your consent, legitimate interests in operating a safe and reliable service, or compliance with law. You may withdraw consent where consent is the basis.

How AI processing works

When you request a try-on or generated look, our own infrastructure processes the photo, prompt, chosen reference, and settings to produce the result. We do not send those inputs to third-party AI model services.

Private uploads and private outputs are not used to train our models unless you separately opt in through a clear choice. If we offer an opt-in, you can withdraw it for future training. Removing data already incorporated into a trained model may not be technically possible, and that limitation will be disclosed before consent.

Public posts may be reviewed for moderation and product-quality analysis. We use de-identified or aggregated data where feasible and do not use public status as a shortcut for unrelated data use.

No selling, trading, renting, or sharing

We do not sell, trade, rent, or share user information with advertisers, data brokers, other users, or external AI model providers.

Limited disclosure may occur only when you direct it (for example, publishing a post), when legally compelled by a valid process, or when essential infrastructure vendors process data strictly on our behalf under confidentiality, security, purpose limitation, and deletion obligations. These vendors may not use it for their own purposes. If ownership of Nappo changes, information may transfer subject to the same Policy and legally required notice.

How long information stays

We retain information only for the shortest period reasonably needed for its purpose:

• Account and profile data: while your account is active, then deleted or de-identified after closure, subject to limited legal needs.
• Generation inputs and outputs: only as needed to return, save, or troubleshoot the result; unsaved temporary files are scheduled for prompt deletion.
• Public posts and messages: until you delete them or the account, except moderation evidence and recipients’ copies.
• Purchase, fraud, security, and support records: for applicable tax, chargeback, safety, limitation, and legal periods.
• Encrypted backups: removed on the normal backup rotation.

Exact periods can vary by feature and law. You may ask us for the period applicable to a specific record.

Your controls & privacy rights

Use in-app settings to edit your profile, manage notifications, change post visibility, remove content, or request account deletion where available. You may also ask to access, correct, delete, export, restrict, or object to processing and to withdraw consent, subject to local law.

Email support@nappo.store from your account email. We may verify your identity before fulfilling a request and will respond within the period required by law. Authorized agents may submit requests where permitted. You may appeal a refusal or complain to your local privacy authority.

We do not use sensitive personal information for unrelated profiling, and we do not make decisions producing legal or similarly significant effects solely through automated processing.

Security, transfers & young users

We use encryption in transit, access controls, logging, minimization, secure development practices, backups, and incident procedures. No system is perfectly secure; report suspected issues promptly. If a breach creates a legally reportable risk, we will notify affected users and authorities as required.

Information may be processed where Nappo operates infrastructure. For cross-border transfers, we use safeguards required by applicable law and keep the same privacy commitments wherever processing occurs.

Nappo is not directed to children under 13 or the minimum age required locally. We do not knowingly collect their personal information. A parent or guardian who believes a child submitted information should contact us for removal.

Updates to this Policy

We may update this Policy to reflect feature, security, or legal changes. We will change the effective date and give prominent notice when changes materially affect your rights. We will request fresh consent where required.