Privacy Policy

Nybble, operated at getnybble.com as a sole proprietorship based in India, is the data fiduciary (data controller) for the personal data described here. For any privacy question, request, or complaint, write to bytes@getnybble.com. Our operations are based in Nagpur, Maharashtra, India.

If you only read Snack, signed out

No account, no sign-in, no personal data. You are counted in the aggregate analytics described below and nothing else.

If you sign in

• Account details from Google. When you sign in with Google we receive your email address, name, profile picture, and Google account identifier. We do not receive your Google password and we have no access to your Gmail, Drive, contacts, or any other Google service.
• Profile details you give us. Anything you set on your profile, such as your display name and preferences.
• Learning activity. Which Snack items and Stack explainers you have read, your Hack quiz answers and scores, and when each happened.
• Progress records. Your bit balance and the ledger of how it was earned, your badges, your unlocks, and your current and longest streak.
• Your time zone. Derived from your browser so that daily streaks roll over at midnight where you are rather than in some other part of the world.

Analytics, for everyone

We use Vercel Analytics and Vercel Speed Insights to understand which pages are used and how fast they load. These are privacy-first products: they do not set cookies, do not track you across other websites, and do not build a profile of you. They record page views and coarse technical details such as browser type, device type, referring page, and country-level location, in aggregate.

If you contact us through the in-app form

We store the message you wrote, the email address you provided (or the one on your account if you were signed in), and a one-way hash of your IP address that we use only to rate-limit abusive submissions. The raw IP is never stored. We use this record to reply to you and to keep track of what needs fixing.

What we never collect

We do not ask for or store payment card details, government identifiers, precise location, or any special category data. Nybble does not build its own marketing profile of you. We do show ads through Google AdSense — how that works, and how to opt out of personalised ads, is described in section 11.

• To create your account and sign you in, and to show your name and picture in the interface.
• To keep your place: reading history, quiz results, and the progress that makes Stack and Hack useful across sessions.
• To run bits, badges, and streaks, including the daily caps and freezes that make the system fair.
• To operate, secure, and debug the service, and to prevent abuse.
• To understand aggregate usage so we can decide what to build next.
• To meet legal obligations and to establish or defend legal claims where necessary.

We process this data on the basis of your consent, given when you sign in, and because it is necessary to provide the service you asked for. You can withdraw consent at any time by deleting your account, as described in section 6.

We do not sell your personal data, rent it, or share it with data brokers, and we do not use it to train AI models. To show ads we use Google AdSense, which lets Google and its partners process cookies and device data to serve and measure ads — see section 11, where you can opt out of personalised ads.

We use a small number of service providers to run Nybble. Each processes data only on our instructions.

• Supabase — database and authentication. Holds your account and all progress data.
• Vercel — hosting for the website, plus the analytics and speed measurement described above.
• Railway — hosting for our backend API, which processes requests in transit.
• Google — sign-in only, through Google OAuth, when you choose to use it.
• Google AdSense — advertising. When ads are served, Google and its certified partners process cookies and device identifiers to serve and measure them (see section 11).

We also use OpenAI and Google Gemini to help write and edit the news summaries and explainers we publish. These tools process public articles and our own editorial material. Your personal data and your learning activity are never sent to them.

We may also disclose data where we are legally required to, or to protect the rights, safety, or property of Nybble or its users.

Most of what we hold is private to you. There is one exception, and you can switch it off.

When you earn a badge, a public page for it is created automatically at getnybble.com/badge. This is on by default. The page is reachable by anyone who has its link, may be indexed by search engines, and generates a preview image for social platforms. It shows your display name, the badge, and the date you earned it. It does not show your email address, your quiz answers, your bit balance, or your reading history. The link is not announced anywhere — it is there for you to share if you want to — but it is publicly reachable whether or not you share it.

To turn this off, use the public badge pages setting on your profile. Switching it off makes all of your badge pages return “not found” immediately, including any you have already shared. You can also email bytes@getnybble.com and we will do it for you. Note that search engines and social platforms may keep cached copies for a period afterwards, which is outside our control.

You can, at any time:

• Access the personal data we hold about you, and receive a copy of it.
• Correct anything inaccurate or incomplete, from your profile page or by writing to us.
• Delete your account and the personal data attached to it.
• Withdraw consent to our processing, which for a service like this means closing your account.
• Complain to us, and to the Data Protection Board of India if you are not satisfied with our response.

To exercise any of these rights, including deleting your account, email bytes@getnybble.com from the address on your account. We will respond within 30 days and will not charge you for a reasonable request. We may ask you to confirm your identity before we act.

If you are in the EU or UK, you also have the right to object to processing, to request restriction, and to data portability, and you may complain to your local supervisory authority.

• Account, profile, and progress data: for as long as your account is open.
• After you delete your account: your profile, reading history, quiz answers, bit ledger, badges, and unlocks are deleted within 30 days.
• Backups: deleted data may persist in encrypted backups for up to 90 days before those backups are rotated out.
• Aggregate analytics: retained on an ongoing basis, but these contain no information that identifies you.
• Records we are required to keep by law are kept for the period the law requires.

Our service providers operate globally and your data may be stored or processed outside India, including in the United States and the European Union. We rely on our providers’ contractual safeguards, including standard contractual clauses where applicable, to protect it in transit and at rest.

Traffic is encrypted in transit with TLS. Authentication uses signed tokens rather than passwords we hold, and database access is restricted per user by row-level security so that one account cannot read another’s data. No system is perfectly secure, and we cannot guarantee absolute security, but if a breach affects your personal data we will notify you and the Data Protection Board of India as the law requires.

Nybble is intended for users aged 13 and over and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, email bytes@getnybble.com and we will delete it.

For the core service we use only what is strictly necessary: authentication cookies set by Supabase that keep you signed in, and local storage on your device that remembers interface preferences. Our own analytics (Vercel) are cookieless. None of this profiles you or tracks you across other sites, and none of it is set unless you sign in or change a setting.

Advertising. Nybble uses Google AdSense to show ads. Where ads are served, Google and its certified partners may set and read cookies and similar identifiers on your device to serve and measure them, including personalised ads based on your prior visits to this and other sites.

Your choices. If you are in the EEA, the UK, or Switzerland, we show a consent banner (Google’s certified consent tool) before any advertising cookie is set, and ads honour your choice. Anywhere, you can turn off personalised ads through Google My Ad Center or aboutads.info, and you can read how Google uses cookies in advertising. Clearing your browser cookies and storage resets these choices and signs you out.

We will update this page when our practices change. The date at the top always reflects the current version. If a change materially affects how we use your personal data, we will give notice on the site or by email before it takes effect.

If Nybble is later incorporated as a company, or the business is reorganised, merged, or sold, personal data may transfer to the successor entity, which will remain bound by a policy at least as protective as this one. We will tell you if that happens.

For any privacy question, request, or grievance, contact our grievance officer at bytes@getnybble.com. We acknowledge grievances within 7 days and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.