Privacy Notice

Nostro is developed and operated by its founding team of three individuals. They are the controllers of the personal data described in this notice (hereafter “Nostro” or “we”).

For any matter relating to this notice, contact us at info@nostroapp.com. Once Nostro becomes a legal entity, we will update this notice with its legal name and address.

For the app, Nostro does not operate its own servers, databases, or analytics services. The app uses CloudKit, Apple’s iCloud infrastructure, to store and sync what the couple saves. Information is stored in each person’s iCloud account and in a zone shared by the two linked people. Each phone also keeps a local copy, including a reduced copy of the cover image for each saved link.

As a result, Nostro cannot access the content you save. We have no dashboard, console, or copy from which to view it. Apple shows us only aggregate, anonymous service metrics, such as numbers of requests and errors.

To verify Nostro Pro subscriptions and learn anonymously which parts of the app are used, Nostro relies on two providers: RevenueCat and TelemetryDeck. Neither receives the content you save. Section 7 explains what each receives.

The app handles the following categories of information. Profiles and content are stored in iCloud; some identifiers and reduced copies of cover images also remain on the device:

• Profile data: the name and color each person chooses in the app.
• Content: shared links and their public details (title, author, and thumbnail), ideas, plans with their dates and places, notes, budgets, photos, and videos with sound.
• Technical identifiers: the CloudKit shared-zone identifier, which lets two people see the same information, and the identifier iCloud assigns to each person’s account within Nostro. The app stores the latter alongside the person’s name to recognize them across pairings. It reaches both phones and is also stored locally for the notification extension; it is neither the Apple Account nor its email address.
• Technical subscription and usage data: Nostro Pro subscription status and anonymous usage statistics. These are not stored in iCloud, do not include the content listed above, and are received by the providers described in section 7.

Nostro does not ask for your full name, email address, phone number, contacts, advertising identifiers, or financial information to create an account. Apple processes Nostro Pro payments; Nostro does not see your card or payment details. The app requires no account or password: identity is tied to the device’s iCloud session, managed by Apple. When you open an invitation, the app displays the name Apple associates with the inviter’s iCloud account, when that account shares it. The name arrives with the invitation and stays on your phone only until you accept or decline it.

Nostro does not retain your location either. If you allow the app to use it, it is read only while you search for a place for a plan, to show nearby places and their distance first. It is not saved on the device or in iCloud and is discarded when you close the search.

Photos are stored at reduced size, with a maximum of twelve per plan and 2,048 pixels per side. Metadata from the original file, including location recorded by the camera, is removed.

Information is used to provide the service: show both devices what the couple saves, keep it synchronized through iCloud, schedule a local streak reminder, let you save photos and videos to the Photos app when you request it, and verify whether the couple has an active Nostro Pro subscription. If you agree, the app also offers to remove from Photos the originals you just uploaded.

The only secondary purpose is to learn, through anonymous statistics, which parts of the app are used so we can improve it. You can object at any time by turning off “Share anonymous statistics” at Nostro › Settings › Privacy Notice, at the bottom of the screen, without affecting the service. Nostro does not use your data for advertising, profiling, or model training, and does not sell it.

What the couple saves in the shared space counts against the iCloud quota of the person who created the shared zone. The copy the app keeps of each person’s stories in “Your past stories” is stored in the iCloud account of the person who posted them and counts against that person’s quota. Each device also keeps a local copy for offline use and a reduced copy of each link’s cover image; these copies are deleted when the app is uninstalled.

Each story is available to both people for 24 hours. After that it no longer appears in the shared space, and the person who posted it keeps their copy until they delete it. Other data remains for as long as it is kept in iCloud. With no linked partner, “Delete everything” immediately and irreversibly deletes local information and information stored in iCloud. While linked, “Request to delete everything” sends a request for the other person to confirm on their phone; if confirmed, the information is deleted for both. If they decline or 24 hours pass, nothing is deleted; you can unlink and then delete without a partner. Uninstalling deletes only the local copy and anything that has not yet uploaded to iCloud.

When the couple unlinks, each person keeps the copy already on their device and stops receiving anything the other saves afterward.

Nostro does not sell your personal data or transfer it to third parties for their own purposes. Some features involve direct technical communication between your device and other services, and two providers receive technical data: RevenueCat, which processes it on our behalf solely to verify Nostro Pro subscriptions under the data processing agreement included in its terms of service; and TelemetryDeck, whose data protection agreement, included in its terms of service, ensures that what it receives cannot identify any person, that it is protected by technical and organizational measures, and that its infrastructure providers’ access is limited to what is technically necessary under contractual protection obligations. Each service and the data it receives are described below:

• Apple (iCloud and CloudKit): stores and synchronizes information and sends silent notifications telling the app about changes, as well as visible alerts about the other person’s activity, to which the app adds that person’s name on the phone. Apple’s privacy policy applies.
• RevenueCat: verifies Nostro Pro subscriptions. It receives the purchase status reported by Apple (the plan purchased, its validity, and whether it was renewed, canceled, or refunded); a random identifier shared by the two linked people that is not associated with their names or email addresses; an anonymous identifier generated by RevenueCat; the app and operating-system versions; language and currency; phone model; country of the Apple storefront; the identifier iOS assigns to the app on that phone (not the advertising identifier); and, when verifying a purchase, whether the phone permits apps to request tracking permission. It also receives the IP address from which each request is made, as with any internet connection. It never receives your photos, videos, notes, plans, dates, names, email addresses, or places. Apple charges the subscription to the purchaser’s Apple Account. RevenueCat keeps the subscription record while Nostro uses its service. You can request its deletion at info@nostroapp.com, providing the order number from the purchaser’s Apple receipt. Deleting that record does not cancel the subscription with Apple; if it remains active and the app is opened, the record may be created again. In that case, definitive deletion is handled when the subscription ends.
• TelemetryDeck: produces anonymous usage statistics. It receives only events from a closed list defined by Nostro, such as completion of initial setup or posting a story, sometimes with a value from a fixed list, such as whether the story is a photo or video. Each event also carries technical device data: the model; operating-system and app versions; language; region; time zone; hour of the day without minutes; some display and accessibility settings; the number of days on which the app has sent statistics; approximate counts of app launches and of time spent in the foreground since the latest launch; a random identifier for each usage session, which changes whenever the app is opened or resumed after five minutes; an anonymous installation identifier produced by an irreversible function, which Nostro cannot link to any person and which changes when the app is uninstalled; and, as with any internet connection, the device’s IP address. It never receives the content you save, names, email addresses, the couple identifier, or the device’s advertising identifier. It is not used to track you or combine information with other sources. Statistics are on by default; you can turn them off at any time using “Share anonymous statistics” at Nostro › Settings › Privacy Notice, at the bottom of the screen. When turned off, the app sends no statistics. Under Nostro’s current plan, TelemetryDeck makes the statistics available for queries for 24 months, then archives them without deleting them. Because they are not linked to any person, they cannot be located or deleted individually.
• TikTok, YouTube, and Instagram: when you save a link to one of these platforms, the app requests the content’s public details (title, author, and thumbnail): from TikTok and YouTube through their public oEmbed services, and from Instagram through the post’s public page. The request sends the platform the link URL and the device’s IP address, as when opening the link in a browser. The thumbnail is downloaded from their servers to both phones, each of which keeps a reduced copy for display; “Delete everything” removes it. Links to other sites are saved without any lookup.
• Apple Maps: when you search for a place for a plan, the search text is sent to Apple’s map service and, only if you have allowed the app to use your location, the device’s location is sent too, to show nearby places and their distances first. Without that permission, the search may center on the last saved place. When you save a place, its coordinates are sent to Apple to obtain its cover image. Both the place and that image are saved in iCloud and visible to the two linked people.
• Vercel: hosts this website and, like any infrastructure provider, temporarily logs each visitor’s IP address and user agent for operational and security purposes. Nostro does not inspect or correlate those logs.

The app requests only the permissions needed for the feature you activate. None is required for general use of the app.

• Camera: to take a photo and save it to a plan without leaving the app, and to take a photo or record a video for a story. The app asks before opening the camera for the first time.
• Photos: to save a story photo or video to the Photos app, for which permission to add only is enough, and to save your memories in a folder with an album for each date when you request it, for which the app requests full access to your library; limited access to selected photos does not allow it to create albums. After uploading photos or videos from your library to a plan, the app offers to remove the originals from Photos; if you agree, the system asks you to confirm, and you can change your answer in the app settings. Selecting photos and videos uses the system picker, which does not require this permission.
• Microphone: to include sound in videos you record with the app’s camera. The system requests permission the first time you record a video, not when you take a photo. Sound is saved as part of the video and handled in the same way.
• Notifications: to tell you when the other person saves an idea, sets a date for a plan, uploads a story, photos, or their note, or changes something about the pairing, and to remind you at night when your streak still needs a story. Each alert can be turned off at Nostro › Settings › Notifications.
• Location: only while using the app and only with your permission. The app requests it once, when you tap “Current location” while searching for a place for a plan. From then on, each place search reads it when opened, without asking again, to show nearby places and their distances first. If you chose approximate location, place search offers “Use precise location”; only when you tap it does the app request precise location, and only for that session. If you decline, search works with approximate location. Location is read only within place search, is not saved, and you can revoke permission at any time in Settings › Privacy & Security › Location Services › Nostro. The app does not request location on launch or outside place search.
• Nostro does not request access to contacts or Apple’s App Tracking Transparency permission, because it does not track you.

Nostro is distributed through the App Store, an Apple service governed by its own terms and privacy policy. Apple processes downloads, updates, and payments and provides us only with aggregate, anonymous information, such as the number of downloads and installs for each version, without identifying individuals.

If you allow analytics data to be shared with developers in your iPhone settings, Apple also provides us with crash reports. These include the device model, iOS version, and app state at the time, but not the content you save. Only the Nostro team reviews these reports, solely to fix errors and improve the app; they are not shared with third parties.

nostroapp.com is a static website. It does not use cookies or trackers, or have forms that collect personal data. The QR codes on Nostro’s printed posters point to addresses that begin with nostroapp.com/s/, each of which forwards to the App Store. Each time one is opened, the site adds one to a counter for that poster, by day and by hour of the day. The counter stores only those figures: it does not record the IP address, the user agent, or any other data about the visit, so it cannot identify anyone. To avoid counting search engines and link-preview services, the site checks the user agent at the time of the visit without storing it. The figures are stored in Upstash, a cloud database service. Links to the App Store and Instagram, and the site-link sharing feature, use your device’s operating-system mechanisms.

You have the right to access, correct, and delete your personal data, to object to its processing, and to withdraw your consent. Because Nostro cannot access the content you save, you can view and change it in the app. With no linked partner, you can delete it using “Delete everything”; with a partner, “Request to delete everything” requires the other person’s confirmation. If they do not confirm, you can unlink and then delete your information.

To exercise these rights for any other data Nostro may hold, such as an email you sent us, or to request deletion of the subscription record held by RevenueCat, email info@nostroapp.com with your name, a way to contact you, and a clear description of your request. For a subscription record, include the order number from the purchaser’s Apple receipt. Deleting that record does not cancel the subscription with Apple; if it remains active, the record may be recreated when the app opens, and definitive deletion is handled when it ends. We will respond within a maximum of twenty business days, at no cost.

If you believe your right to personal-data protection has been violated, you may contact the competent authority in Mexico.

Nostro is intended for people aged 13 or older, the minimum age for an Apple Account in Mexico. People under 18 need their parent’s or guardian’s consent. Nostro does not collect data that would reveal users’ ages; if you learn that a minor is using the app without the required permission, please write to us so we can address it.

Information is transmitted and stored through Apple’s iCloud infrastructure, with the encryption in transit and at rest that Apple applies to CloudKit. Nostro includes only two third-party libraries, those of RevenueCat and TelemetryDeck described in section 7, and neither receives the content you save. Keeping their number to a minimum reduces the app’s exposure. Your device’s iCloud backup also protects Nostro information; we recommend keeping it on.

Any change to this notice will be published on this page with the date of the latest update. If a change substantially affects how your data is handled, for example if Nostro adds its own services in the future, we will notify you in the app before it takes effect.

This notice is governed by Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations, and other applicable provisions of the United Mexican States. If you live in another country whose laws grant you additional rights, you can exercise them through the same contact address.