Privacy Policy

• Account information — your name (first name, last name and nickname) and email address, used to create and identify your account, to sign you in, and to show who approved or commented on a piece of content.
• Account identifier — the internal ID number of your account, used to keep you signed in and to link your actions, sessions and notification settings to your account.
• Authentication data — an encrypted login token stored securely on your device to keep you signed in.
• Content interactions — the approvals, rejections, and comments you make on content within the App, recorded with the time and your account, so your marketing team can act on them.
• Share links — when you create a link to share content with someone, we record that you created it.
• Device identifiers — if you turn notifications on, a push notification token for that device, so an alert reaches the right place: the Apple Push Notification service on iPhone, Firebase Cloud Messaging in the Android app, and your browser's own push service on the web. On the web we also store your browser's user-agent string (the name and version of the browser and operating system) with the notification subscription. The iPhone and Android apps also generate a Firebase installation identifier, used by crash reporting and, on Android, by push notifications.
• Technical data — your IP address when you sign in, renew a session, request a password reset or send an error report. We use it only to count repeated attempts and block abuse; it is held in a short-lived security record and is never used to locate you. Opening a share link records more, as described in the next section.
• Crash and diagnostic data — if the App crashes, a crash report (stack trace, app version, device model and operating system version) is sent to Google Firebase Crashlytics so we can fix the problem. Crash reports are not linked to your name or email address.
• Website error reports — if a page of the website fails, it sends an error report to our server: the error message and where in the code it happened, the address of the page (without the part after "?", where a share or approval link keeps its code) and your browser's user-agent string. It goes to our server logs at Cloudflare so we can fix the problem; we do not add your name or email address to it.

We do not collect your location, contacts, photos, or your browsing activity outside the App. The App has no advertising identifier: it does not request one. No advertising SDK and no usage-analytics SDK is built into it — the only Firebase components in the apps are crash reporting and, on Android, push notifications.

• Each visit — every time a share link is opened we record the time, the visitor's IP address and their browser's user-agent string, to count views and to spot misuse of the link.
• Email address — to approve or comment, the visitor enters an email address and confirms it with a one-time code we email to them (sent through Resend).
• Response — the approval or comment is recorded with that email address and the time, on the link and in the content's approval and comment history. Like any other response, it is synced to Smartsheet and may be passed to the marketing team by Slack or email.

The visit records, the one-time codes and the response stored on the link are deleted together with the link: when it expires (a share link lasts up to 3 days) or when the person who created it deletes their account. The entry in the content's history, with the email address and any comment, is kept as set out under Data retention.

• To provide access to your account and the content prepared for you.
• To record your approvals, feedback, and comments so your marketing team can act on them.
• To send notifications about content that needs your review, if you enable notifications.
• To keep your account secure — limiting repeated failed sign-in attempts and preventing abuse of the service.
• To diagnose crashes and faults, so we can keep the App working.

We use your information only to operate the App. We do not sell or rent it, we do not use it for advertising or marketing, and we do not track you across other apps or websites.

• Cloudflare — hosts the App, its database and its media.
• Google Firebase — Crashlytics processes crash reports from the iPhone and Android apps, and Cloud Messaging delivers push notifications to Android devices.
• Apple — the Apple Push Notification service delivers notifications to iPhones. On the web, your browser's own push service does the same.
• Smartsheet — the project-management system your content is planned in; your approvals and comments are synced back to it so your marketing team can act on them.
• Resend — sends the emails the service needs to send, such as sign-in and password-reset messages and notifications about content.
• Slack — where your account is set up to use it, approvals and comments are posted to your team's Slack channel.

We may disclose information if required to do so by law.

• Sign-in attempt records: 24 hours.
• Rate-limiting records (used to block abuse): about 1 hour.
• Sessions and sign-in tokens: until they expire or you sign out. A website session lasts up to 30 days; the apps' sign-in token expires 90 days after it was last renewed. One exception: in the iPhone app with Face ID sign-in turned on, signing out keeps your sign-in token, on your iPhone (where only Face ID can unlock it) and on our server, so that you can sign back in with Face ID. It then stays valid until it expires or you delete your account.
• Notification tokens: until you turn notifications off, sign out, or delete your account. A token is also removed as soon as the push service tells us the device can no longer be reached.
• Share links, with their visit records (IP address and user-agent string), one-time codes and the response recorded on them: until the link expires or its creator deletes their account.
• Website error reports: up to 7 days, in our Cloudflare server logs.
• Crash reports: 90 days (held by Google Firebase).

Some records survive account deletion, because they belong to the client account's content record rather than to your login: the approval and comment history stored against each piece of content (which includes the name, email address and comment text of whoever acted on it), copies already synced to Smartsheet or already sent as Slack or email notifications, and anonymised aggregate logs. Crash reports age out after 90 days and are not linked to your identity. This is set out in full on the account deletion page.

Deleting your account. You can delete your account yourself in the App (Settings → Delete Account), which takes effect immediately, or request deletion at ntzplay.com/delete-account, which we action within 30 days. That page lists exactly what is deleted and what is kept.