Nearlet

Your space.
Your privacy.

Updated 5 November 2026

Nearlet is operated by Roman Vei, an individual developer. This policy covers the Nearlet app for Apple iOS and these support pages.

Information we process

When you sign in, Nearlet processes your account identifier, email address and profile name through your chosen sign-in provider and Supabase. Google and Apple sign-in are available.

Signed-in notes, tasks, plans, saved links, photos, recordings, sharing choices and pairing records are stored through Supabase to provide the features you use and synchronize your devices. Preview content and private drafts remain on your device.

If you contact support, we receive your email address and the information you choose to include. We use it to respond and resolve the issue.

Personal and shared content

Personal content is accessible to your account. Items you share become accessible to your paired partner. Pairing does not automatically publish your personal items.

Ending a pairing gives each person a separate archive of shared history they could already access. Private drafts, hidden answers and unopened capsule contents are not revealed by disconnecting. New partners do not automatically receive earlier archives.

Server access controls protect stored content. After you set up encryption keys, the current app encrypts new Memories posts and replies, Saved items and attachments, tasks and plans and their comments, signals and statuses and their replies, custom tags and collections, and supported capsule and answer content on your device before upload. Shared encrypted content requires both partners to set up keys and verify their safety codes. The service stores ciphertext plus the metadata needed to route and authorize changes. Older app versions may not be able to open new encrypted content.

Encryption, recovery and optional concealment

Account names, profile photos, relationship dates, membership and delivery metadata, and curated question prompts remain readable by the service under access controls. Legacy voting rounds use server-controlled reveal rules. Existing records are not all encrypted automatically: the earlier-content action converts supported active content you authored, but does not retroactively encrypt or erase earlier archives, backups, exports or recipient-held copies. The service can still see account and public-key identifiers, sharing relationships, record identifiers, revisions, workflow state, request timing and object sizes.

Nearlet keeps encryption keys separately for each account in this device’s Keychain. Signing out or switching accounts does not erase those keys. After confirming the account’s registered encryption identity, the app also attempts to save a separate recovery seed in Apple’s synchronizable Keychain. If iCloud Passwords & Keychain is enabled and a matching copy is available, Nearlet can restore that identity automatically after reinstalling or on another Apple device. Apple handles Keychain synchronization under its own privacy and security rules. A successful local save does not prove that synchronization has completed, and recovery is not guaranteed. Nearlet’s servers do not receive the private recovery seed. Partner verification remains specific to the device and is not restored as trusted automatically. An optional recovery-kit export in Settings remains a fallback; protect that exported file like a password.

Your recovery kit contains private key material. You can export it through Files after device authentication and import it for the matching signed-in account. The exported file is not password-encrypted; protect it like a password and choose a trusted storage location. A file provider you select, such as iCloud Drive, handles that copy under its own rules. Keep a secure copy and save a fresh kit after verifying a partner. Nearlet does not receive the kit and cannot recover lost keys for you. Restored devices share the same account identity; there is no individual-device revocation or forward secrecy. A compromised recovery kit can expose encrypted content. This implementation has not had an independent cryptographic audit.

Ordinary photos display normally. “Hide until tapped” is optional and covers content on screen; it is separate from encryption. Optional Face ID or Touch ID, with device-passcode fallback, gates revealing covered posts and exports on that device. Biometric matching is handled by Apple iOS; Nearlet does not receive biometric data. A recipient can still capture, export or keep content. No feature guarantees that shared content cannot be copied.

The new app excludes local content caches and drafts from future device backups. Accessible content remains available to the authorized app on an unlocked device. Explicit exports contain decrypted content; protect those files separately.

Device permissions and links

Microphone and photo access support actions you choose, such as recording a voice note or saving an image. You can change permissions in your device settings. The optional “Use my location” action uses your position to find nearby places in Apple Maps. Your current position is not automatically shared with a partner; only a place you confirm and save becomes part of the plan. Image text recognition runs on-device. Voice transcription uses on-device recognition where supported. When a selected language requires Apple’s online speech recognition, Nearlet explains this and asks for confirmation before sending that recording to Apple. Cancelling keeps your recording and lets you enter text manually.

Opening a link or requesting its preview may contact the linked website. That site can receive network information such as your IP address and handles it under its own privacy policy.

Memories, notifications and widgets

Saved and Memories are separate spaces. Photos you send through the camera widget are an exception: they also create or append to one normal shared gallery for that day, up to its free or Premium media capacity. Later photos may still be exchanged without being added to that full gallery.

Nearlet and its widget and notification extensions share protected, device-local storage so widgets and notification previews can update while the app is in the background. This may include decrypted status and signal text, selected note text, photo previews, account and pair identifiers, and limited-purpose widget credentials. A separate, non-synchronizing Keychain copy of read keys lets authorized extensions decrypt an encrypted projection for the current account and pair; it does not contain the account signing key or an Auth refresh token. The server stores that projection encrypted and does not receive its private decryption keys.

Full note or photo widget previews require your choice in Nearlet. Your Home Screen may expose that preview to anyone who can view it. Concealed or encryption-locked posts are excluded from timeline widget entries. Widget actions can send the signal you explicitly tap; taking and sending a photo uses a full-screen view in Nearlet. These shared photos follow the app's encrypted media storage described above.

Signing out clears the active widget snapshot, credentials and extension read context. Your account's recovery keys remain separately preserved as described above. Apple iOS controls background execution and visible widget refresh; updates may be delayed.

AI, advertising and diagnostics

Cloud AI chat and writing are not connected. On supported Apple iOS devices, optional automatic organization uses Apple’s on-device model to categorize imported links from their title, URL and your note. This processing stays on the device. You can turn it off in Saved → Share to Nearlet. It preserves your chosen visibility. Links are organized with tags rather than link collections. The optional Apple speech-recognition flow described above sends audio only after your confirmation. The app has no advertising or advertising tracking. Optional usage analytics is described below.

Apple may provide crash reports, diagnostics and TestFlight feedback according to your Apple settings. Please avoid including private content in feedback screenshots.

These support pages have no analytics scripts or advertising cookies added by Nearlet. The hosting service receives ordinary web request information, such as IP address and browser information, to serve and protect the pages.

Optional usage analytics

Usage analytics is off until you choose to allow it. Your choice applies to the signed-in account on this device and can be changed in Settings → Usage & privacy. Declining does not restrict app features.

If you agree, we send selected app actions, onboarding steps, invitation and connection results, successful content-write categories, explicit opening of shared items, sync timing and error categories, notification preferences, app version and language to PostHog’s EU service. Account, couple and item identifiers are transformed into stable coded identifiers. These are pseudonymous, not anonymous: we can derive the account identifier to handle a verified privacy request.

We do not send names, emails, messages, titles, photos, recordings, saved URLs, precise locations or raw errors in analytics events. There is no automatic screen capture, session replay, advertising ID, cross-app tracking. PostHog keeps a profile under the coded account identifier so analytics deletion can be located and verified; we do not set names, emails or other person-profile properties. IP geolocation is disabled in the event payload; PostHog still receives network requests needed to deliver the service.

Unsent events are held on this device for up to seven days, with a maximum of 256 events. Opting out or signing out clears unsent events and cancels pending delivery; an already accepted request cannot be recalled. Opting out does not delete events already received by PostHog. PostHog currently has no automatic event-expiry period configured for Nearlet. Deleting your Nearlet account queues a request to delete its coded analytics profile and events. This runs separately from account deletion and provider processing is asynchronous, so erasure is not immediate. We retain limited cleanup records to retry and verify the request. You can also contact support to request analytics deletion without deleting your account.

We use opted-in events to improve onboarding and reliability. They are not a complete count of all users. Test-account events are separated from launch dashboards. Limited feature-flag checks for designated test accounts are independent of optional usage analytics and control testing tools; normal account permissions remain enforced by the server.

Service providers

Supabase provides authentication, database and media storage. Nearlet’s database project is hosted in Ireland. Your sign-in provider, support email provider and hosting provider may process information in other countries under their own policies.

Retention and deletion

We retain your account and content to provide the service until you remove them through the available controls. Support correspondence is retained as needed to resolve requests and keep a record of their resolution.

In Settings → Account & space, you can export accessible content, end a pairing or delete your account. Account deletion removes your sign-in, personal content and archives, and ends your current pairing. Your partner keeps shared history they could already access, including independently retained attachments. Retained attachments are removed when account deletion leaves no remaining reader.

Other installations need an internet connection to learn that an account was deleted. Offline copies cannot be cleared remotely while offline. Exports, screenshots and copies held outside Nearlet cannot be recalled.

Restricted, encrypted operational backups may contain earlier copies while needed for recovery. They are used for recovery rather than ordinary app access. Deletion requests must be reapplied before recovered data is returned to service. Minimal technical deletion receipts are retained to support safe retries and recovery.

Your choices and requests

You can manage sharing, edit your profile, export accessible content, delete your account and change device permissions. For questions or requests about your information, email support@nearlet.app. Depending on where you live, you may have additional privacy rights. We may need to verify account ownership before acting on a request.

Premium subscriptions

Apple handles payments. RevenueCat receives an environment-prefixed Nearlet account identifier, subscription product and transaction information, renewal or expiry dates, and entitlement status to verify Premium and restore purchases. We do not send private content, names, email addresses or payment card details to RevenueCat. Our server checks subscription status and shares benefits with your current connected partner; purchaser decoration belongs to the account that owns Premium. Temporary complimentary grants record an account identifier, expiry, operator, reason and reference in a restricted audit log. Deleting your Nearlet account does not cancel an Apple subscription. Manage or cancel renewal in your Apple subscription settings. After account deletion completes, Nearlet queues removal of that account's RevenueCat customer record. Cleanup is asynchronous and retried during provider outages. We continue checking for late records for at least eight days before recording verified removal. This does not cancel an Apple subscription or erase transaction records Apple must retain. Contact support@nearlet.app for billing-data requests.

RevenueCat privacy policy

Partner facts

Knowledge facts about you or your partner, such as preferences, clothing measurements, selected answer images and custom photos, are shared within your connected pair. There is no private-fact setting. Saved wishes and links added to a person’s canvas are also shared within that pair. Your other personal items stay in Mine unless you choose to share them.

Changes to this policy

We will update this page when the service or its data practices change and revise the date above. Material changes that affect your choices will be communicated in the app or by another appropriate means.

Optional cover photos

When you request cover suggestions from a product or venue website, Nearlet contacts that public website and its image hosts. When you tap Search in the cover picker, your search words are sent through Nearlet to Pixabay to retrieve public photo suggestions. We do not send your private notes or your current location to Pixabay. Public search results are cached for 24 hours; the cache stores a hash of the search, not its text. Selected covers are downloaded and saved with the item, using the same privacy and encryption as your other saved images. You can use your own photo instead.

Optional Spotify connection

When you connect Spotify to search for songs, your searches go directly to Spotify. Connection tokens are stored in this device’s Keychain and are not sent to our server or shared with your partner. Disconnect Spotify in the song picker or sign out of Nearlet to remove the local connection. You can also revoke access in your Spotify account.

Saving a Spotify link may load its public title and artwork from Spotify without connecting an account. Saved song links, metadata and your notes follow the privacy setting you choose; shared songs are visible to your partner. New song links, metadata and notes use the Saved-item encryption described above after key setup; profile and routing metadata remain outside that encryption. Spotify metadata is not passed to the automatic AI link categorizer. Playback opens Spotify and is subject to Spotify’s account and playback rules.