Privacy Policy

Last updated 10 October 2026

In short

We keep only what Nidalumi cannot work without: your sign-in email and what you add to your family yourself.
We never store your password — only a strong hash of it. Not even we can recover it.
We don’t sell data or show ads in the service.
We delete everything on your first request.

1. Who we are

Nidalumi is provided by Nidalumi (self-employed, taxpayer ID 189218224121), “we” below. For any question about your data, write to support@nidalumi.com.

2. What we collect

Account. Your email and password. The password is stored only as a scrypt hash with a separate salt for every account — the original password is never saved anywhere.

Family data. Whatever you and your family enter yourselves: members’ names and roles, tasks and schedules, shopping, menus, expenses, homework, important dates, details of appliances and documents, medicine notes, presents and wishlists, member photos and the family crest if you add them.

Telegram. If a member connects the bot, we receive their Telegram chat ID and username, if they have one, and keep the conversation with the bot so it can be shown in the app. If you forward someone else’s message to the bot, its author’s name may be saved with it. Telegram does not share phone numbers with us.

External calendars. If you connect a calendar by link, the server fetches it from that link to show its events in Nidalumi.

Technical data. A session cookie for sign-in. Your IP address during sign-in, sign-up and code requests, to stop password guessing and spam; it stays in server memory for no longer than an hour. For the free trial we keep an irreversible hash of the address (not the address itself), so that no more than two trials a month are taken from one network.

Payments. Payments are handled by a payment provider. We never see or store your card number.

3. Why

to run the service: show the family plan, send reminders, keep devices in sync;
to protect your account from someone else signing in;
to answer your requests;
to meet legal requirements.

We show no ads, build no profiles and sell no data. We process data to perform our agreement with you and on the basis of the consent you give when creating an account.

4. Who receives data

Telegram — if a member connected the bot: reminders and messages go through Telegram and are handled under its own rules.
Hosting — the company we rent the server with your data from; it only keeps the server running.
Payment provider — payment details only.
Public authorities — only on a request based on law.
Meta (Facebook) — the ad pixel: the page address, browser details and the fact of sign-up, so we can see which ads bring people here. Family data never goes there.

No one else.

5. How long we keep it

For as long as the account exists. A sign-in session lasts up to 180 days from its last use. After an account is deleted, its data is erased from the server within 30 days.

Some data goes away on its own so it does not pile up for years: completed and cancelled tasks older than 90 days are folded into daily counts (how many tasks there were and how many were done — for the yearly summary), items deleted to the bin are removed after 30 days, the feed, “I’m here” check-ins and the pocket-money log after 90 days, and bought items leave the shopping list after 7 days. If a family’s access is unpaid and nobody has signed in for six months, we email its members and delete the family 30 days after that email unless someone signs in.

6. Cookies and on-device storage

Session cookie — for sign-in only. Scripts on the page cannot read it; you cannot sign in without it.
Browser storage — a copy of the family data and settings, so the app opens fast and works offline. Signing out erases this copy.
App cache — interface files for offline use. Family data never goes there.

The Meta ad pixel sets its cookies to show which ads bring people here. You can turn it off in your browser settings by blocking third-party cookies or tracking; the service works without it. There are no analytics cookies: we count site visits on our own server without cookies — country (from the address, which we do not keep), where you came from, device type and page language; kept for 90 days.

7. Children

Parents can add children as family members. A child’s data is entered by the adult who manages the family, and that adult is responsible for it. Accounts are created by adults.

8. Your rights

You can find out what data we hold about you, get a copy, correct it, delete it, withdraw consent and object to processing. Write to support@nidalumi.com — we reply within 10 working days. If you believe we are violating your rights, you can complain to the data protection authority of your country.

9. How we protect data

Passwords are stored only as salted scrypt hashes. Sign-in works through a session in a protected cookie. Password guessing is stopped after ten misses. The server hands out family data only for a valid session. The connection to the service is encrypted.

10. Changes

If this policy changes materially, we will let you know in advance — by email or in the app.