Privacy policy.

01 / A little clarity

This policy explains how Nuvkin, the mobile app and this website, handles personal information. Nuvkin is operated by Ismath, an individual based in Sri Lanka. You can contact the operator at ismath@nuvkin.com.

Nuvkin is a friends-only sharing app for adults aged 18 and over. It supports a circle of up to 10 friends, camera snaps, voice notes, invitations, and emoji reactions. A small audience does not mean no data is collected: the service needs account information and stores the content you send.

02 / What we collect

We do not request access to your address book or your precise device location. Snaps use the in-app camera; there is no gallery-upload feature. A photo or recording can still reveal personal information through what it shows or contains. Only share content you are entitled to share.

03 / Why we use it

• Create and maintain your account, authenticate you, and protect sessions.
• Find a person by the email or QR code you provide, send invitations, and manage accepted friendships.
• Store, generate thumbnails for, deliver, and display photos and voice notes to the intended recipients.
• Show reactions and seen status, and deliver optional notifications.
• Send password-recovery codes and password-change notices through transactional email.
• Respond to support and privacy requests, diagnose errors, prevent abuse, and meet applicable legal obligations.

Where the law requires a legal basis, we use the basis applicable to the activity: providing the service you request, legitimate interests in operating and securing it where those interests are not overridden by your rights, compliance with law, or consent where required. Optional device permissions can be withdrawn in your device settings.

04 / Who can see your information

Other users: your intended friends can see the moments you share with them, your reactions, and your profile information, including your name, emote, and email. Someone who already has your exact account email or a valid QR invitation can use it to initiate a friend request or resolve your profile. Nuvkin has no public discovery feed, but email and QR lookup are not anonymous.

Service providers: the service uses server/database hosting and MinIO object storage for accounts and media; Expo’s push service, Apple Push Notification service, and Google Firebase Cloud Messaging for notifications; and Brevo for password-recovery and security emails. Email providers receive the destination address and email content. Push providers receive device tokens, notification text, and routing metadata. The notification payload does not contain the photo or voice file itself.

Notifications may reveal a sender name or activity on a device’s lock screen, depending on the recipient’s settings. Your friends may save or capture content using their devices. Nuvkin cannot recall copies someone has already made.

Other disclosures: information may be disclosed when required by applicable law, to respond to lawful requests, protect people or the service, or handle a transfer of the service with appropriate notice where required.

The current app and website do not include third-party advertising or behavioral-analytics integrations. We do not sell personal information or use your snaps and voice notes for targeted advertising.

05 / Permissions & your device

• Camera: used to capture snaps and scan friend QR codes when you open those features.
• Microphone: used when you record a voice note.
• Notifications: optional, for new moments, invitations, and reactions. You can disable them in your operating-system settings.
• Local storage: the app stores a refresh token using platform secure storage, remembers your appearance preference, and may temporarily cache media so it can load and replay. Device or operating-system backups may be controlled by your platform settings.

You can change permissions in your device settings. Denying camera or microphone access limits the corresponding feature; disabling notifications does not prevent you from opening the app.

06 / How long we keep information

Account information is retained while the account is active and as otherwise needed to provide the service or handle a verified deletion request. In the iOS and Android app, open your profile, choose Edit profile to reach settings, and choose Delete account. Confirm your current password and then confirm permanent deletion. Photos, voice notes, friendships, and related records remain stored until removed through an available feature or a processed request, subject to the limits below. Viewing a snap, catching up on home, logging out, or uninstalling the app does not itself delete your account or all stored content.

Available media-deletion controls depend on the feature. Profile snaps can be removed; in a direct conversation, the current app permits deletion of the most recent message you sent. Unfriending should not be treated as a request to erase every account or service record.

In-app account deletion removes your profile, friendships, invitations, conversations, sent snaps and voices, reactions, sign-in sessions, push registrations, and recovery records from the active database. It immediately ends access through the deleted account. Original files and thumbnails are queued for physical erasure, normally within a few minutes. A durable cleanup queue temporarily retains object keys until erasure succeeds and retries storage outages automatically. Background cleanup also removes other media no longer referenced by active snaps or messages after it is eligible for cleanup. The current backend also prunes password-recovery records older than two days and completed push-delivery records older than seven days. These are routine cleanup rules, not guarantees of immediate erasure, and rely on successful background processing.

Some information may need to be retained for security, fraud prevention, resolving disputes, or applicable legal obligations. Copies in any backups or provider systems may follow their own deletion cycles. Contact us for details relevant to your request. Copies independently saved by a recipient are outside Nuvkin’s control.

07 / Your choices & deletion requests

This opens your email application; it does not automatically delete anything. Requests are handled by the operator. We may ask for information reasonably needed to verify ownership before acting. A full-account request covers the profile, friend relationships, and associated snaps, voice notes, and reactions, subject to applicable retention exceptions. We will explain any applicable limits when handling your request.

You can edit profile details in the app, remove friends, use available message or snap deletion controls, and change device permissions. Depending on the law where you live, you may also have rights to access or obtain a copy of your information, correct it, request erasure, restrict or object to processing, withdraw consent, or complain to your data-protection authority. Contact us to exercise an applicable right.

08 / Storage, security & international processing

Accounts and metadata are held in a server database, and photos, thumbnails, and recordings are held in object storage. The app uses HTTPS for its production API, password hashing, authenticated access, and time-limited media links. Photos and voice notes are not end-to-end encrypted; the server processes them to provide the service. No online service or transmission can be guaranteed completely secure.

Nuvkin is operated from Sri Lanka. Hosting, notification, email, and platform providers may process information in other countries. Their locations and applicable protections may differ from those where you live. Contact us for information about the processing locations and safeguards relevant to your account. We do not claim that all data stays in Sri Lanka.

09 / This website & external services

This website is informational. It does not provide web signup, upload your media, or register you for testing automatically. Testing-access and support links open your email application. The website stores only your chosen light/dark preference in browser local storage; it does not add advertising cookies, analytics scripts, or third-party embedded content.

Local storage is separate from server access logs. Your hosting connection can still produce technical logs. Fonts and preview images are served with this website. Preview accounts and sample moments are fictional.

If you follow a link to an app store, email provider, or another service, that service processes information under its own terms and privacy policy. Relevant provider notices include Expo, Apple, Google, and Brevo.

10 / Adults only

Nuvkin is intended for people aged 18 and over. It is not intended for children or teenagers under 18. We do not knowingly offer the service to or collect account information from people under 18. If you believe a person under 18 has provided personal information or created an account, contact ismath@nuvkin.com so the operator can investigate and take appropriate action, including removal where appropriate.

11 / Changes & contact

We may update this policy as the service or applicable requirements change. The date at the top identifies the latest version. Where required, we will provide additional notice of material changes.

Operator: Ismath, Sri Lanka.
Privacy and support: ismath@nuvkin.com.
Service: Nuvkin — Your Inner Circle, nuvkin.com.