Privacy Policy

Last updated: August 23, 2026

1. Your data stays yours

For Nibleaf Cloud, your content and account data are used only to provide hosting, publishing, search, analytics, authentication, and support. We do not sell your data or use it for advertising. A separately operated self-hosted deployment is governed by its operator's privacy practices.

2. What we collect

We collect the information needed to operate Nibleaf Cloud: account details (name, email, and a hashed password or your Google account identifier), workspace and project metadata, the documentation content you author, published-site analytics, product usage events (such as sign-up, editing, and publishing activity) that we use to operate and improve the service, support communications, and session data — including IP addresses and browser user-agent — used for authentication and to protect accounts against abuse.

3. Where your data lives

Nibleaf Cloud is hosted in the European Union. Your account data, documentation content, and uploaded assets are stored on servers located in the EU.

4. Subprocessors

We use a small number of infrastructure providers to run the Service: Hetzner Online GmbH (server hosting in the EU, where application data is stored), Cloudflare (DNS, traffic delivery, security, and aggregate web telemetry), Postmark / ActiveCampaign (transactional email such as sign-in verification and invitations), OpenRouter (routes document text to the configured AI model only for explicit AI features), and Google for optional public-site measurement after a visitor accepts the analytics prompt. When a deployment configures Google Tag Manager, it delivers allowlisted events to Google Analytics; the legacy direct Google Analytics fallback does not use Tag Manager.

5. Built-in analytics

Nibleaf includes first-party analytics for your published sites, such as page views, unique visitors, top pages, and searches. These analytics power the product experience and do not require a third-party analytics provider. Site owners can additionally configure their own analytics for their published sites.

6. Cookies

Authentication uses first-party session cookies and related security cookies to keep you signed in and protect your account. With the Tag Manager configuration, neither Google Tag Manager nor the downstream Google Analytics tag loads before you accept optional analytics. With the legacy direct Google Analytics fallback, Google Analytics loads only after acceptance and Tag Manager is not used. Google Analytics may then set analytics cookies for public page views and allowlisted conversion events. We do not use advertising cookies, send account or document content to Google, or include email addresses and form text in analytics events. You can reopen Privacy choices on a public page and withdraw consent; withdrawal denies analytics storage, stops new event delivery, and removes accessible Google Analytics cookies for the current site.

7. Account deletion and data requests

You can delete projects and workspaces from the dashboard at any time, which removes their content and published sites. To delete your account entirely, or for access, correction, or export requests, email privacy@nibleaf.com and we will action the request. Backups expire on a rolling basis after deletion.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "last updated" date above.

9. Contact

For any privacy question or request, contact privacy@nibleaf.com.