Privacy Policy

Last updated 2 November 2026

1. Who we are

ntgld is a Small Academy product, published by Education for the Little Ones SRL (Reg. Com. J40/8099/2015, CIF RO34730646), B-dul Expoziției nr. 1C, Clădirea B2, Etaj 3, Sector 1, București 012101, Romania. We are the controller of the data described here. Write to us at hello@small.academy.

2. Your account

The first time you open ntgld, your iPhone makes an account for you, without asking anything: a random account id and a nickname made of two words and a number (like pink-panther-56), which you can change in Me › Account. Your iPhone registers the account with our server, so the nickname is yours alone. Our server keeps:

• the account id, the nickname, and when the account was made and last used;
• for each iPhone on the account: a fingerprint (a hash) of a secret the iPhone made and keeps in its Keychain, the name the iPhone gives itself (“iPhone”), and when it was added and last used. We never have the secret itself;

An account like this is anonymous: it isn’t linked to your name, your email address or your Apple Account, and nothing you save in ntgld is sent to us because of it. It lets us keep your nickname unique and, if you later sign in, gives your things an owner on the server.

3. Signing in: email or Apple

In Me › Backup & sync you can link your account to an email address, to your Apple Account, or to both. A link is what lets you open the same account on another iPhone, or again after reinstalling ntgld.

• Email. You type your address and we email you a 6-digit code, good for 10 minutes. We keep your address, in lower case, linked to your account. Of the code, we keep only a keyed fingerprint (HMAC), until it’s used or expires. The email is sent from our hosting’s mail server; if you reply, the reply reaches hello@small.academy.
• Sign in with Apple. Apple gives us an id for your Apple Account that is unique to ntgld, and a token we keep encrypted so that we can undo the link with Apple when you delete your account. We don’t ask Apple for your name or your email address. If you stop using Sign in with Apple for ntgld in your iPhone’s Settings, or delete your Apple Account, Apple tells our server and we remove the link; your ntgld account stays. Apple handles the sign-in under Apple’s privacy policy.

To stop guessing and abuse, our server counts sign-in attempts and new accounts: by the IP address the request comes from and by a fingerprint of the email address, never the address itself. These counts are kept for about a day.

4. Backup & sync

Backup & sync is free, and it is on only for accounts linked to an email address or an Apple Account. An anonymous account has no backup: nothing you save leaves your iPhone for our server.

When it’s on, ntgld keeps on our server a copy of everything on your account, so that your other iPhones have the same things and a new iPhone gets them back:

• your things: links, notes and text, with their titles, sources and pictures;
• the files of your pictures and documents (PDF, Word, Pages and the like), up to 50 MB each;
• what your iPhone worked out about them (tags, descriptions, the text recognised in pictures and documents, the colours of a picture and the data used to search by meaning), so another iPhone doesn’t have to work it out again;
• your tags and sets, and which things are in which set.

Everything travels over an encrypted connection (HTTPS) to our server at api.ntgl.me, hosted by DigitalOcean in Frankfurt, Germany (EU). Pictures and documents are kept there as files that only your account can download; no one gets them through a public link. We don’t look at what you save, use it for anything else or share it with anyone. When you delete a thing, the deletion is synced too, and the thing and its files leave our server.

5. Sign out, Delete all data, Delete account

• Sign out (there when Backup & sync is on) takes this iPhone out of your account. It syncs one last time, our server forgets this iPhone’s secret, and the iPhone empties itself and starts a new anonymous account. Your things stay on our server and on your other iPhones.
• Delete all data (in Me) deletes all your things, tags and sets. With Backup & sync on, it deletes them everywhere: on this iPhone, on our server, with their files, and on your other iPhones. Your account and its sign-in links stay. With sync off, it empties only this iPhone.
• Delete account (in Me) deletes your account from our server: your things and their files, your tags and sets, your email address, the link to your Apple Account (which we undo with Apple first), your iPhones’ secrets and any sign-in code still waiting. It also asks PostHog to delete what it has under your account (section 11). Your other iPhones empty themselves the next time they reach our server; for that, we keep only the deleted account’s id and the time it was deleted. This iPhone then starts a new anonymous account. Delete account needs a connection, so that nothing stays behind on the server.

Deleting your account doesn’t cancel ntgld Premium, which belongs to your Apple Account: cancel it in your iPhone’s Settings › your name › Subscriptions (section 10).

6. Worked out on your iPhone

ntgld uses Apple’s on-device frameworks (Vision, Natural Language and, where available, the on-device Apple Intelligence model) to suggest tags, recognise text in pictures and documents, write descriptions, find the colours of a picture and search by meaning. This runs on your iPhone. Nothing is sent to us or to anyone else to work it out. With Backup & sync on, the results are synced with your things (section 4).

What you save also lives in ntgld’s storage on your iPhone, which iOS includes in your iPhone backups (to iCloud or to a computer) according to your settings.

7. Reading the sources of links

When you save a link and Read sources from the web is on (in Me › Processing), ntgld opens that page directly from your iPhone, the way a browser would, to read its title, description and picture. That website sees your IP address and the request, under its own privacy policy. Nothing goes through us. With the setting off, ntgld keeps only the address of the link.

8. Camera, photos and files

ntgld uses the camera only when you choose Take a photo, and reads only the photos and files you pick or share with it. It reads the clipboard only when you tap to paste. What you pick is saved in ntgld on your iPhone and, with Backup & sync on, on our server (section 4).

9. Siri, Shortcuts and Spotlight

Your things (their titles, sources, tags, links and the text recognised in them) and the names of your sets are indexed by iOS on your iPhone, so that Siri, Shortcuts and Spotlight can find them. When you talk to Siri, Apple handles the request under Apple’s privacy policy.

10. Purchases

ntgld Premium is bought through your Apple Account, with Apple’s StoreKit. Apple processes the payment; we never see your payment details. The app asks Apple whether the subscription is active. Apple also tells our server about the subscription (App Store Server Notifications): the product, the transaction number, when it renews or ends, refunds. The app puts your account id on the purchase, so we can link the subscription to your account. If you delete your account, these records stay, no longer linked to it, as a record of the sale. We also receive sales reports from Apple that don’t identify you.

11. Usage stats

To understand how ntgld is used and make it better, the app sends usage stats to PostHog, on its EU cloud. They are on unless you turn off Me › Share usage stats, which stops the app sending them straight away.

What is sent:

• what you do, without its content: that you saved something, its kind (link, picture, note, document), where from (the share sheet, the app, the clipboard); that you made a set, searched, synced, opened Premium; the screens you open, when you open the app and for how long, and errors in processing and sync;
• for links, only the website’s domain, and only if it is one of a fixed list of large, well-known sites; any other site is sent as “other”;
• numbers, such as how many things you have;
• the kind of iPhone, its screen size, the iOS and app versions, the language, the time zone, and whether it’s on Wi-Fi or mobile data;
• for you as a person in the stats: your plan (Free or Premium) and how many things and sets you have;
• your account id, so that what you do on your iPhones and what our server records can be counted as one person. It’s the same random id as in section 2, not your name or your email address;
• session replays: recordings of how the screens move as you use them, with all text and all pictures covered, and your things, sets and searches covered whole, so no content can be seen in them. While a document is open in full, nothing is recorded.

Each event is checked in the app before it leaves: it can only carry the kinds, numbers and site names listed above.

What is never sent: what you save or what ntgld works out about it. No titles, links, text, recognised text, descriptions, names of tags or sets, search text, your nickname or your email address.

The share sheet doesn’t talk to PostHog: it writes what happened in ntgld’s storage on your iPhone, and the app sends it later, under the same switch.

Our server also sends PostHog a few events about your account, under the same account id, with no content in them either: an account was made, linked to an email address or an Apple Account, or opened on another iPhone, and changes to your subscription that Apple tells us about. When an account is deleted, our server counts it without the account id. Your iPhone tells our server whether Share usage stats is on, with every request; when it’s off, our server sends PostHog nothing about your account.

PostHog receives the IP address each request from the app comes from, as any server does, and uses it to estimate the country and city. Our server never passes your IP address on to PostHog, and its own events aren’t placed on a map at all.

We use PostHog only as our processor, to count and understand; not for ads, and we don’t sell or share these stats. When you delete your account, we ask PostHog to delete what it holds under your account id.

12. When you write to us

Me › Feedback opens an email to hello@small.academy. Below your message, it adds your account id, your nickname, the app version, the iOS version, the kind of iPhone, your plan, appearance and language, so that we can help. You see all of it before you send, and you can delete any of it. We use your email only to answer you.

13. This website

ntgl.me is hosted by DigitalOcean in Frankfurt, Germany (EU). Like any website, the hosting keeps technical logs (IP address, time, the page requested) for security and troubleshooting, for at most 90 days. The site counts visits with PostHog web analytics, without cookies and without storing anything on your device, so every visit counts as new: the pages seen, the site you came from, the kind of browser and device, and the country. Nothing you click or type is recorded, and a browser that asks not to be tracked (Do Not Track) isn’t counted.

14. Why we may use your data

• Your account, sign-in, Backup & sync, and the three deletions: to provide the service you use (Art. 6(1)(b) GDPR).
• Limits against abuse, the server’s and the website’s logs: our legitimate interest in keeping ntgld and its users safe (Art. 6(1)(f)).
• Usage stats and the website’s visit counts: our legitimate interest in understanding how ntgld is used and improving it (Art. 6(1)(f)). You can object at any time with Share usage stats, or by writing to us.
• Purchase records: to provide Premium and keep records of sales (Art. 6(1)(b) and (c)).

15. Who else handles it

• DigitalOcean, our hosting, runs our server and our website in its Frankfurt data centre (EU).
• PostHog, on its EU cloud, for usage stats (section 11).
• Apple, for Sign in with Apple, purchases, Siri and iPhone backups, under its own privacy policy.

We don’t sell your data, show ads or share it with anyone else, unless the law requires us to.

16. How long we keep it

Your account, its links and, with Backup & sync, your things stay on our server until you delete them or delete your account (section 5). Sign-in codes go after 10 minutes, the counts against abuse after a day, the website’s logs after at most 90 days.

17. Your rights

Under the GDPR you can ask for access to your data, its correction or deletion, restriction of processing and portability, and you can object to processing. Much of it you can do yourself in the app: see and change your things, change your nickname, turn off usage stats, sign out, delete all data or delete your account. For anything else, including a copy of what our server holds about you, write to hello@small.academy from the address linked to your account, or include your account id (Me › Feedback adds it). We answer within a month.

You can also complain to the Romanian data protection authority, ANSPDCP (B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, București, dataprotection.ro), or to the authority where you live.

18. Changes

If we change this policy, we update the date at the top. Important changes are announced on this site before they apply.