Privacy Policy

Last updated: August 22, 2026

1. Your data stays yours

For Nibleaf Cloud, your content and account data are used only to provide hosting, publishing, search, analytics, authentication, and support. We do not sell your data or use it for advertising. A separately operated self-hosted deployment is governed by its operator's privacy practices.

2. What we collect

We collect the information needed to operate Nibleaf Cloud: account details (name, email, and a hashed password or your Google account identifier), workspace and project metadata, the documentation content you author, published-site analytics, product usage events (such as sign-up, editing, and publishing activity) that we use to operate and improve the service, support communications, and session data — including IP addresses and browser user-agent — used for authentication and to protect accounts against abuse.

3. Where your data lives

Nibleaf Cloud is hosted in the European Union. Your account data, documentation content, and uploaded assets are stored on servers located in the EU.

4. Subprocessors

We use a small number of infrastructure providers to run the Service: Hetzner Online GmbH (server hosting in the EU, where application data is stored), Cloudflare (DNS, traffic delivery, security, and aggregate web telemetry), Postmark / ActiveCampaign (transactional email such as sign-in verification and invitations), OpenAI (processes document text only when a user explicitly invokes the AI writing assistant), and, when enabled, Google Analytics (optional public-site measurement only after a visitor accepts the analytics prompt).

5. Built-in analytics

Nibleaf includes first-party analytics for your published sites, such as page views, unique visitors, top pages, and searches. These analytics power the product experience and do not require a third-party analytics provider. Site owners can additionally configure their own analytics for their published sites.

6. Cookies

Authentication uses first-party session cookies and related security cookies to keep you signed in and protect your account. Google Analytics remains disabled until you accept optional analytics; declining does not load its script. If accepted, it may set analytics cookies for public page views and allowlisted conversion events. We do not use advertising cookies, send account or document content to Google Analytics, or include email addresses and form text in analytics events. You can reopen Privacy choices on a public page and withdraw consent.

7. Account deletion and data requests

You can delete projects and workspaces from the dashboard at any time, which removes their content and published sites. To delete your account entirely, or for access, correction, or export requests, email [email protected] and we will action the request. Backups expire on a rolling basis after deletion.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "last updated" date above.

9. Contact

For any privacy question or request, contact [email protected].