Privacy Policy

Last updated: August 11, 2026

This Privacy Policy explains what information Nolti collects, how we use and share it, and the choices and rights you have. It covers both this website (nolti.ai) and the Nolti mobile app (together, the “Service”).

1. Who we are

Nolti (“Nolti”, “we”, “us”, or “our”) is an app that turns the YouTube videos you follow into a searchable index of topics, people, tips, and moments. Nolti is operated by an individual sole proprietor. For any privacy question or to exercise your rights, contact us at hello@nolti.ai. For the purposes of the EU/UK General Data Protection Regulation (GDPR), we are the “data controller” of your personal data. We will provide our full legal identity to a supervisory authority or where otherwise required by law.

2. Scope

This policy applies to:

• The website at nolti.ai, including the early-access waitlist.
• The Nolti app (currently iOS), including sign-in, video analysis, search, and subscriptions.

The Service is not directed to children. You must be at least 16 years old to use it (see Children’s privacy).

3. Information we collect

a. Waitlist (website)

When you join the waitlist, we collect your email address and limited technical context about the submission — the source (e.g. which button or page), the referring URL, and your browser’s user-agent string. We use this to send you a confirmation, to invite you when early access opens, and to prevent spam and abuse.

b. Account & profile (app)

You sign in to the app with Google Sign-In or Sign in with Apple. From your Google profile we receive your name, email address, and profile picture (avatar). From Apple we receive your name and email address(which may be Apple’s private relay address if you choose to hide your email). We do not receive or store your Google or Apple password.

c. YouTube account data (app)

With your authorization, Nolti accesses your YouTube data through the YouTube Data API in order to provide its core features. This includes:

• Your list of subscribed channels and channel details.
• Video metadata — titles, descriptions, thumbnails, durations, and publish dates — for the videos we analyze.
• Transcripts / captions of those videos, where available, so we can index what was said.

Nolti requests a YouTube permission scope that allows it to read and manage your subscriptions. We only add or remove subscriptions when you explicitly ask us to (for example, subscribing to a suggested channel from within the app). We never change your subscriptions on our own.

To keep analyzing new uploads in the background, we store an encrypted Google refresh token. It is held in encrypted storage (Supabase Vault), is never exposed to the app on your device, and is used only to renew access to the YouTube data described above.

d. Content you create in the app

We store the content and preferences you generate while using Nolti, including:

• Video or channel links you add manually or share to Nolti.
• Snippets you save and “moments” you create.
• Insights (“bits”) you hide, and channels you disable.
• Your settings and preferences (e.g. auto-add, theme, captions, notifications).

e. Subscription & purchase status

If you subscribe to Nolti Pro, your purchase is processed by Applethrough in-app purchase and managed via RevenueCat. We receive your subscription status and entitlement (for example, whether Pro is active and when it renews or expires). We never receive or store your full payment card details — those are handled by Apple.

f. Technical, crash & usage data

We keep limited operational data needed to run the Service — for example, server logs, error information, and internal usage counters (such as how many analyses you have run, to enforce plan limits). In addition, the app uses two service providers to keep Nolti reliable and understand how it is used:

• Crash & error reporting (Sentry): if the app crashes or hits an error, we receive a crash report with technical details (stack trace, device model, OS version, app version) linked to your user ID so we can investigate issues you experience. Crash reports do not include your name, email, or the content of your library.
• Product analytics (PostHog): we record app usage events — for example which screens are opened and when core actions happen (adding a video, searching, viewing the paywall, completing a purchase) — linked to your user ID. We use this to measure aggregate usage (such as daily active users) and improve the app. These events do not include your name, email, or the content of your videos, transcripts, or searches.

What we do not collect

Nolti does not use advertising or ad-tracking SDKs, does not build advertising profiles, and does nottrack you across other companies’ apps or websites. The app does not request access to your camera, microphone, location, photos, contacts, or health data. We do not sell your personal data.

4. How we use your information & legal bases

We use your information to:

• Provide and operate the Service — analyze videos, build your index, run search, and sync your subscriptions at your request.
• Send you the waitlist confirmation and early-access invitation.
• Process and manage your Nolti Pro subscription and enforce plan limits.
• Keep the Service secure, prevent abuse, debug, and improve reliability — including diagnosing crashes and errors.
• Measure aggregate usage (for example, daily active users and which features are used) to improve the app.
• Communicate with you about important changes or support requests.

If you are in the EEA or UK, our legal bases under the GDPR are: consent (for the waitlist email you asked to receive; you can withdraw at any time), performance of a contract (to provide the app features you sign up for), and legitimate interests (to secure the Service, prevent abuse, and improve Nolti — balanced against your rights).

5. Google user data (Google API Services & YouTube)

Because Nolti connects to your Google Account, we want to be fully transparent about how we access, use, store, share, and delete the data we obtain from Google APIs — including the YouTube Data API (“Google user data”):

• What we access: your Google profile (name, email, avatar) and your YouTube data — your subscribed channels, video metadata, and video transcripts/captions (see Section 3).
• How we use it:only to provide and improve Nolti’s user-facing features — building your searchable index, running search, suggesting channels, and adding or removing subscriptions when you ask us to (see Section 4).
• How we store and protect it: in our secured backend; your Google refresh token is held in encrypted storage and never leaves our servers (see Section 11).
• Who we share it with: only the service providers needed to deliver these features, including our AI processing providers (see Section 6 and Section 7). We do not sell it.
• How long we keep it and how to delete it:for as long as your account is active; you can revoke Nolti’s access or delete all of it at any time (see Section 9 and Section 10).

Limited Use

Nolti’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we:

• use Google user data only to provide or improve user-facing features that are prominent in the Nolti app;
• transfer Google user data only as necessary to provide or improve those features, to comply with applicable law, or as part of a merger/acquisition (with notice) — never for other purposes;
• do not use or transfer Google user data for serving advertisements, including personalized, targeted, or interest-based advertising;
• do not sell Google user data, and do not transfer it to data brokers, information resellers, or for determining creditworthiness or lending;
• do not use or transfer Google user data to develop, train, or improve generalized or non-personalized AI/ML models;
• do not use Google user data to build, augment, or maintain a separate database or profile; and
• do not allow humans to read your Google user data, except: with your affirmative consent for specific data, where necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.

The Nolti app uses YouTube API Services. By using Nolti you also agree to the YouTube Terms of Service, and your use of Google is subject to the Google Privacy Policy. You can review and revoke Nolti’s access to your Google Account at any time via the Google security settings page.

6. AI processing of your content

Nolti’s core feature — extracting topics, people, tips, and timestamped moments — relies on third-party AI models. To generate this index, we send relevant content to our AI processing provider, OpenRouter, which routes requests to large language models operated by DeepSeek and Google (Gemini). Depending on the feature, the content sent may include:

• The transcript and metadata (title, description) of a video being analyzed.
• For videos without captions, the YouTube video URL itself, so the model can analyze the video directly.
• Your search query and items from your indexed “bit” library, when you use in-app search or ask a question.
• Signals derived from your library (e.g. topic labels) to suggest relevant channels.

We share this content with these providers solely to provide Nolti’s features to you. Consistent with the Limited Use commitments above, we do not use or transfer your Google user data (including YouTube transcripts and video content) — or your other content — to train, develop, or improve generalized or non-personalized AI/ML models, and we do not sell it. These providers process the content under their own terms and privacy policies to return results to you.

AI can be wrong. Summaries, tips, and other AI-generated output may be inaccurate or incomplete. Please verify anything important before relying on it.

7. Who we share your information with

We do not sell your personal data. We share it only with service providers (“sub-processors”) that help us run the Service, and only as needed:

• Supabase — database, authentication, secure token storage, and backend hosting.
• Google / YouTube — sign-in and the YouTube Data API.
• OpenRouter, and through it DeepSeek and Google (Gemini) — AI analysis of content.
• Inngest — orchestration of background analysis jobs.
• RevenueCat and Apple — in-app subscription processing and management.
• Apple — Sign in with Apple.
• Sentry — crash and error reporting for the app.
• PostHog — product usage analytics for the app.
• Expo — delivery of push notifications you enable.
• Resend — sending the waitlist confirmation email.
• Vercel — hosting for the nolti.ai website.

We may also disclose information if required by law, to protect our rights or users’ safety, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you).

8. International data transfers

Our providers may process and store data in countries outside your own, including the United States. Where personal data is transferred out of the EEA or UK, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) offered by these providers.

9. Data retention

• Waitlist data is kept until you ask us to remove it or unsubscribe, or until it is no longer needed for early access.
• App data is kept for as long as your account is active. If you delete your account (see below), we delete the personal data associated with it, except where we must retain limited records to comply with legal obligations or resolve disputes.

10. Your rights and choices

Subject to your local law, you have the right to access your personal data, and to correct, delete, restrict, or object to its processing, as well as the right to data portability and to withdraw consent at any time. To exercise any of these, email us at hello@nolti.ai.

How to delete your data

You can remove your data in the following ways:

• Revoke access: disconnect Nolti from your Google account via Google security settings to stop all future YouTube data access.
• Delete your account & data in the app: go to Settings → Delete account. This permanently deletes your account and associated personal data — your videos, index, saved snippets, preferences, push tokens, and stored Google credentials.
• Or by email: write to hello@nolti.ai from your account email and we will delete your account and data for you.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

11. Security

We protect your data with industry-standard measures, including encryption in transit (HTTPS/TLS), encrypted storage of sensitive credentials (your Google refresh token is held in Supabase Vault), and database row-level security so each user can only access their own data. No method of transmission or storage is completely secure, but we work to protect your information and continuously improve our safeguards.

12. Children’s privacy

Nolti is intended for users who are at least 16 years old and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, please contact us at hello@nolti.ai and we will delete it.

13. Cookies & local storage

The nolti.ai website does not use advertising or tracking cookies. The app stores your login session locally on your device so you stay signed in. We use only the storage strictly necessary to operate the Service.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of the Service after an update means you accept the revised policy.

15. Contact us

Questions, requests, or complaints about privacy? Email hello@nolti.ai.