Privacy policy

Who we are

DW Labs, in London, England, is responsible for the personal data described here. Email hi@nerdsnipes.com with a privacy question or request.

What we collect

• When you visit: your IP address, details about your browser and device, the pages you asked for, timestamps, and security or error logs. On the live site, PostHog also records page views, where you arrived from, which controls you used, and pseudonymous browser, session and account IDs. We also measure reading progress and active time, character choices, sign-in, newsletter preferences, chat outcomes and subscription payments. We mask control text and attributes and remove non-campaign URL queries. We do not send email addresses, chat messages, passwords or verification codes to PostHog.
• When you sign in: your email address, an account ID, and authentication and session information. If you choose Google sign-in, Google and Supabase handle it between them, and we get back the account details we need to know who you are.
• When you read: what you picked, who you cast, how far you got, estimated foreground time in an exploration, your favourites and your saved state. Some of that never leaves your device. Signed-in reading data can also sync to your account.
• When you use conversations: your questions, the ones you save, the history of the conversation, the AI replies, their citations and the reading context around them. We also keep a small amount of request, usage, cost and error data to run the feature and protect it.
• When you pay: your membership status, your Stripe customer and subscription IDs, and the checkout records that go with them. Stripe collects your payment details. Your full card number never reaches us.
• When you write to us or get email updates: whatever is in your message, your email setting, and a record of the service emails we send.

Why we use it

• To run the service: to know it is you, to remember your reading between sessions and devices, to answer your questions and to handle your membership. Lawful basis: performing our contract with you.
• To protect and improve it: to stop abuse, chase down faults, measure how the site is used, and make the content and navigation better. Lawful basis: our legitimate interest in a secure, useful service, weighed against your privacy.
• To meet legal duties: to keep the records that tax, accounting or lawful requests require. Lawful basis: legal obligation.
• To email you about new explorations: you can subscribe with an email address without making an account; we send updates only after you confirm that address. The lawful basis for guest updates is your consent. New accounts get a weekly email under our legitimate interest in telling readers about new explorations. You can choose daily or weekly, turn it off in account settings if you have an account, or unsubscribe from any update without signing in. Necessary account and billing messages still go out.

An account needs an email address. A paid membership needs payment details, which Stripe collects at checkout. Free explorations need neither. We do not use your data for third-party advertising, and we do not make decisions about you by automated means alone where they would have a legal or similarly significant effect.

AI conversations

Asking a question sends your message, the relevant conversation history and the article or character context through OpenRouter to the selected model provider. The model may also make a limited web search. That provider may process what you write, so keep confidential or sensitive personal information out of it. We store the conversation in your account so you can pick it up later.

Who receives information

These are the services behind NERDSNIPES:

• Supabase for accounts, sign-in and stored reader data.
• Google if you choose Google sign-in.
• Stripe for checkout, payments and subscriptions.
• OpenRouter and the selected model provider for AI conversations.
• Vercel for site hosting and operational logs.
• PostHog for product analytics on the live site.
• Resend for service email from the product; sign-in email goes through Supabase.
• Cloudflare for article images and other media.

Some articles embed YouTube videos. Loading one means your browser contacts YouTube whether or not you press play, and YouTube may get your IP address and browser information and use storage of its own. We embed through its privacy-enhanced domain. Any link out of here lands you on a site with its own privacy practices.

We may also hand information over where the law requires it, to protect people or the service, or if the business is reorganised. We do not sell your personal data.

International processing

Some of those providers process information outside the UK. Where UK data protection law requires a transfer to be protected, we rely on an applicable adequacy arrangement or appropriate contractual safeguards. Ask us if you want the detail on a particular transfer.

Cookies and information on your device

Session cookies keep you signed in, and a device cookie keeps downloaded readings with the right account. Local storage remembers your room and reading preferences, your marks, favourites, progress and some conversation state. Save articles for offline reading and your browser also keeps the article files, your progress and any unsent questions in device storage and a cache. Those copies can survive a sign-out or an account deletion. Clear them with the site’s own controls or through your browser’s site-data settings.

On the live site, PostHog uses a cookie and local storage to recognise a pseudonymous browser across visits and to count page views and interactions. When you sign in, we link those events to a pseudonymous account ID so we can measure return visits across devices and understand which features people use. We count browser failures and chat failures without sending error messages or chat text. Session replay, heatmaps, surveys and automatic exception capture are switched off, and there are no advertising cookies.

How long we keep information

Account, reading and conversation data stays while your account is active. Ask us to delete the account and your access ends at once; the data is queued for permanent deletion 30 days later, and you can write to us about recovering it during that window. Copies on your device are separate and stay until you remove them from that device. We keep a minimal email preference record after an unsubscribe or account deletion so that an old guest subscription cannot start sending again. Backups, and a limited set of security, billing, tax and legal records, can last longer where their purpose or the law requires it.

Deleting a NERDSNIPES account does not cancel a Stripe subscription, so cancel that in the billing portal too. Stripe may keep payment and transaction records under its own retention rules.

Analytics events and operational logs are kept only as long as we need them to measure use, troubleshoot or protect the service. How long that is depends on the record and on our settings with each provider.

Your choices and rights

You can unsubscribe from email updates using the link in any update, without an account. Account deletion is in account settings, and saved material can be cleared from your device. For anything else, email hi@nerdsnipes.com to see your personal data, correct it, erase it, restrict what we do with it, receive a copy of it, or withdraw consent where we rely on it. Which of those apply depends on the circumstances, and we may need to check you are who you say you are.

Right to object: you can object to anything we do on the basis of legitimate interests, product analytics included. Tell us what you object to and why, and we will stop, unless we have compelling lawful grounds to carry on or we need the information for a legal claim.

You can complain to the UK Information Commissioner’s Office at ico.org.uk.

Children

NERDSNIPES is for people aged 13 and over. If you think a child under 13 has given us personal information, tell us and we will look into it and delete what we should.

Changes

When our practices change, this page and its date change with them. For a material change, we may also tell account holders in the service or by email.