Privacy Policy

Last updated 29 September 2026. Data controller: Mepia Ltd, United Kingdom.

What we collect and why

• Account data (email, username, display name, password hash) — to run your account. You give it to us when you sign up.
• Photos, captions, tags and comments you post — shown publicly in the app and on the web. You choose what to post.
• Precise location — with your permission, your device's GPS location is used to show nails and studios near you and to pin where a post was made. Post pins are rounded to a ~500 m grid and home-based artists' pins to a ~1 km grid before storage, so exact addresses are never stored or shown. Distances shown to others are rounded. You can use a city instead of GPS.
• Photo metadata — every photo you upload is re-encoded on our servers, which removes embedded metadata such as camera details and GPS coordinates before it is stored or displayed.
• Your nail diary (NailPin+) — the sets you log, with photos, who did them, what you paid, how long they lasted and your notes. It is private: only you can see it, it is never shown on your profile or in any feed, and diary photos are stored separately and only ever sent to your signed-in account. Refill reminders are scheduled on your device.
• Saved ideas — posts you save for inspiration. Only you can see your list.
• Studio details (name, address, phone, social links) that studio owners choose to publish.
• Purchase status — whether a partner subscription is active. Payment details are handled by Apple or Google; we never see your card.
• Reports and blocks — to moderate the service and keep it safe.
• Technical logs (IP address, request time) kept briefly for security and rate limiting.

Who we share it with

We use the following processors, each bound by contract to protect your data to at least the same standard:

• Vercel — hosts the website and app servers, which run in Dublin, Ireland.
• Supabase — stores our database and your photos, in Ireland (EU).
• Resend — handles emails sent to and from our nailpin.app addresses, processed in the EU.
• Apple and Google — process in-app purchases. We never see your card details.
• RevenueCat — validates purchase receipts so we know which features you have unlocked.

Some of these companies are based in the United States. Where your data leaves the UK or EU, it is protected by the UK–US Data Bridge or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. We do not sell your data and we do not use advertising or tracking SDKs.

How long we keep it

Until you delete your account. Deleting your account in the app permanently removes your profile, posts, comments, likes, saved ideas, nail diary and photos. Reports you made may be kept in anonymised form for moderation records.

Your rights

Under UK GDPR you can access, correct, export or delete your data, and object to processing. Most of this you can do in the app; for anything else email support@nailpin.app. You can also complain to the ICO.

Children

NailPin is only for people aged 18 or over. If you believe someone under 18 has an account, contact us and we will remove it.