Privacy Policy

1. Who operates NBFS

NBFS is an independent app discovery project made by Madman Studio. In this policy, “NBFS,” “we,” and “us” refer to the operator of nbfs.app.

2. Information we handle

Information from LinkedIn sign-in

When you choose LinkedIn sign-in, we request the OpenID Connect scopes openid, profile, and email. LinkedIn may provide a stable account identifier, name, profile image, and email address. Email may be absent. We do not treat LinkedIn sign-in as verification of identity, employment, expertise, or Shopify usage.

Information you provide

• Discussions, evaluations, reactions, reports, maker notes, developer responses, and other contributions.
• App claim activity and the verification status of a public support email.
• An email address and confirmation status when you subscribe to discovery emails.
• Messages and information you send when requesting support, correction, exclusion, or privacy assistance.

Public app listing information

We collect facts published on official Shopify App Store pages, including app and developer names, descriptions, categories, pricing, media, review counts, launch information, and public support details. This is listing research, not private Shopify merchant or store data.

Technical and usage information

We process session cookies, user agent information, and network information needed to authenticate users, secure the service, prevent abuse, and diagnose errors. Rate limiting uses a one-way hashed network identifier rather than storing the raw address in our event table.

For first-party app views, Daily Brief activity, and Shopify App Store clickouts, NBFS may set an nbfs_anon cookie containing a random identifier. It expires after 24 hours and is used to deduplicate basic service events.

Firebase Analytics records page views to help us understand service usage. We send the page pathname, page title, and origin without URL query strings. We disable Google Signals and ad-personalization signals. Google may process standard browser, device, network, and approximate location information as part of providing analytics.

3. How we use information

• Provide sign-in, sessions, profiles, community contributions, app claims, and subscriptions.
• Publish accountable evaluations and discussions with their disclosed context.
• Operate discovery, search, corrections, moderation, security, abuse prevention, and troubleshooting.
• Send transactional claim and subscription messages and, after confirmation, discovery emails.
• Measure aggregate use and improve navigation, content, reliability, and product decisions.
• Comply with law, enforce our terms, and protect users, NBFS, and third parties.

Depending on the law that applies, these activities rely on providing a service you requested, your consent, our legitimate interests in operating a safe and useful service, or compliance with legal obligations. You may withdraw newsletter consent at any time using the unsubscribe link.

4. AI-assisted editorial content

NBFS may use OpenRouter and a selected language-model provider to draft Daily Brief editorial copy. The input is limited by design to allowlisted public app-listing facts. We do not intentionally send LinkedIn account data, emails, user contributions, claim data, cookies, tokens, or internal review notes to the model provider.

5. When information is shared

We do not sell personal information. We share information only as needed to operate the service, follow your instructions, protect rights and safety, or comply with law.

• LinkedIn provides OpenID Connect sign-in.
• Railway provides application hosting and managed infrastructure.
• Google Firebase and Google Analytics provide page-view analytics.
• Resend delivers claim verification, subscription confirmation, and discovery emails.
• OpenRouter and selected model providers process the public-source editorial inputs described above.

Public contributions and profile attribution are visible to visitors. Information may also be transferred as part of a reorganization, acquisition, or sale, subject to appropriate notice and safeguards.

6. Retention

• Account and contribution data is kept while your account is active or as needed to provide and protect the service.
• Authentication sessions remain until they expire, you sign out, or the account is deleted.
• Claim links expire after 30 minutes and are stored as one-way hashes.
• Raw first-party event records are scheduled for deletion after 90 days.
• Newsletter consent is managed separately from an NBFS account. If you unsubscribe, we retain a limited suppression record, including your email address and unsubscribe status, so we can honor your choice and avoid sending further discovery emails. You may contact us to request deletion of that record, subject to any limited retention needed for legal, security, or dispute purposes.
• Public listing snapshots may be retained to document listing history, corrections, eligibility decisions, and data provenance.

We may retain limited records longer when required for security, dispute resolution, legal compliance, or backup rotation.

7. Your choices and rights

You can sign out at any time. The Profile page provides an option to disconnect LinkedIn and delete your NBFS account and account-linked contributions. A developer response attached to another user's evaluation may remain after account deletion with its author attribution removed. Because newsletter subscriptions are separate, use the unsubscribe link in an email to stop discovery emails or contact us to request deletion of that record.

Subject to applicable law, you may ask to access, correct, delete, restrict, or receive a copy of your personal information, or object to certain processing. You may also request a correction, exclusion, or review of public listing information. Send requests to ops@nbfs.app. We may need to verify the request before acting on it.

8. Security and international processing

We use HTTPS, server-side authorization, restricted secret storage, encrypted OAuth tokens, secure cookie settings, input validation, and data minimization. No online service can guarantee absolute security.

Our providers may process information in countries other than yours. Where required, we and our providers use appropriate contractual or legal safeguards for international transfers.

9. Children and external services

NBFS is intended for people evaluating or building commerce software and is not directed to children under 16. We do not knowingly collect personal information from children under 16.

NBFS links to Shopify, app developers, and other third-party services. Their privacy practices are governed by their own policies.

10. Policy changes

We may update this policy as the service, providers, or legal requirements change. We will revise the date above and provide additional notice when a change materially affects how personal information is used.