Privacy notice

Nyni.com collects as little personal information as it can. This notice explains what we collect, why, how long we keep it, who helps us process it, and the rights you have over it. It covers nyni.com and the sites people make with it, including on their own domains.

Who we are

Nyni.com is run by Nyni, from Finland. Nyni decides how your personal information is used here (in GDPR terms, the controller). For anything about your privacy, write to privacy@nyni.com.

In short

No advertising, no tracking cookies, no third-party analytics, no profiles of visitors.
Videos and music from YouTube, Spotify or SoundCloud on a site load only after a visitor says yes, or presses Load on one.
We never sell or share personal information for advertising.
Delete your account and your site and data go with it.

What we collect

Your account. Your email address, a scrambled (hashed) password (never the password itself), whether you’ve confirmed your email, and your settings. Your account also has a customer reference: a random code such as cus_7RQ2K9XW….

Two-step sign-in. Every account signs in with a second step. For passkeys we keep each passkey’s public key, the name you give it and when it was last used; your fingerprint, face or screen lock never leaves your device. For an authenticator app we keep its secret, encrypted. Your recovery codes are kept only in scrambled form.

Signed-in browsers and security log. For each place you’re signed in, we keep the browser and device type (such as “Chrome on Windows”), when you signed in and when it was last used, so you can see and end them in Security. We also log security events, such as sign-ins, failed attempts and changes to how you sign in. IP addresses are kept only in scrambled form, to spot a new or suspicious sign-in.

Leaked passwords. When you choose a password, we check it against passwords known from data leaks using Have I Been Pwned’s range check: only the first five characters of a scrambled (SHA-1) form of the password are sent, never the password itself, so the service can’t tell what it is.

Your site. Everything you add: your name, words, links, pages, photos, the videos and music you add (only which service, and the video’s or track’s own code), colours and other settings, your address (and, for 7 days after you change it, your old one) and any custom domain. Your site is public: anyone with its address can see it, and search engines may list it unless you turn that off.

Checks on names and links. Some addresses can’t be taken, such as our own pages, well-known companies and scam bait, and our team can add more. If the address you have is added later, we move your site to a new address straight away and tell you by email and in your dashboard, so you can pick another. When you save your site, its links are checked against words for illegal content. A site with such a link can’t be saved, and a site that already has one is passed to our team to look at.

Connections. If you add a connection to your site (such as GitHub, Bluesky, Last.fm, YouTube, Twitch, Steam, Roblox, Telegram or a Spotify playlist), we keep the username or link you give, and our server asks that service for what’s public about it (such as your latest post or video), keeping the answer for up to a day (it’s asked again after 15 minutes). Visitors’ browsers never contact these services for this. Discord is added on Discord itself: Discord tells us your account’s id, username, display name and avatar, which we keep to show your Discord on your site, until you remove it or your account. We never see your password, messages, servers or status there.

Your own domain (Boost). If you put your site on a domain you own, we keep the domain, the code for its DNS record that shows it’s yours, whether it’s live, and when you switched it on. To serve your site there, Cloudflare (who hosts Nyni.com) is given the domain and makes its HTTPS certificate. Visitors to your domain are treated like visitors to Nyni.com.

Photos. When you upload a photo, it’s made smaller and saved again before it’s stored. That also removes hidden details phones add, such as where the photo was taken. The text you write to describe a photo is stored with it.

Reports. If you report a site, we receive the site’s address, the reason, what you write and, if you give it, your email address so we can answer you. Your IP address is kept only in scrambled form, to spot one person sending many reports. The site’s owner isn’t told who reported it.

When we act on a site. If we pause or clear a site, or ask for something on it to change, we tell its owner why by email and in their dashboard’s notices. If we delete an account for breaking our terms, we tell its owner 24 hours before; from then on it’s signed out and can’t be signed in to (you can still ask us for a copy of your data at privacy@nyni.com). We then keep a one-way fingerprint of its email address, never the address itself, so it can’t be used to make a new account. What we did and why is recorded with the email address of the team member who did it, and our notes on a report are signed the same way. That record is for our team only: what you see, and your data download, say “the Nyni team”, never which person.

Boost from us. If we give you Boost, or you redeem a gift code from us, we keep how long it lasts and, for a code, when you used it. A gift code itself is never stored, only a scrambled fingerprint of it.

Messages to us. What you send us by email (such as to support@nyni.com or privacy@nyni.com), and our replies.

Bot check. Signing up, signing in, asking for a password reset and reporting a site use Cloudflare Turnstile to tell people from bots. It looks at signals from your browser and device, such as how the page is used, to make that check. It isn’t used for advertising or to follow you across sites.

Technical information. Like any website, our servers receive your IP address, browser and device type, the page asked for and the page you came from. It’s used to deliver pages, limit how often something can be tried (such as signing in or checking a domain), keep Nyni.com secure and fix problems. It’s not used to identify or follow you.

Staff sign-in. Nyni’s team signs in to its staff tools with work accounts through Cloudflare Access and Microsoft Entra ID. Each sign-in, with the browser and country it came from, and what the team changes, is recorded with their email address.

What our team sees. In our staff tools, email addresses are shown partly hidden (such as m•••@g•••.com). A team member sees one in full only when they need it, by asking for it, and each time is recorded with who looked.

Why we use it

To run your account and your site; to send you codes and links to confirm your email or reset your password, security notices and important news about your account or site; to answer you; to handle reports and keep Nyni.com free of scams and abuse; and to keep it secure.

Under the GDPR and similar laws, we rely on: our agreement with you (running your account and site); our legal obligations (answering lawful requests, and acting on reports of illegal content); our legitimate interests in a secure, working service free of bots and abuse, and in answering people who contact us; and your consent where we ask for it (for example, loading videos and music on a site).

Cookies and browser storage

Nyni.com doesn’t set tracking or advertising cookies. A few things are strictly necessary:

Signing in uses a session cookie, so you stay signed in to your dashboard, plus two small cookies: one remembering which account last signed in on this browser, and one random code that tells a sign-in from this browser apart from a new one.
Your browser may keep small things for you, such as an unsaved draft.
Cloudflare may set security cookies to protect Nyni.com from attacks, and its bot check runs in your browser on the forms above.
Staff sign-in uses a Cloudflare Access session cookie.
Your privacy choices (whether videos and music may load) are kept in your browser’s own storage for 12 months and never sent to us. After that, or when the choices change, you’re asked again.

Visitors to your site get none of these, unless they sign in to Nyni.com themselves, apart from their privacy choices.

Videos and music on sites. A site can show videos and music from YouTube, Spotify or SoundCloud. Nothing is loaded from those services until the visitor allows Embedded media in Privacy choices, or presses Load on one: until then the site shows a placeholder of its own, with no picture from them, and the first visit to a site with any asks first. Once one loads, that service receives the visitor’s IP address, browser details and the page it’s on, and may set cookies or use similar storage in the visitor’s browser, under its own privacy policy: Google (YouTube), Spotify and SoundCloud. YouTube videos use its privacy-enhanced mode (youtube-nocookie.com). Global Privacy Control and Do Not Track count as a no. Anyone can change their answer at any time with Privacy choices at the bottom of every site and of nyni.com.

How long we keep it

Your account, site and photos: until you delete them or your account.
Accounts that were never finished: if the email address is never confirmed, the account is deleted after 48 hours. If two-step sign-in is never set up and nothing was added to the site, after 7 days.
Your own domain: while it’s on your site. When you remove it, Cloudflare stops serving it straight away; when you delete your account, within a day.
Your old address, after you change it: 7 days, so links you’ve shared still lead to your page. Then anyone can have it again.
The address of a deleted account: 30 days, so links its owner shared don’t lead to someone new. Only the address is kept, nothing that leads back to the account.
Email confirmation codes and links: they stop working after 15 minutes; password reset links after 30 minutes. Then they’re deleted.
Signed-in sessions: they end after a week without use, and after 30 days at the most.
Security log and signed-in browsers: 90 days.
Reports, with our team’s notes on them: while open, then two years after they’re closed.
The fingerprint of an email address from an account we deleted for breaking our terms: three years, unless our team lifts it sooner.
Notices in your dashboard: two years, even if you clear them from your dashboard (they stay in your data download).
The team’s record of what it did (including staff sign-ins and actions on sites): two years. When you delete your account, your details are removed from it.
Messages to us: two years, then deleted.
Emails we send you: a copy for 30 days, so we can help if one goes missing. Codes and sign-in links in them aren’t kept.
Privacy choices: in the visitor’s own browser, for 12 months.
Technical and security logs: no longer than 90 days.
Backups: deleted data is cleared from backups within 30 days.

Who processes it for us

Cloudflare hosts Nyni.com and its databases and photos, serves Boost members’ own domains (and makes their certificates), sends our emails, runs the bot check (Turnstile), protects us from attacks and handles staff sign-in.
Have I Been Pwned answers the leaked-password check, receiving only the first five characters of a scrambled form of a password, which can’t identify you or the password.
Microsoft (Entra ID) provides staff accounts.
GitHub, Bluesky, Last.fm, Google (YouTube), Twitch, Valve (Steam), Roblox, Spotify and Discord are asked by our server for the public details a site’s connections show; they receive the username or link, not who’s visiting.
Google (YouTube), Spotify and SoundCloud play the videos and music people put on their sites. They receive a visitor’s information only once the visitor lets them load (see Cookies and browser storage), as independent controllers under their own privacy policies.

They process information only as needed to provide their service, under their own privacy terms. Some of them process information outside your country, including outside the European Economic Area; where they do, it’s protected by safeguards such as the European Commission’s Standard Contractual Clauses.

Your rights

Depending on where you live, you can ask to see, correct, download or delete your personal information, object to or limit how we use it, and withdraw consent you’ve given. Much of this you can do yourself in your dashboard: download your data, and delete your account in Security. If you can’t sign in, write to us from your account’s email and we’ll send you the same file. For anything else, write to privacy@nyni.com. We’ll answer within one month. You can also complain to your data protection authority; in Finland, that’s the Data Protection Ombudsman (tietosuoja.fi).

Children

Nyni.com isn’t for children under 16. We don’t knowingly collect their information. If you think a child under 16 has made an account, tell us and we’ll delete it.

Security

We protect your information with encrypted connections (HTTPS) everywhere, hashed passwords, two-step sign-in with passkeys or an authenticator app for every account, confirmed email addresses, a bot check and limits on how often things can be tried, staff tools that need a verified sign-in and show email addresses partly hidden, a record of who on our team did or looked at what, and keeping only what we need. No system is completely secure, but we work to protect your information and to fix problems quickly.

Changes to this notice

We may update this notice when Nyni.com or the law changes, for example when paid plans arrive. The latest version is always on this page, with its date. If a change is significant, we’ll tell you by email or in your dashboard.

Contact

Questions about privacy, or a privacy request: privacy@nyni.com.