noddi.A little clarity on privacy.
Noddi (noddi.lol) is a small feedback widget built and run by an independent developer based in Bahrain (“I”, “me”). This policy explains what Noddi collects, why, and what you can do about it. It is written to be read, not skimmed past.
Two kinds of people
Account holders are the website owners who sign up and install the widget. Visitors are people on those websites who choose to send feedback through the widget. The website owner decides to collect feedback and is responsible for telling their visitors about it; Noddi processes that feedback on the owner’s behalf.
What I collect from account holders
Your email address and a password, or the email address and name that Google shares when you sign in with Google. Your projects: a name and website address. If you buy Pro, a record that the purchase happened, the Whop membership identifier, and its status. Card and payment details are entered on Whop, never on Noddi, and I never see your card number.
What the widget collects from visitors
Only what a visitor chooses to send: their message, a rating, an optional email address, and an optional screenshot. Alongside it, the widget records context that helps the website owner reproduce a bug: the page address without query strings or fragments, the browser, operating system, screen size, and user agent. The widget sets no cookies, uses no fingerprinting, and runs no analytics on the website it is installed on. Messages and screenshots can contain personal information; visitors should only share what they are comfortable with.
Why I use it
To deliver feedback to the website owner who installed the widget, to keep you signed in, to enforce plan limits, to confirm and honour Pro purchases, and to keep the service reliable and free of abuse. I do not sell personal data, and I do not use feedback content for advertising or to train any models.
Cookies and analytics on noddi.lol
The Noddi website and dashboard use essential authentication cookies to keep you signed in. The site also loads the Whop pixel, which records page views on noddi.lol so that purchases can be attributed to visits. That pixel runs only on noddi.lol; it is not part of the widget and never loads on customer websites. If server-side product analytics are enabled, they record milestones such as “project created” against an account identifier, never the content of any feedback.
Abuse protection
To stop spam, the feedback endpoint rate-limits submissions using a salted hash of the visitor’s IP address. The raw IP address is not stored with feedback, and the hash cannot be turned back into an address.
Where data lives and who helps run the service
Noddi runs on a small set of providers, each bound by its own data-processing terms: Supabase (authentication, database, and screenshot storage; hosted in Frankfurt, Germany, EU), Vercel (web hosting and serverless functions, USA and global edge network), Whop (checkout, payments, receipts, and the pixel described above, USA), and Google (only if you choose “Continue with Google”). Because some of these providers are outside your country, your data may be transferred internationally; the providers rely on standard contractual safeguards for those transfers.
How long I keep it
Feedback and screenshots stay until the website owner deletes them or deletes the project; deletion in the dashboard is immediate and permanent. Account data stays while the account exists. Purchase records are kept as long as required for accounting and to honour lifetime Pro access. Provider backups may retain deleted data for a short rolling window before it ages out.
Your choices and rights
Account holders can view, export as CSV, and delete their feedback and projects from the dashboard at any time. To delete your whole account, or to access, correct, or erase personal information that Noddi holds about you, DM me on X at @hamzadevO0 and I will handle it personally, normally within a few days. Visitors who want feedback they submitted removed should contact the website owner first, since the feedback belongs to them; if that is not possible, DM me and I will help. Depending on where you live, you may have additional rights under local law, and you can raise a complaint with your data protection authority.
Children
Noddi accounts are for people aged 16 or over. I do not knowingly collect personal information from children.
Changes
If this policy changes in a way that matters, I will update the date at the top and note the change on this page. Continued use of Noddi after a change means you accept the updated policy. See also the Terms of Service.