Privacy Policy

Last updated: 22 October 2026

Nippy ("nippy.host", "we", "us") is a hosting service that lets you publish HTML sites, images, and files to the web. This policy explains what personal data we collect, why, and what your rights are. The short version: we collect the minimum we need to run the service, we don't sell data, and we don't run advertising trackers.

Who we are

The data controller is Street Ventures Limited, trading as Nippy — a company registered in England and Wales (company number 16804955), registered office 124 City Road, London, EC1V 2NX. For anything privacy-related, contact us at support@nippy.host.

What we collect

Your account

We use passwordless sign-in: the only credentials we hold are your email address and, if you choose to set one, your display name. We never see or store a password. We also keep standard account records such as when the account was created and which plan it's on.

Content you upload

Files you publish are stored so we can serve them — that's the product. Anything you publish to a live site is publicly accessible on the internet unless you put it behind a site password. Site passwords are stored only as cryptographic hashes; we cannot read them back.

Billing

Payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers; we store only what we need to manage your subscription (plan, billing status and Stripe's customer reference). See Stripe's privacy policy.

Service logs

Like nearly every web service, our servers keep short-lived technical logs (IP address, request path, user agent) for security, abuse prevention, and debugging. These logs are deleted automatically, normally within 30 days.

Security and abuse-prevention records

Separately from those logs, when you sign up, sign in, publish, or create an API token we record the IP address and network you used, your browser's user agent, and a random device identifier that the Nippy web app keeps in your browser. We use these records to protect the service: to spot one person or group running many accounts, to investigate abuse, and to enforce our terms. That includes comparing records across accounts and flagging accounts that appear to be connected for our team to review. When an IP address, network or device identifier was used for abuse, we may block it, so requests from it can no longer sign in, create an account or publish. These records are not deleted after 30 days; see "How long we keep data" below.

Why we're allowed to use it (lawful basis)

Under UK GDPR our lawful bases are:

Performance of a contract — running your account, storing and serving the files you publish, and managing your subscription.
Legitimate interests — keeping the service secure, preventing abuse (including detecting accounts operated together), and debugging (service logs and security records). We balance this against your rights.
Legal obligation — retaining billing and tax records, and responding to lawful requests.

Analytics on sites you publish

If you turn on analytics for one of your sites, we count your visitors using a daily-rotating anonymous hash — no cookies, no persistent identifiers, no cross-site tracking. Visitors cannot be re-identified across days, which is why your sites don't need a consent banner for our analytics. You can turn this off per site at any time.

Cookies

We set one essential cookie: the session cookie that keeps you signed in. The web app also keeps a random device identifier in your browser's local storage, used only for the security records described above. There are no advertising or third-party tracking cookies on nippy.host.

Who processes data for us

Cloudflare — file storage and content delivery for published sites.
Fly.io — application hosting.
Stripe — payment processing.
Postmark — transactional email (sign-in links, invitations, and the emails that keep a free site online).

Each processor receives only what it needs to do its job. Some of them operate globally; where data leaves the UK/EEA, transfers rely on standard contractual clauses or equivalent safeguards.

How long we keep data

Account data is kept while your account exists. A site on the free plan that goes offline because nobody kept it online is deleted 30 days after it goes offline (see the terms). When a site is deleted — by you, when you delete your account, or because nobody kept it online — we may keep a backup copy of its files and settings, with the email address of the account it belonged to, for up to 90 days, as a safeguard against mistakes and abuse. After that it is deleted permanently. Form replies sent through a site are deleted with the site and are not part of that backup. Service logs are normally deleted within 30 days. Security and abuse-prevention records (IP addresses, device identifiers, user agents) are kept for as long as we need them to protect the service, which can be after the account they relate to is closed or banned. If you want your account and its data deleted, email us and we'll action it promptly; billing records are retained for as long as tax law requires (currently six years).

Your rights

Under UK GDPR you can ask us to access, correct, export, or delete the personal data we hold about you, and you can object to or restrict certain processing. Email support@nippy.host and we'll respond within a month. You also have the right to complain to the Information Commissioner's Office.

Children

Nippy isn't directed at children under 13, and we don't knowingly collect their data. If you believe a child has created an account, contact us and we'll remove it.

Changes to this policy

If we make material changes we'll update this page and, for significant changes, email account holders. The "last updated" date at the top always reflects the current version.