Back to Nekl

Privacy Policy

Effective date: November 1, 2026

Nekl is operated by FrostPeak Ventures LLC, a limited liability company registered in the State of Wyoming, United States (“we”, “us”, “our”). This policy explains what personal data we collect when you use Nekl, why we collect it, who we share it with, and what rights you have over it.

We have written this policy to describe what Nekl actually does. If you find anything here that does not match your experience of the product, please tell us at support@nekl.com and we will correct it.

1. A summary, in plain terms

  • We store the content you create in Nekl (your tasks, your quick captures and your focus session history) on servers we control. It is not kept only in your browser.
  • We can technically access that content. We do not read it except where necessary to operate the service, investigate a fault, or comply with the law.
  • We do not sell your data. We do not share it for advertising. We do not build advertising profiles.
  • We measure how Nekl is used with PostHog, which sets no cookies and is not linked to your account.
  • We use a small number of service providers to run Nekl. They are listed in section 5.
  • You can ask us for a copy of your data, or ask us to delete your account, at any time.

2. Who we are

Data controller: FrostPeak Ventures LLC

Registered address:
FrostPeak Ventures LLC
30 N GOULD ST STE N
SHERIDAN WY 82801
United States

Contact: support@nekl.com

3. What we collect, and why

3.1 Account information

When you create an account we collect:

  • Your email address. Used to identify your account, to send you a confirmation link, to allow you to reset your password, and to contact you about your subscription or important service changes.
  • Your display name, if you provide one. Used to greet you in the dashboard.
  • Your password, stored only as a cryptographic hash by our authentication provider. We never see or store your password in readable form.
  • The date your account was created, and the date and time you accepted our Terms of Service and this policy.

Legal basis (UK and EU): performance of a contract with you.

3.2 Content you create in Nekl

This is the most personal information Nekl holds, and we want to be explicit about it. The following is stored on our servers, not only in your browser:

  • Task list entries. The text of every task you add, whether it is complete, and when you completed it.
  • Quick captures. The full text of anything you type into the capture box. When you type a date or a tag, we also store the date and tag we extracted from your text, so that the calendar and the overdue list can work.
  • Focus session history. The length of each focus timer you complete and the date and time you completed it. This history is kept indefinitely so that your statistics remain accurate over time.
  • Dashboard preferences. Which widgets you show, how they are arranged, which weather cities you have chosen, your ambient sound choice, and your preferred time format.

Quick captures are a free-text field. Please be aware that whatever you type there is stored on our servers, and treat it accordingly.

Legal basis (UK and EU): performance of a contract with you.

3.3 Payment information

Payments are processed by Stripe. We never see, receive, or store your card number, expiry date, or security code. Stripe handles your card details directly.

We store a small amount of subscription information so that we know whether your account is active:

  • An identifier linking your Nekl account to your Stripe customer record.
  • Your subscription status (including whether you are in a free trial), which plan you are on, when the current period or trial ends, and whether you have canceled.

We do not store your card brand, the last four digits of your card, your billing address, or your invoices. Those are held by Stripe and Link. Link emails you your receipts and invoices, and you can also see them in your Link account at link.com or through the billing portal linked from your Billing page.

Legal basis (UK and EU): performance of a contract with you, and compliance with our legal obligations regarding financial records.

3.4 Location, for the weather feature

If you add a weather city, we send the coordinates of that city to WeatherAPI.com in order to retrieve the forecast. We send the city's coordinates, not your device's location.

On our public home page, we display the local weather for the approximate area your internet connection appears to be in. This is derived from your IP address by our hosting provider, Netlify, at the moment the page loads. It is used only to show that one weather reading. We do not store this location, and it is not linked to your account.

Legal basis (UK and EU): our legitimate interest in demonstrating what the product does, and performance of a contract where you have chosen a weather city.

3.5 Technical information

Our hosting and database providers automatically record standard technical information, including IP addresses, browser type and request times, in their operational logs, for security and reliability purposes. We do not use these logs to build a profile of you.

Legal basis (UK and EU): our legitimate interest in keeping the service secure and available.

3.6 Usage measurement

We use PostHog to measure how Nekl is used: which pages are visited, and whether a checkout or a sign-up was started or completed. On the dashboard we also record which widgets are shown. With each of these we record:

  • The address and title of the page, with any query string and fragment removed from the address.
  • The address of the page that referred you, with the same parts removed.
  • Technical details your browser reports: its type and version, your operating system and device type, your screen and window size, your language setting, and your time zone.

PostHog runs in a mode that sets no cookies and stores nothing in your browser. To count visitors, PostHog combines your IP address and browser details with a value that changes every day and is deleted once that day's events have been processed. Your IP address is then removed before the event is stored, and it is not used to estimate your location.

We do not link these events to your account, and we never send your email address, your name, or anything you type into Nekl.

Legal basis (UK and EU): our legitimate interest in understanding how the service is used, so that we can improve it.

3.7 What we do not collect

  • We do not use advertising cookies or tracking pixels.
  • We do not use analytics cookies or any analytics service that stores data in your browser.
  • We do not collect biometric data, precise device GPS location, contacts, or files from your device.
  • We do not knowingly collect information from children. See section 11.

4. Cookies and local storage

Nekl uses cookies and browser storage only for the service to function. We do not use them for advertising or tracking, and we therefore do not show a cookie consent banner. PostHog, which we use for usage measurement (section 3.6), sets no cookies and does not use local or session storage. Cloudflare Turnstile, the security check on sign-in and account forms (section 5), runs in your browser to tell people apart from automated traffic. Cloudflare describes the signals it collects as strictly necessary for that purpose.

  • Authentication cookies. Keep you signed in. Set by our authentication provider. They last until you sign out or the session expires.
  • Local storage. Holds a copy of your tasks, captures, focus history and preferences so the dashboard loads quickly and can show your last copy if your connection drops. If you change a task or a capture while offline, the change is not saved. A focus session you finish while offline is kept here and saved to your account the next time the dashboard loads. The copy stays in this browser until another account signs in here or you clear your browser data.
  • Session storage. Remembers the email address you signed up with until you confirm it, so that we can resend the confirmation link, and whether the opening animation has already played. It is cleared when you close the tab.

You can clear this data at any time through your browser settings. Doing so will sign you out; your data on our servers is unaffected.

5. Who we share your data with

We do not sell your personal data, and we do not share it for advertising purposes. We use the following service providers, each of which processes data on our instructions:

  • Supabase: database and authentication. Hosts your account and all content you create in Nekl, and runs on Amazon Web Services infrastructure. It receives everything in sections 3.1 and 3.2.
  • Netlify: website hosting and content delivery. It receives technical request data, including your IP address, and the approximate location derived from it, used only to display home-page weather.
  • Stripe: payment processing and subscription management. It receives your email address and your payment details, which you provide to Stripe directly. For purchases, Link, a Stripe company, acts as the merchant of record. Link handles your payment details, tax, receipts and payment support as an independent controller under its own privacy policy, available at link.com.
  • WeatherAPI.com: weather forecasts. It receives the coordinates of the cities you have chosen, or of the approximate area shown on the home page. No account identifier is sent.
  • PostHog: usage measurement. PostHog, Inc. is a company based in the United States. It receives the page and event data described in section 3.6. Your IP address reaches PostHog so that it can deliver the data and count daily visitors, and it is removed before the data is stored.
  • Cloudflare (Turnstile): a security check on sign-in and account forms that tells people apart from automated traffic. Cloudflare, Inc. is a company based in the United States. It receives your IP address and details about your browser and connection, namely its User-Agent header and TLS fingerprint. Cloudflare uses them to detect and block automated traffic, and also to improve its bot detection, which it does as an independent controller under its own privacy policy, available at cloudflare.com.

We may also disclose personal data where we are legally required to do so, where necessary to establish or defend legal claims, or to protect the rights and safety of our users. If Nekl is ever sold or merged, personal data may transfer to the acquiring entity; we would tell you before that happened.

6. Where your data is held

Our database and authentication services are hosted in Tokyo, Japan (Amazon Web Services region ap-northeast-1). Netlify, Stripe and Cloudflare operate globally. PostHog, Inc. is based in the United States and stores usage data in Germany (PostHog EU Cloud).

FrostPeak Ventures LLC is established in the United States. If you are located in the United Kingdom or the European Economic Area, your personal data will be transferred outside your country. Where such transfers occur, we rely on the Standard Contractual Clauses approved by the European Commission, which our providers incorporate into their terms.

7. How long we keep your data

  • Account information. For as long as your account exists.
  • Tasks and quick captures you delete. Hidden from you immediately, and permanently erased approximately 30 days later. See the note below.
  • Focus session history. For as long as your account exists.
  • Subscription records. For as long as your account exists, and afterwards for as long as we are required to keep financial records.
  • Usage measurement events. Kept by PostHog for 1 year, the period PostHog sets for our plan.
  • Everything else, on account deletion. Erased when your account is deleted, subject to the notes below.

About the 30-day window. When you delete a task or a capture, it disappears from your dashboard at once but is retained for approximately 30 days before permanent erasure, so that accidental deletions can be recovered. We aim for 30 days, and it may occasionally be slightly longer if our scheduled deletion process does not run on time. It is a target, not a guarantee.

What survives account deletion. When we delete your account we erase the content in it, with one exception: we keep a minimal record that a specific person accepted a specific version of our terms on a specific date. We keep it because we may need it to establish or defend a legal claim. That record contains no task content, no quick captures, no focus session history and no preferences.

Backups. Our providers keep encrypted backups for their own operational periods. Data you delete may persist in those backups until they expire in the ordinary course.

8. Security

  • All connections between your browser and our servers are encrypted using TLS.
  • Data stored in our database is encrypted at rest by our hosting provider.
  • Access to your account's data is restricted at the database level, so that no other user of Nekl can read it.
  • Passwords are stored only as cryptographic hashes.
  • Payment card details never reach our servers.

What this does not mean. Nekl is not end-to-end encrypted. We hold the keys to our own database, which means that we are technically able to access the content you store, and so, in principle, are our hosting providers and anyone who obtains lawful access. We restrict this access to what is necessary to run the service, but you should not treat Nekl as a confidential vault. Please do not store passwords, financial account details, medical records, or similarly sensitive information in your tasks or captures.

No online service can be perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant supervisory authority as required by law.

9. Your rights

Depending on where you live, you may have some or all of the following rights:

  • Access. Ask for a copy of the personal data we hold about you.
  • Rectification. Ask us to correct data that is wrong or incomplete.
  • Erasure. Ask us to delete your account and the data in it, subject to the record described in section 7.
  • Portability. Ask for a copy of your data in a machine-readable format.
  • Restriction and objection. Ask us to limit how we use your data, or object to a particular use.
  • Withdraw consent. Where we rely on consent, withdraw it at any time.

How to exercise them. Email support@nekl.com from the address on your account. We will respond within 30 days.

Please note: you can delete your account yourself from your Account page. Data export is still handled by email for now; write to us and we will send you a copy of what we hold.

If you are in the UK or EEA, you also have the right to complain to your local data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk).

If you are in California, you have rights under the CCPA to know what personal information we collect, to request deletion, and not to be discriminated against for exercising those rights. We do not sell personal information as that term is defined in the CCPA.

10. Automated decision-making

We do not make any decisions about you by automated means that produce legal or similarly significant effects.

11. Children

Nekl is not directed at children. You must be at least 18 years old to create an account. Nekl has no free tier: every account needs a subscription, and starting one, including the monthly free trial, requires a payment card. We do not offer accounts to anyone below that age. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact support@nekl.com and we will delete it, along with the account.

12. Changes to this policy

If we change this policy in a way that materially affects your rights, we will notify you by email or in the product, and where required we will ask you to accept the updated policy before you continue using Nekl. The effective date at the top of this page always reflects the current version.

13. Contact

FrostPeak Ventures LLC
30 N GOULD ST STE N
SHERIDAN WY 82801
United States

support@nekl.com