Privacy Policy

What Nowlark stores, why it stores it, where it is kept and for how long, who it is shared with, and how to delete all of it.

Effective 17 October 2026

Skail Consulting LLC ("we", "us") makes Nowlark, an app that delivers notifications you send to yourself from your own scripts, servers and apps. This policy explains exactly what Nowlark processes, why, where it is kept and for how long. It is written to be complete rather than short.

1. The short version#

• There is no sign‑up: no email address, no password, no name, no third-party login. The one exception is a message you choose to send us (section 2.9), where an email address is optional.
• We store what is needed to deliver your notifications and show you their history. The Nowlark app contains no advertising, analytics or crash-reporting SDKs and sends nothing to Google or any advertiser. Our websites (not the app) use Google Analytics to measure visits and how our Google ads perform, with ad personalization switched off (section 2.10).
• We do not sell your data, and do not share it with advertisers or data brokers. The few services that receive any of it, and exactly what each gets, are listed in section 4.
• You can delete everything from inside the app, at any time.

2. What we process, and why#

2.1 Your account#

On first launch our server creates an account for you and generates a random account key. The key is stored on our server only as a one-way hash, so nobody, including us, can read it back. For each device that holds the key we keep the device label it was issued to (for example "iPhone"), so you can see and revoke access in the app.

If your device provides it, we store your iCloud user record identifier as a label. It lets the app tell you when a device is signed in to a different Apple Account. It is never used to identify you to anyone, and never accepted as proof of identity.

2.2 Your devices#

To deliver notifications we store, for each device: the push token Apple issues for it, whether that token is for Apple's production or development service, the device's name and model identifier, and the iOS and app versions, plus when it was added and last seen.

2.3 Your API keys#

API keys are what your scripts and apps use to send. We store them only as one-way hashes, together with the name you give each key, the first few characters (so you can tell keys apart), how many notifications each has sent and when it was last used.

2.4 The notifications you send#

When one of your senders sends a notification, we store what it contains: the source name, title, body, link, image address, buttons, copy text, priority, grouping and de-duplication keys, when it arrived, whether you have read it, how many of your devices accepted it, and, for an Urgent one, whether it is still repeating and whether you acknowledged it. This is how the app shows you a history.

Notifications are deleted automatically once they are older than the history length you choose in Settings: 30 days by default, or up to 365 days with the Upgrade Pass. Deletion runs every hour and removes the rows; it does not hide them. You can delete any notification sooner from the app.

2.5 Your sources#

Each name your senders use appears as a source, with the settings you choose for it (muted, silent, colour, tone) and when it was first and last seen.

2.6 The Upgrade Pass#

If you buy the Upgrade Pass, Apple processes the payment. We never see your payment details. We store the Apple transaction identifier, the dates the pass covers, and whether Apple reported a refund, so the features it unlocked stay unlocked on every device.

2.7 Moving to another device#

If you move your account to a device on a different Apple Account, the transfer code you create is stored only as a one-way hash and expires after ten minutes.

2.8 IP addresses#

To stop automated abuse, we limit how often accounts can be created and transfer codes tried from one internet address. For this we keep only a keyed hash of the address, which cannot be turned back into the address, and delete it within two hours. We do not keep request logs containing IP addresses.

2.9 Messages you send us#

Skail Consulting LLC also runs the contact forms on skailstudio.com, orgomedia.ai and nowlark.com, the OrgoMedia launch list on orgomedia.ai, and the "send feedback" screens in our apps. They all post to this same server, and this section is what it keeps when you use one. Nothing here is collected unless you press Send.

• What you write, and, if you fill them in, your name and email address. The email address is optional and is used only to reply to you; leave it empty to send anonymously, and we then cannot answer you.
• What the form says about where it came from: which site or app, and its kind (inquiry, bug, feature request, question or launch-list sign‑up).
• The launch list keeps only your email address and when you joined. We use it once, to email you when OrgoMedia is released, and never share it. To leave the list, email us and we delete the address.
• Diagnostics, only in an app and only when the box is ticked. The app version and build, the operating system version, the device model, your language, a rough free-storage band, whether you have the Upgrade Pass (yes or no, never an identifier), and recent error codes. The screen shows you exactly what will be sent before you send it. It also includes an install id: a random number the app made for itself, which is not linked to your name, your Apple Account or your iCloud and which is deleted when you delete the app. It is one line of the diagnostics you can read before sending.
• Screenshots and a log, only if you add them: up to three images totalling 5 MB, and, in OrgoMedia for Mac, a log file of up to 2 MB that the app cleans of file names, paths and keys on your Mac before it shows it to you.
• A reference (it begins frm_) that we give you after you send. Quote it if you want the message removed.
• On your phone until it is sent. If you are offline when you press Send, the app keeps the message on your phone, outside iCloud and device backups, and sends it when the connection returns. You can discard it from the same screen. The app also keeps the last few references it was given, on your phone, so you can quote one later.

We keep the message and the details above for 24 months (730 days) and any screenshots or log for 180 days, then delete them automatically. We read them, and add a private note and a status ("read", "replied", "archived") of our own, to reply to you and to fix what you reported. We use them for nothing else, we do not share them, and they never leave the two service providers in section 4. To have a message removed sooner, email us its reference and we delete the message and its files.

To stop the forms being used to flood us, we count how many messages one internet address (per site, per hour) and one install id (per day) have sent. As in section 2.8 the address is kept only as a keyed hash, deleted within two hours; the install id is kept the same way for up to 25 hours.

Each form also has a spam filter that learns. For every word and link in the messages it receives, it keeps two counts: how many spam messages held it and how many real ones did. The counts do not keep the words, only a scrambled code for each word that cannot be turned back into it, and they belong to that one form and are never shared with another. A sender's address, or their domain, can be put on that form's list of senders it always keeps or always files as spam, when whoever runs the form marks a message as spam or not spam, or adds it by hand. A message filed as spam keeps the reason with it: the check that filed it, or a few words quoted from that same message. The reason is deleted with the message. The counts and lists are deleted with the form.

2.10 Visits to our websites#

The same server counts visits to the pages of nowlark.com, skailstudio.com and orgomedia.ai, so we can see which pages are read and whether a message follows. For each visit we keep the page (without anything after a ?), the name of the website you came from (not the address of the page), whether your device is a computer, phone or tablet, and a fingerprint. The fingerprint is a keyed hash of your internet address and browser type, made with a key that is replaced every day and deleted after two days. It can tell us that two visits today were by different people. It cannot be turned back into your address and cannot be matched with a visit on another day, so someone who returns tomorrow counts again. For this count we set no cookie and run no script in your browser. Visits by search-engine crawlers and scripts are not counted. We keep these counts for 90 days.

Google Analytics. Separately from that count, the pages of nowlark.com, skailstudio.com and orgomedia.ai load Google Tag Manager, which runs Google Analytics. When you open one of those pages, your browser sends Google the page, the site you came from, your browser and device type, your approximate location (which Google derives from your internet address and does not pass to us), and a random identifier that Google Analytics keeps in first-party cookies named _ga and _ga_… for up to two years. Google gives us only aggregate reports: how many visits, to which pages, from where. Our Google Analytics properties are linked to our Google Ads account so we can see whether an ad led to a visit; ad personalization is switched off, so your visits are not used to choose ads for you. When you send the contact form on skailstudio.com or join the launch list on orgomedia.ai, the page also tells Google Analytics and Google Ads that it happened (not what you wrote or your address), so we can see whether an ad led to it; to connect it to an ad you clicked, Google keeps the click in first-party cookies named _gcl_… for up to 90 days. Google processes this data under its own terms, described at policies.google.com/technologies/partner-sites.

• In the European Economic Area, the United Kingdom and Switzerland the tag starts with analytics and advertising storage denied: no Google Analytics cookie is set, and Google receives only cookieless measurement signals.
• Not on every page. The page a Nowlark test notification opens (/link-test) loads none of this. The Nowlark app itself never contacts Google; when the app shows you one of our web pages (Support, this policy), that page behaves as described here.
• Your choice. Any content blocker stops it, as does Google's opt-out add‑on at tools.google.com/dlpage/gaoptout.

Our private consoles also show, read only, what Google reports about these sites: how often they appear in Google Search and are clicked (Search Console) and the visits Google Analytics records.

2.11 Team plans#

A team plan is bought from Paddle, our reseller and Merchant of Record (section 4). We never see the card or bank details. We store Paddle's customer and subscription identifiers, the number of seats and forms, the plan's status, and the date it is paid through, so the team gets what it paid for.

2.12 Form statistics#

Forms that run on Nowlark (our own contact forms, and the forms teams make with Nowlark, on their own websites or on their page at Nowlark) count how often they are seen, started and sent, so whoever runs a form can see where people give up. For each time a form is shown we keep the day and time it came into view, whether someone began filling it in, the names of the fields they reached and of the last one they were on (never what they typed in them), whether and when it was sent, and a short label for where the visit came from: the campaign's utm_source tag (up to 64 characters, and never one that holds an email address), or else the name of the website that linked to the page (not the address of the page). The page gives each showing a random number that lives only while the page is open; the form sends it along with the message, so that showing can be counted as sent. We also note which website each form has been shown on: the site's domain, not the page or anyone who saw it, so the team that runs the form can see it working there. It is deleted with the form. An address a team types into Check my site is read once for that check and not kept. That number ties a sent form's counts to its message, which the team that runs the form can already read; the counts of a form nobody sent are tied to no one. For these counts we set no cookie. The only thing the form keeps in your browser is where the visit began, for the open tab only, so a form a few pages in can still say it; it is gone when you close the tab. We do not keep your internet address or browser type with these counts. To stop the counts being flooded, we limit how many events one internet address can send in an hour; as in section 2.8 the address is kept only as a keyed hash, deleted within two hours. We keep these counts for 400 days, so a form's numbers can be read across a whole year.

A team can try two versions of a form at once, to see which more people send. Which version you see is picked at that moment from a one-way code made from the test, your internet address and your browser type, so you see the same version each time you come back on the same network and browser. Your address and browser type are used only to pick the version: neither they nor the code are kept for it, and no cookie is set for it. With the counts above we keep only which version was shown, A or B.

A team can also have its form tell the team's own Google Analytics that it was seen, started and sent. This is off unless the team turns it on, and then the team, not Nowlark, sends these events to Google: the form passes them to the Google tag or Tag Manager the team already runs on its own website, under that website's own privacy policy and cookie choices, and Nowlark loads no Google script. Each event says only which form it was (its id, name and the web address it sends to), never what you typed. If the team also gives us its Google Analytics API secret, our server tells Google Analytics when it accepts a message from you, on the team's behalf, with the same three details and the random identifier Google Analytics already keeps in that website's _ga cookie, so Google can count it with the rest of your visit. It does this only when your browser carries that cookie, which Google sets only where the website's cookie choices allowed it; without it, our server tells Google nothing. Turning the setting off stops this at once. We keep the team's secret encrypted, with a key kept outside our database, and use it for nothing else. Nowlark's own forms do not do this.

3. What stays with you and Apple#

• Your account key is kept in your iCloud Keychain and in your own private iCloud database, so your other Apple devices can use your account without signing in. Apple holds this data under your Apple Account; we cannot read it.
• Your settings (theme, accent, links and similar) are kept on your device and, with iCloud Sync on, in your iCloud key-value storage, so your devices match. We cannot read these either.
• Links and images. When you open a link in a notification, your device connects to that website directly. When a notification includes an image, your device downloads it directly from the address the sender gave, so that server sees your device's IP address, as with any web request.

4. Who processes your data#

We use these service providers, strictly to run Nowlark and our websites:

• Apple, whose Push Notification service carries each notification to your devices (so notification content passes through Apple, as with every iOS notification), and which provides the App Store and iCloud.
• Fly.io, which hosts our server and database in Chicago, United States. The database is on an encrypted volume.
• Paddle.com, our reseller and Merchant of Record for team plans (section 2.11): it takes the payment and holds the buyer's name, email, address and payment details under its own privacy notice. We receive only Paddle's customer and subscription identifiers, the plan bought (how many people and forms it allows), and the plan's status and dates.
• Google, only for visits to our websites (section 2.10): Google Analytics, through Google Tag Manager, with ad personalization off. The Nowlark app sends Google nothing. When a team turns on its form's Google Analytics events (section 2.12), Google receives them for that team, under the team's own agreement with Google, including, when the team saves an API secret, each send's form details and your Google Analytics cookie identifier, sent from our server.

We do not share your data with anyone else, except where the law requires it.

5. How long data is kept#

Backups. Our host takes a daily snapshot of the database volume and keeps each for 5 days. Data you delete disappears from our live database immediately and from snapshots within 5 days, as they roll over.

6. Deleting your data#

A message you sent through a form is not part of your Nowlark account; to remove one, email us its reference (section 2.9).

In the app, Settings › Delete Account erases your account, every notification, every key and every registered device from our database straight away. It cannot be undone. Deleting the app alone does not do this; your data then remains until its history length expires, so use Delete Account if you want it gone immediately.

7. Your rights#

You can see and delete your data in the app at any time. You can also email us to ask for a copy of the data we hold about you, or for it to be corrected or deleted, and we will respond within 30 days.

If you are in the European Economic Area or the United Kingdom, you have the rights of access, rectification, erasure, restriction, objection and data portability under the GDPR. We process your data because it is necessary to provide the service you asked for (Article 6(1)(b)). You may also complain to your local data protection authority.

If you are in California, you have the right to know, to delete and to correct your personal information. We do not sell or share personal information as those terms are defined under California law.

8. Security#

All traffic uses HTTPS. Keys and codes are stored only as hashes, the database volume is encrypted, and access to our servers is restricted to us.

9. Children#

Nowlark is not directed at children under 13 (or under 16 in the EEA and UK), and we do not knowingly collect their information. If you believe a child has used Nowlark, contact us and we will delete the account.

10. International transfers#

Our servers are in the United States. If you use Nowlark from elsewhere, your data is processed in the United States, with the protections this policy describes.

11. Changes#

If we change this policy, we will update the effective date above and publish the new version at this address.

12. Contact#

Skail Consulting LLC Email: support@nowlark.com