Privacy policy
Updated: 2026-11-02
In short
- No account, no email, no name: Nightsy identifies you with a random token tied to your device.
- No ads, no trackers, no analytics, no data sold.
- From iCal links, Nightsy only keeps the stay dates and the platform: no guest name, phone number or price.
- Your notes, the cleaner's first name, their comments and photos stay on your phone. Cleaning reports go through our server end-to-end encrypted: we cannot read them.
- "Delete my account" (Settings) immediately erases all your data from our server.
Controller
Isnadware — nightsy@isnadware.com. The publisher is a private individual based in Morocco; the server and its backups are located in the European Union.
Data processed on our server
| Data | Why |
|---|---|
| Device identifier (random token; only its SHA-256 hash is stored) | Find your data without an account |
| Homes: the name you give them, city, residence type, night cap | Compute the counter |
| Your listings' iCal links and the stays they contain (arrival and departure dates, platform, technical id) | Count nights, detect double bookings, plan cleaning |
| Stays added by hand (dates) and "blocked, not rented" | The service itself |
| Cleaning: secret link, status of each visit (done / issue, with its date) | Cleaning page and tracking in the app |
| Cleaning: encrypted reports (comment and photo), unreadable by us | Deliver them to your phone, the only device that can decrypt them |
| Subscription: store purchase id, plan, expiry date | Verify Premium with Apple or Google |
| Technical logs: method, path, status, duration (no IP address, no content) | Security and troubleshooting |
Your IP address is not stored. It is only used in memory, for one hour at most, to limit abusive account creation.
Payments are handled by Apple (App Store) or Google (Google Play): Nightsy never receives your card details.
Data kept on your phone only
Theme, language, checklists, alert settings, stay notes, the cleaner's first name, the cleaning encryption key, comments and photos received. Reminders (checklist, cleaning tomorrow) are notifications scheduled locally by your phone: nothing is sent for them. Nightsy does not back this data up: it is lost if you uninstall the app.
Cleaning page
The cleaner needs no account and no app. The encryption key and their first name are in the part of the link after "#", which the browser never sends to our server. Their comment and photo are encrypted in their browser before sending; the photo is redrawn without its metadata (location, device). Only the "done / issue" status and the date reach us in clear. The page uses no cookies and no external resources.
Photos are meant to show the state of the home: they must not show guests or personal documents.
Legal bases
- Performance of the service you ask for (GDPR art. 6.1.b): counter, stays, cleaning, subscription.
- Legitimate interest (art. 6.1.f): service security; delivering the cleaner's reports to the host who named them.
- Subscription receipts and invoices are issued and kept by Apple or Google: Nightsy does not need to keep your purchase data once your account is deleted.
Recipients
- Hosting and backups: on the publisher's own machines located in the European Union, with no hosting provider. The publisher, based in Morocco, administers them remotely over an encrypted connection.
- Apple and Google, to verify subscriptions; they act under their own privacy policies and may process data outside the EU with their safeguards (standard contractual clauses, Data Privacy Framework).
- Airbnb, Booking.com, Abritel: our server downloads the iCal links you provided, without sending them anything about you.
No data is sold, rented or shared for advertising.
Retention
- Your data is kept as long as your account exists. "Delete my account" erases it immediately; backup copies disappear within 30 days. Deleting a home erases its stays, links and reports.
- Encrypted cleaning reports: deleted from the server as soon as your phone has picked them up, and at the latest 7 days after they were sent.
Note: uninstalling the app without deleting your account loses the device token. Delete your account before uninstalling, or write to us.
Your rights
Access, rectification, erasure, portability, restriction and objection: write to nightsy@isnadware.com. As there is no named account, we may ask for proof that the device is yours (for example a stay or link shown in the app). The cleaner can exercise the same rights at the same address; as their comments and photos are encrypted, only the host who received them can share or erase them. We answer within one month. You can also complain to the French data protection authority, the CNIL (cnil.fr), or the authority in your country.
Security
Encrypted connections (HTTPS), tokens stored as hashes, end-to-end encrypted cleaning reports (AES-GCM), secret non-indexed cleaning links, no third-party resources loaded by our pages.
Children
Nightsy is meant for people who rent out a home: it is not intended for anyone under 16.
Changes
When this policy changes, the date above is updated; an important change is announced on this page before it applies.