Effective date: 2026-07-29

Nib is an Android client for a Ghost publication chosen and controlled by the user.

Data processed by the app

Nib stores the following data on the device:

• the Ghost site URL and Admin API key supplied by the user;
• account labels and locally cached site metadata, which includes the site address again;
• drafts, queued posts, attachment references, and display preferences;
• the last five search terms typed in each blog's timeline;
• Nib Pro entitlement state and local aggregate monetization event counts;
• the Google Gemini API key, if the user chooses to supply one for the alt-text assistant;
• the crash-reporting choice described below.

The Admin API key is stored using Android encrypted preferences backed by Android Keystore. The other items in that list, including the cached copy of the site address, are ordinary app-private files: unreadable by other apps, but not separately encrypted. Application backup is disabled, so none of it — credentials, drafts, queued content or search terms — is copied through Android Auto Backup.

Member records are never written to the device at all. Nib holds one local table, for posts; subscriber names, email addresses and statistics exist only in memory while a screen that shows them is open, and are gone when it closes.

Data sent to other services

Nib sends Ghost requests directly from the device to the Ghost site configured by the user. Those requests can contain publishing content, media, tags, pages, newsletter settings, and member-management data necessary to perform the requested action. The operator of that Ghost site controls its data handling.

Three things reach servers that are neither Nib's nor your blog's, and all three are worth knowing about because none of them is obvious from using the app.

The first is link previews. When you add a link to a post and ask Nib to fetch its preview, Nib requests that page directly from your device, identifying itself as Nib/1.0. The site you linked to therefore learns your IP address and the approximate time you were drafting, whether or not you ever publish the post. Nothing is fetched until you ask for a preview. If the page supplies a preview image, that image is loaded from whatever server the page names, and it is loaded again each time the post is later displayed — so that server sees the request repeat. If this matters for something you are writing about, skip the preview and paste the link as plain text.

The second is member avatars. On the Members screens, each member's picture is loaded from whatever address your own Ghost site supplies for it. On a default Ghost installation that address is a Gravatar URL derived from the member's email address, which means opening the member list can tell Gravatar's operator that those addresses were looked at. This follows from your Ghost configuration rather than from anything Nib chooses, and Nib displays a plain initial instead whenever no address is supplied.

The third is the alt-text assistant, and it is the only feature in Nib that can send one of your images somewhere. It is off unless you turn it on: it does nothing at all until you paste your own Google Gemini API key into Settings, and even then nothing is sent when you attach an image, save a draft, or publish a post. An image leaves the device only when you open the alt-text dialog for it and press Generate.

When you do, Nib prepares the image before sending it rather than sending the file you picked. It is scaled down so that its longest edge is at most 1024 pixels and re-encoded as a JPEG. Re-encoding discards the metadata the original carried, which for a photo taken on a phone typically includes GPS coordinates, the camera model and serial number, and the time the picture was taken. None of that metadata is sent, and the original file is never sent. What Nib transmits is the downscaled image and one fixed instruction asking for a one-sentence description. Your post text, your Ghost site address, your Admin API key, your account name and your other attachments are not part of the request.

The request goes directly from your device to Google's Gemini API, authenticated with your key and billed to your Google account; Nib operates no server and sees nothing. Google's handling of that image is governed by the terms attached to your own Gemini key, not by this policy. The description that comes back is placed in the alt-text field for you to read, edit or delete before anything is published — Nib never publishes a generated description on its own. Your key is stored using Android encrypted preferences backed by Android Keystore, is kept separately from your Ghost credentials, belongs to the device rather than to any one blog, and can be removed at any time from the same Settings screen. Removing it turns the feature off.

If the user starts a Nib Pro purchase — a monthly or yearly subscription, or the one-time lifetime purchase — Google Play processes the transaction. Nib receives product and purchase status information but does not receive payment-card details. Google processes purchases under its own privacy terms.

Nib stores four values on the device to remember Pro access between launches: the access state, whether it came from a subscription or the lifetime purchase, whether the subscription is set to renew, and when Google Play last confirmed it. Nib does not store the purchase token, the order ID, or any Google account identifier, and none of them is written to logs.

Nib also records the first app version an install ever ran, so that people who installed Nib before Pro existed keep the features they already had. That value is a version number and identifies nobody.

This version carries no advertising, and no analytics SDK beyond the Crashlytics session events described in the next section — which are governed by the crash-reporting switch and stop when it is off. There is no separate usage-analytics product: Google Analytics for Firebase is deliberately not included. Monetization funnel counters remain on the device and contain no Ghost URL, API key, account/member identity, content, filename, purchase token, or order ID.

Crash reports

Nib includes Google Firebase Crashlytics. It is on by default, and it can be switched off at any time in Settings › Send crash reports. Switching it off takes effect immediately — it does not wait for a restart — and the choice is remembered, so a later launch will not quietly resume reporting.

These reports are used for one purpose: finding and fixing bugs in Nib. They are not used for analytics, profiling, advertising, personalisation, measuring usage, or building any picture of who you are or what you publish, and they are not sold or passed to anyone for those purposes.

When it is on, a crash sends the stack trace of the failure together with the envelope Crashlytics assembles for itself: device model, Android version, Nib version, locale, available memory and storage at the moment of the crash, and a randomly generated installation identifier. That identifier is created by Crashlytics, belongs to the installation rather than to a person, and is destroyed when the app is uninstalled or its storage cleared.

Crashes are not the only moment something is sent. While reporting is on, Crashlytics also records that the app was opened — a short session event carrying the same installation identifier and the same device, Android and Nib version details, and nothing about what you did in that session. This is how Crashlytics can say what proportion of launches ended in a crash rather than only how many crashes there were; without it a crash count means nothing. It is governed by the same switch: turn crash reporting off and these session events stop too. They carry no Ghost site address, no credential, and no content.

Nib attaches nothing of its own to a report. No Ghost site address, Admin API key, account label, draft, published post, image, filename, tag, page, newsletter setting, member record, purchase token, or order ID is included, and Nib holds no capability to add one — the code path to Crashlytics accepts an on/off value and nothing else.

Crashlytics is operated by Google, which processes the reports as a data processor for Nib under the Firebase terms and privacy information published at https://firebase.google.com/support/privacy. Google states that it encrypts this data in transit and does not transfer it to third parties other than its own subprocessors.

Reports already sent are held by Google and are removed under its retention practices; to have them removed sooner, contact pawel@orzech.me. Disconnecting the last Ghost account returns the crash-reporting choice to the default if you had left it on, so a device that is handed on or started over does not carry the previous owner's settings. If you switched crash reporting off, disconnecting your blogs does not turn it back on. Once you have said no, only you can undo it, from the same switch in Settings.

Retention and deletion

Nib has no accounts and no server. There is nothing to close and nothing held about a person under a login, so deletion is a matter of removing data from the device and, for crash reports only, asking for removal from Google.

How to delete your data in Nib — step by step

1. Remove one blog's data. Open Settings and tap Disconnect Current Account. This deletes that account's stored Ghost credential, its local drafts, its queued posts, its cached site metadata, its newsletter and tag settings, and its search terms. If it was your last blog, this does everything step 2 does, including returning the crash-reporting choice to the default — unless you had switched reporting off, which is kept.
2. Remove everything. In Settings, tap Disconnect All Accounts. This deletes every stored credential, all local drafts and queued posts, every blog's newsletter and tag settings, all search terms, and the cached images and site metadata. It also returns the crash-reporting choice to the default, unless you had switched reporting off — a refusal is kept.
3. Remove the rest. Uninstall Nib, or open Android Settings › Apps › Nib › Storage and tap Clear storage. This removes everything Nib has written on the device, including the Pro entitlement cache and the local monetization counters.
4. Remove your Gemini key. In Settings, under Alt text assistant, tap Remove key. This is a separate step on purpose: the key belongs to the device rather than to any one blog, so disconnecting a blog — or even all of them — deliberately leaves it alone. Uninstalling or clearing storage removes it too.
5. Stop crash reports. Crash reporting is on by default; turn off Send crash reports in Nib's Settings. Collection stops immediately and the choice is remembered.
6. Request removal of crash reports already sent. Email pawel@orzech.me from any address, stating that the request concerns the Nib Android app. No account identifier is needed, because Nib holds none.

What each step deletes, and what it does not

Deleted	Not deleted
Ghost site URLs and Admin API keys stored on the device	Posts, pages, images and members already published to your Ghost site — those belong to your site and are deleted through Ghost, or through Nib while it is still connected
Local drafts, queued posts, and attachment references	Google Play transaction records, which Google retains under Google Play policies; refunds and transaction history are handled through Google Play
Cached site metadata, feature images and avatars	Crash reports already delivered to Google, until Google's retention period elapses or the request in step 6 is actioned
Your saved search terms, and each blog's newsletter and tag settings	Server logs kept by any site whose link you previewed, or by whatever host serves your members' avatars — those belong to the operators of those sites, not to Nib
The Pro entitlement cache and local monetization counters
Your Gemini API key, by Remove key or by uninstalling — but not by disconnecting a blog or by Disconnect All Accounts, which leave it in place	Anything Google has already received and retains for an alt-text request you made, which is governed by the terms attached to your own Gemini key
The crash-reporting choice, unless you switched reporting off — a refusal is kept

Deleting a Ghost integration key inside your own Ghost site revokes Nib's access to it regardless of anything on the device, and is worth doing if you believe a key has been exposed.

Security

Nib blocks cleartext network traffic in release builds, does not log Ghost authorization headers or response bodies in production, and stores no real secrets in its source repository. No security measure can guarantee absolute protection; users should rotate a Ghost integration key if they believe it has been exposed.

Children's privacy

Nib is a professional publishing tool and is not designed for children.

Changes and contact

Material changes to this policy will be published with the application update.

Nib is published by Paweł Orzech. For privacy questions or data requests, contact pawel@orzech.me.