Privacy Policy

Effective: June 1, 2025 · Last updated: October 26, 2026 · NOMADO LLC

1. Who We Are

NOMADO LLC ("NOMADO", "we", "us" or "our") operates the NOMADO website at nomadoapp.app and the NOMADO Android app (together, the "Service"). NOMADO helps expatriates track document expiry dates, receive reminders, find local services and connect with other expats in the community. NOMADO LLC is incorporated in Wyoming, United States, and is responsible for the personal data described in this policy.

Contact: info@nomadoapp.app

2. Information We Collect

2.1 Information you give us

• Account: email address, password (stored only as a secure hash by our authentication provider) and name. If you sign in with Google, we receive the name and email address on your Google account.
• Profile and settings (optional): phone number, nationality, language, theme and notification preferences.
• Documents and reminders: document type, expiry date, the name of the person the document belongs to (who may be a family member, including a minor), an optional note, reminder time, frequency and period, renewal checklist progress and items you add, and WhatsApp numbers you save so you can share reminders yourself.
• Community: your handle, display name, bio, profile photo, cover photo, posts, replies, photos, videos and voice notes you attach, likes, reposts, bookmarks, follows, follow requests, blocks, mutes, reports you submit and your privacy settings.
• Camera and microphone: the apps and the website use the camera and microphone only when you choose to record a video or a voice note for a post, and only while the recording screen is open. Nothing is recorded in the background, and a recording is uploaded only when you post it. You can turn these permissions off at any time in your phone settings.
• Messages: the messages you send and receive, message requests and whether they were accepted, when you last read each conversation, and your message settings (who can message you, read receipts and message text in notifications). If you report a message, we save a copy of it with your report so our team can review it.
• Questions and solutions: the questions you ask (title, details, topic, country and whether you asked without your name), the answers you write, the answers you mark as helpful, the answer you choose as the solution, the reports you submit, and which questions you open, to count views.
• Services directory: business listings you submit (business name, category, contact numbers, address, description, working hours, photos, an optional video and an optional business licence), reviews and ratings you write, and reports you submit about listings.
• Job ads: the job details you publish, such as the job title, employer, location, salary, requirements and benefits, the contact details applicants use (email, phone or WhatsApp number, or application link), the application deadline, and when you accepted the job ad confirmations.
• Advertising requests: business name, contact phone and email, target country and city, website, ad title, banner images and notes.
• Post boosts: the post you boost, the country and number of days you choose, the payment status and the total views and clicks of the boost.
• Support: messages you send us through support tickets, email or WhatsApp.
• AI assistant (where available): the questions you type, which we send to our AI provider to answer and do not store, and a daily count of your messages to apply usage limits. If you report an answer, we save the question, the answer and your report as a support ticket so our team can review it.
• Referrals and payouts: your referral code and referred accounts, wallet balance, withdrawal requests and the payout details you provide, such as account holder name, bank name, IBAN, SWIFT code or payout email. If you set up payouts with Stripe Connect, Stripe collects the information it needs directly.
• Organization accounts: organization name and type, members and invitations, and documents assigned to staff.

2.2 Information collected automatically

• Country (approximate location): we determine the country you are in without GPS or precise location, using only your device time zone, both on the website and in the Android app. We save the country to your community profile and use it to show posts, trends, suggestions and ads for where you are.
• Activity used for personalization: topics derived from your community searches (we store the derived topics, not the search text), posts you open, like, repost or reply to, trends you open, and directory categories and services you view. See section 4.
• Interactions: likes, reposts, follows, post views, service views, and ad views and clicks. A post view is recorded once per post for each account when the post stays on your screen for a moment, to show its total views. Ad views and clicks are recorded once per ad per day for each account, to count unique views and prevent abuse.
• Device and technical data: push notification token (Firebase Cloud Messaging) in the phone app or, if you turn on notifications on the website or the installed web app, your browser's push address and its encryption keys, the time zone and language used to send reminders on time, device type, operating system and app version, and IP addresses and request logs kept by our hosting and security providers.
• Sign-up security: when you create an account, on the website or in the Android app, Cloudflare Turnstile checks that you are not a bot, which processes technical signals from your browser or the app.

2.3 Children

NOMADO is for adults. You must be at least 18 years old to create an account or use the community. A parent or guardian may add document details for their minor children to receive reminders. We protect this data like all other data and never use it for personalization or ads. We do not knowingly collect personal data directly from children. If you believe a child has created an account, contact us and we will delete it.

3. How We Use Information

• Provide the Service: store your documents, send reminders, show checklists, run the community and the directory, and publish approved listings and ads.
• Safety and security: authenticate you, prevent spam, fraud and abuse, enforce our Terms of Service and Community Guidelines, and review reported content.
• Personalization: rank the community "For you" feed and follow suggestions by your country and inferred interests and, when Personalized feed is on, choose which approved ads are most relevant to you. You can turn this off.
• Advertising: show approved banner ads and boosted posts by page and country, give every advertiser a fair turn, count views and clicks, and give advertisers and people who boost a post their totals.
• Notifications: show in-app notifications about your account, such as likes, replies, reposts, mentions, new followers and follow requests, decisions on your ads and listings, support replies, new sign-ups with your referral code (without telling you who they are) and document reminders. On your phone, we send push notifications for document reminders and new messages, without the message text if you turn on Hide message text in notifications.
• Communication: send service messages, reply to support requests and tell you about important changes. We do not send marketing messages without your consent.
• Payments and payouts: process website subscriptions, listing fees and ad payments through Stripe, and pay referral earnings.
• Improvement: fix problems and improve features using aggregated information.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performance of our contract with you, our legitimate interests (security, moderation and improving the Service), your consent where required (for example notifications and personalization, which you can withdraw at any time), and legal obligations.

4. Personalization and Interests

We infer interest topics such as visa and residence, jobs, housing, education, health, money, travel, food, family, documents, transport, life abroad and religion from the activity described in section 2.2. We store a score for each topic linked to your account and use it to rank community posts and follow suggestions and, when Personalized feed is on, to choose which approved ads inside NOMADO to show you first. This happens inside NOMADO: we never share your interests with advertisers or other third parties, and advertisers never learn who saw their ads.

You can turn off Personalized feed and clear your interest history at any time in Settings, under Community privacy. When personalization is off, posts are ordered by your country and recency, and ads rotate evenly without using your interests.

5. The Community and What Others Can See

• The community is for signed-in NOMADO users, with one exception: posts from public accounts and the community pages of those accounts are also shown to visitors without an account, on the public community page of our website and through shared links, unless the account owner turns this off in Settings, Privacy. Visitors see each post with its photo or video, its author's display name, handle and profile photo, its country if shown and its counts, and on a community page the display name, handle, profile and cover photos, bio, country if shown, join date and counts, but never the replies. These public pages can appear in search engines such as Google, which may keep showing a copy for some time after a post is deleted, hidden or made private.
• Your community page (display name, handle, bio, profile photo, cover photo and follower counts) and your posts and replies, including their photos and videos, are visible to other users. Your country appears on your page and posts unless you turn off Show my country.
• With a private account, only followers you approve can see your posts and your follower lists.
• You choose who can reply to your posts, and you can block or mute any account. Blocked accounts cannot follow you, see your posts, reply to you or message you.
• When you repost a post, it appears on your community page and in your followers' feeds with your name, and its author is notified. You can repost your own posts, and other people cannot repost posts from private accounts.
• Each post shows its total number of views. Other users, including the author, cannot see who viewed a post, and your views of your own posts are not counted.
• Messages are visible only to you and the person you are talking to. People you do not follow can only send you a message request, and the conversation opens only if you accept it. You choose who can message you and whether people can see that you read their messages.
• Questions and solutions are public: anyone, including visitors without an account, can read them on our website, and they can appear in search engines such as Google. Each question and answer shows its author's community display name, handle and profile photo, except questions you ask without your name, which show no name or photo to anyone; our team can still see who asked when reviewing reports. If your account is private or you turned off public links in Settings, Privacy, visitors without an account see your questions and answers as from "a Nomado member". Helpful votes are shown only as totals.
• Your bookmarks are private. Only you can see the posts you saved.
• When you share a post, you send a link to it with the app you choose. If the post is from a public account that allows it, anyone with the link can open the post, and apps such as WhatsApp may show a preview with its author, text and photo. Posts from private accounts open only for people who can see them in NOMADO.
• Content you post is visible to other users, who may see, save or screenshot it. Do not post personal information you do not want others to see.
• Directory listings and job ads, including the contact details in them, are shown in the directory so that customers and applicants can reach the business or employer. Job ads are hidden after their application deadline.
• Published business listings also have a public page on our website with their name, category, description, photos, video, contact details, address, map, rating and reviews. Anyone can open these pages through a shared link without an account, and they can appear in search engines such as Google, which may keep showing a copy for some time after a listing is changed or removed. Reviews on these pages never show who wrote them.
• When you report a post, an account, a message, a listing or a job ad, we record the report (who reported, what was reported and the reason) to review it. Posts and job ads are hidden automatically after several reports while we review them.

6. Advertising

NOMADO shows banner ads from advertisers who submit a request that we review and approve, and boosted posts, which are community posts that their authors paid to show to more people in a country they choose. Boosted posts are marked as Sponsored, never shown to people who muted or blocked their author, and their views and clicks are counted in the same way. Ads are chosen first by the page you are viewing and your country. Among the eligible ads, those you have not seen yet today come first so that every advertiser gets a fair turn, and when Personalized feed is on, ads that match your interest topics get a higher chance. This selection happens inside NOMADO. Ads appear on the home and document pages, in the community feed and in the services directory, and are always marked as ads. We record ad views and clicks for each account once per day to count unique views and clicks and to rotate ads fairly, and advertisers receive only total numbers. We do not use third-party ad networks, advertising identifiers or tracking cookies. If we ever add a third-party ad network, we will update this policy and ask for your consent where required before enabling it.

7. How We Share Information

We do not sell your personal data and we do not share it for third-party advertising. We share data only in these cases:

• Service providers that process data on our behalf under contract: Supabase (database, authentication and file storage, with servers in Singapore), Google Firebase Cloud Messaging (push notifications in the phone app, which carry the reminder, or the sender name and, unless you hide it, the message text), the push service of your browser from Google, Apple, Mozilla or Microsoft (notifications on the website and the installed web app, sent encrypted so the push service cannot read them), Google Sign-In (if you use it), Cloudflare (website hosting, content delivery and Turnstile bot protection), Vercel (website hosting), Stripe (website payments and referral payouts), Resend (account and service emails), and Anthropic (processing questions you type into the AI assistant where it is available, never your document data).
• Other users, as described in section 5.
• Advertisers, who receive only the total views and clicks of their own ads.
• Listing owners, who see only daily totals of views and taps on WhatsApp, the map and the website for their own listing, counted once per person per day. They never see who viewed or tapped.
• Legal reasons: when required by law, to protect the rights, property or safety of our users or others, or as part of a merger or acquisition, in which case we will notify you.

When you choose to share a reminder or contact a business on WhatsApp, WhatsApp opens on your device with the message. We do not send your data to WhatsApp ourselves.

Listing pages in the services directory show a Google Maps map of the business address. When the map loads, Google receives your IP address and browser information under Google's own privacy policy. Opening directions or a business website takes you to Google Maps or to that website.

When you apply for a job, you contact the employer directly by email, phone, WhatsApp or the employer's website. NOMADO does not receive or store your application, and the employer is responsible for how it uses what you send.

8. International Transfers

Our providers may process data outside your country, including in Singapore and the United States. Where required, we rely on safeguards such as standard contractual clauses.

9. Data Retention

• We keep your data while your account is active.
• Content you delete, such as a document, post, photo or video, is removed from the Service right away and from backups within 90 days.
• Interest scores, post view records, ad view and click records, notifications and reports you made are deleted when you delete your account. Read notifications are deleted after 90 days. You can clear your interests at any time.
• Job ads stay in your account after their application deadline, hidden from others, until you delete them.
• Deleting a conversation removes it and its earlier messages from your list, while the other person keeps their copy. When either person deletes their account, the conversation and its messages are deleted for both.
• A copy of a reported message is kept with the report for review, and is deleted when the reporting or reported account is deleted.
• Questions and answers stay until you delete them or delete your account. Deleting a question also deletes its answers. A question or answer is hidden automatically after several reports while we review it.
• When you delete your account, your data is deleted within 30 days and purged from encrypted backups within 90 days.
• We keep records that the law requires, such as invoices and payment and payout records, for the legally required period.
• Server logs with IP addresses kept by our hosting and security providers are retained for a limited time for security.

10. Deleting Your Account and Data

You can delete your account in the Android app (Profile, Settings, Delete account) or on the website (Settings, Delete account). You can also follow the steps at nomadoapp.app/delete-account or email info@nomadoapp.app from your account email.

Deleting your account deletes your profile, documents, reminders, saved phone numbers, community page, posts, replies, likes, reposts, bookmarks, follows, messages and conversations, photos, videos, voice notes, interests, privacy settings, service listings, job ads and reviews, ad requests and banner images, questions, answers and helpful votes, support tickets and push tokens. You can also delete individual items, clear your interests or turn off personalization without deleting your account.

11. Your Rights and Choices

Depending on where you live, for example under the GDPR, the UK GDPR or US state laws such as the CCPA, you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict processing, to withdraw consent, and to complain to a data protection authority. You can do most of this directly in the app; otherwise email us and we will respond within 30 days. We do not sell personal information or share it for cross-context behavioral advertising.

Your choices include notifications (device settings, or Settings, Notifications on this device on the website), personalization and interest history, a private account, who can reply to you, who can message you, read receipts, message text in notifications, showing your country, and blocking or muting accounts.

12. Security

• Data is encrypted in transit (HTTPS/TLS) and at rest by our database provider.
• Row-level security ensures each account can access only its own private data.
• Messages are encrypted in transit and at rest, but they are not end-to-end encrypted. Our team does not look at your conversations; we review a message only when someone reports it to us.
• Business licences are stored in restricted storage that only you and our review team can open. Only media meant to be displayed, such as profile and cover photos, post photos, videos and voice notes, listing photos and videos, and ad banners, are publicly accessible by link.
• If you turn on App lock in the Android app, your phone checks your fingerprint, face or screen lock, and on Android 13 and later the app's preview is hidden in the recent apps screen. NOMADO never receives or stores biometric data.

No method of transmission or storage is completely secure, but we work to protect your data and will notify you of a breach where the law requires.

13. Cookies and Local Storage

The website, and the Android app that shows it, use essential cookies and local storage for sign-in, language and theme preferences, and Cloudflare Turnstile for security. We do not use advertising or tracking cookies.

14. Changes to This Policy

We will post any update on this page and change the date above. For significant changes we will notify you in the app or by email at least 14 days before they take effect.