1. Service and privacy contact
Nibble is a development component service available at https://nibble.lat. For questions about personal data, rights requests, or privacy incidents, contact galavic@nibble.lat.
This notice covers the website, accounts, favorites and folders, Pro and MCP services, Studio, and its CLI connection. External websites and tools may have their own notices, which this document does not replace.
2. Account and profile information
To create and maintain accounts, we process email addresses, user identifiers, creation dates, and the information necessary to verify access and maintain sessions. If you complete your profile, we also process your display name, selected avatar variant, and theme preference.
Nibble avatars use generated application illustrations; selecting one does not require uploading a photograph. We do not ordinarily request health information, biometric data, political views, religious beliefs, or other sensitive categories. Do not include such information in folder names, example code, queries, or publications.
Email sign-in uses temporary codes managed through Supabase Auth and delivered through the configured email service. Keep codes and sessions confidential. If an external sign-in provider is enabled, the relevant information and permissions must be explained in that flow and reflected in this notice before the corresponding processing begins.
3. Favorites, folders, and preferences
Saving components and creating, renaming, or deleting folders requires an account. The database stores the account identifier, saved component identifiers, folder names and identifiers, their organization, and the revision and update information needed to synchronize changes.
Your collection belongs to your account and is not made public by using these features. It is retrieved when you sign in, reload, or return to the tab, and updated when an operation is confirmed. These features do not publish folders or promise instantaneous synchronization across every device.
In this implementation, favorites, folders, and persistent theme preferences are not stored as an application collection copy in browser localStorage. The visible page state is held temporarily in memory. Account theme preferences are stored in profile data. A visitor without an account may change the theme for the current page session without permanently saving that preference.
Browser-only records from older versions are not automatically assigned or transferred to whichever account signs in, because their owner cannot be reliably established. Those old records may remain until removed through browser controls.
4. Subscriptions and payments
To manage Pro, we process Stripe customer and subscription identifiers, subscription status, period-end dates, renewal cancellation information, and billing event references. Starting a purchase shares the necessary information with Stripe, including your account email and internal references connecting the payment to your account.
Payment method information is entered in the payment processor's environment. Nibble's own application forms do not collect complete card numbers or card security codes. Stripe and financial institutions may process payment, billing, and fraud-prevention information for their services and legal obligations.
Refunds and payment questions may require an account email, receipt reference, and case details. Do not send complete card information to support. Payment documents and information needed for tax obligations or disputes may be retained after account closure when legally justified.
5. Studio and publisher content
For authorized publishers, we process account identifiers, permission-related email addresses, permission grants or removals, components, code, styles, preview properties, metadata, and update dates. This supports drafts, versions, publication, attribution, and complaints.
Saving a draft does not publish it to the catalog. Its author and authorized administrators may access what is necessary to operate Studio, administer content, provide support, or address security and rights complaints. Do not include passwords, private keys, client data, or third-party information without a sufficient basis.
When you publish, code and resources intended for distribution, the component name, description, and creator attribution may be viewed and downloaded by others. Attribution includes your display name, avatar, and identifiers needed to present the creator. Publishing does not by itself disclose your sign-in email as attribution.
Later withdrawal prevents future availability through the relevant Nibble distribution mechanisms, but cannot retrieve copies already obtained by others, screenshots, or files beyond our control. Decide carefully what information you make public.
6. MCP keys, CLI sessions, and agents
For MCP keys, we store their name, identifier, prefix, a cryptographic hash, and relevant dates, including revocation. The complete secret is supplied when created so you can configure your tool; it is not stored as readable text in the application's key record.
Connecting the Studio CLI uses temporary authorization, technical information to return authorization to the correct computer, and an account-linked session. The server stores code or token hashes and necessary creation, expiration, and revocation information. Connection authorization expires after five minutes and a CLI session lasts 30 days unless earlier revoked or restricted. Expiration of access does not mean immediate deletion of every technical record.
The CLI stores its session credential on your computer to perform authorized operations. Verification screenshots and reports are written to the output directory used for those checks. This CLI storage is separate from storing the website's favorites and folders in the database. Control access to your device and those files.
An external agent may receive the code, examples, results, and credentials that you configure or share. Its provider may process information under its relationship with you. Review permissions and conditions before sending confidential information to an agent.
7. Technical information, logs, and external resources
Infrastructure requests may involve IP addresses, timestamps, browser and device information, requested routes, response statuses, and security information. Hosting, authentication, and payment providers may generate logs necessary to operate and protect their services. Absence of a dedicated analytics tool does not mean no technical records exist.
Components may display third-party images, media, or fonts. Downloading those resources can disclose the technical information inherent in a browser request to their origin servers. Preview restrictions do not necessarily prevent every permitted external media request. Publishers should review the resources they use.
Shared component configurations appear in URLs. Recipients, history, link preview systems, and technical logs may see those parameters. Do not include credentials, private information, or sensitive content in shared links.
8. Necessary purposes
We use information to verify access, maintain accounts and sessions, save collections and preferences, manage permissions, support publications and downloads, process payments and cancellations, control Pro and MCP access, answer inquiries and complaints, fix issues, prevent abuse, and meet legal obligations.
Processing must rely on the appropriate legal basis in each case: the requested service, legal obligations, consent where required, or another valid basis. Accepting the Terms and Conditions is not indiscriminate authorization for incompatible purposes.
If you do not supply information necessary for a function, that function may be unavailable. Public catalog browsing does not require an account unless you request an account-dependent feature.
9. Optional purposes and automated checks
The reviewed implementation does not include selling personal data, advertising profiles, or subscribing users to newsletters merely because they create an account. Optional processing requiring consent will not be activated without appropriate information and a valid choice.
If personalized advertising, non-essential analytics, or marketing is introduced, this notice will be updated and required controls will be available before activation. Rejecting an optional purpose will not block features that do not depend on it.
The application automatically checks payment, authentication, and permission status to determine feature access. If a restriction appears incorrect, you may request review through privacy or support contact. These technical checks are not presented as decisions about employment, credit, or comparable rights.
10. Providers and data disclosures
Supabase provides authentication, profiles, database services, collections, permissions, and storage for publications and session records.
Stripe provides Checkout, subscriptions, the payment portal, and events needed to reflect payment status.
Brevo delivers authentication messages and operational emails that are legitimately configured.
Vercel hosts and delivers the website and processes requests and technical records according to service configuration.
Zoho Mail operates Nibble's contact mailbox and handles information voluntarily sent to that address.
Only information relevant to a provider's function should be supplied. A provider may act as a processor for Nibble or process some information for its own obligations and legitimate purposes. A technical description alone does not determine its legal role.
Information may also be disclosed to meet a legal obligation or valid request, handle a claim, or defend rights within legal limits. Filing a complaint does not automatically entitle someone to all another user's account information. Voluntary component publication makes the information described in section 5 public.
11. Location and international processing
Infrastructure and external services may involve processing or access from countries different from the user's location. We do not promise exclusive storage in Mexico or any particular region without verifying the effective configuration and relevant agreements.
Where required, Nibble must use appropriate safeguards, commitments, and mechanisms for international processing or transfers, distinguish recipients' roles, and obtain necessary consent. General acceptance of the website is not a substitute for legally required consent. Contact us for questions about recipients or processing locations.
12. Cookies and device storage
The website uses technical session mechanisms, including authentication cookies, to recognize accounts and maintain access. Browsers also use execution memory and may cache resources as part of their operation. Disabling necessary mechanisms may prevent sign-in or interrupt authenticated functions.
Favorites and folders are stored in the database rather than persisted by the application in localStorage. Clearing browser data does not itself delete an account's collection or cancel a subscription. Account-data deletion requests follow section 14.
The reviewed code does not identify dedicated advertising or commercial analytics integrations. Before optional mechanisms are activated, their purposes must be documented and legally required choices provided. A mechanism will not be classified as necessary merely to avoid obtaining consent.
13. Retention and deletion
Account information, collections, and publications are retained while needed for the requested function, user relationship, and applicable obligations. Account closure or an erasure request triggers a review of what should be deleted and what must be retained for legal periods, fraud prevention, claims, or justified technical retention.
Legally retained or restricted information must be used only for the corresponding purpose. A generic retention rationale does not authorize indefinite storage or unrelated uses. Logs and backups may follow different cycles from operational data, with appropriate safeguards and restrictions until deletion.
Signing out, revoking a key, canceling Pro, and deleting an account are separate operations. Deleting an account also cannot automatically remove public copies downloaded by others. We will explain a request's effects and limitations when handling it.
14. Your rights and how to request them
You may request access, correction, cancellation or erasure, and objection in accordance with applicable law. Where applicable, you may also request portability, restriction, consent withdrawal, or other legally recognized rights. These rights differ in effect and do not apply absolutely to every record.
Send requests to galavic@nibble.lat, preferably with the subject “Privacy — rights request.” Include your account email, the right requested, sufficient details about the information or circumstances, and a response method. A representative may be asked for appropriate evidence of authority.
Identity will be checked proportionately before information is disclosed or changed. Do not send complete identity documents, payment information, or keys unless their necessity is explained and an appropriate channel provided. Where possible, we will use a verified account or a less intrusive verification method.
We will communicate the outcome and implement applicable rights within legal deadlines. Under the Mexican ARCO framework, the determination is generally communicated within a maximum of 20 days from receipt and, if granted, implemented within 15 days after the response, subject to legally justified extensions that are communicated. Any applicable shorter deadline will be respected.
You do not need to waive claims, buy a plan, or pay merely to submit a rights request. Exceptional reproduction or delivery costs must be lawful, justified, and disclosed. If a request is denied in whole or part, the reason and applicable review or complaint routes will be explained.
15. Limiting use, communications, and consent
Available controls allow profile and preference changes and revocation of keys or sessions. You can request limits on use or disclosure by email. Withdrawing consent does not retroactively invalidate lawful earlier processing or prevent legally required retention.
Messages necessary for authentication, security, charges, renewals, cancellations, and responding to a request differ from promotional newsletters. Optional marketing, if enabled, will provide appropriate unsubscribe controls.
Requests to delete content remain subject to third-party rights, retention obligations, and public copies outside our control. We will explain these distinctions when handling your request.
16. Security and incidents
Technical controls include authentication, account-specific permissions, restricted data access, and operation validation. User-published previews run with isolation from the website session. These controls reduce risk but do not guarantee that incidents are impossible.
If an incident is detected, we will investigate its scope, take containment measures, and provide legally required notifications to affected people or authorities. You can report an exposure to the contact email without publicly disclosing another person's information or secrets as proof.
Protect your device, sign-in email, and connected tools. These recommendations do not transfer Nibble's own security obligations to you.
17. Children and age requirements
Accounts, subscriptions, and publication are intended for people aged 18 or older under the Terms and Conditions. We do not deliberately request children's information to create accounts under that policy.
If we discover information relating to someone who does not meet that requirement, we will review the circumstances, identity, and applicable obligations before restricting or deleting it. A parent or guardian may contact privacy support to report a case. This does not exclude special legal protections for children.
18. Changes and effective date
The current notice is available through an identifiable service link. Changes will include a date and version. Material changes to information, purposes, or recipients will be communicated by appropriate means before they apply when legally required.
A purpose requiring consent will not be expanded merely by editing this text or treating continued browsing as automatic consent. You can request earlier versions or ask about changes through the privacy contact.
Version 1.0. Effective November 5, 2026. Privacy contact: galavic@nibble.lat.