Privacy and security

Where Nisaba runs

Nisaba runs on servers in Germany. The server is hosted by Hetzner in Falkenstein.

The privacy policy names every provider, for example for payments, e-mail and AI. What the AI providers receive is explained in AI and your data.

We do not sell personal data and we do not use your content for advertising.

Usage measurement only with your consent. You can change your choice at any time with Cookie settings in the website footer or in Settings → Account.

Backups

The server is backed up every night, and Hetzner keeps the last seven daily backups of the whole server. In addition, the database and the uploaded files are backed up every night. These backups stay on the server for 14 days, and an encrypted copy is kept for 30 days with Cloudflare R2 in the EU. The copy is encrypted before it leaves our server, so Cloudflare cannot read its content.

Deleted data can therefore remain in backups for up to about one month. After that, the backups are deleted automatically. If the off-site copy fails, we keep the backups on the server for up to about six weeks.

How your data is protected

• The connection between your browser and Nisaba is encrypted with TLS.
• Passwords and access tokens are stored only as hashes.
• Your library is visible only to your account unless you share a workspace publicly.
• No system is perfectly secure. If personal data is breached, we report it where the law requires.

Protect your account

• Turn on two-factor sign-in under Settings → Security.
• You stay signed in on a device for up to 7 days. If you lost a device or shared your password, choose Sign out everywhere under Settings → Security.
• When you change your password, Sign out my other devices is on by default.

Delete your account

Delete your account and your data from the settings.

1. 1If you want a copy, export your data first.
2. 2Open Settings, then Data & export, and choose Delete account….
3. 3Enter your current password. If two-factor sign-in is on, also enter a code from your app or a recovery code.
4. 4Type your email to confirm, then choose Delete my account permanently.

This deletes every bookmark, tag, note, highlight and saved page copy, and your workspaces, rules, feeds, access tokens and settings. Public workspace links stop working immediately. It cannot be undone. Deleted data can remain in backups for up to about one month, or up to about six weeks if the off-site copy fails.