Privacy Policy
Effective date: 18 September 2026 · Updated 9 October 2026
Who we are
Nhoma (“Nhoma”, “we”, “us”) is operated by Waripixel, established in Arlington, Texas, United States. Waripixel runs nhoma.app, a service for writing simple agreements, sending them to another person, and signing them. For anything in this policy, contact us at privacy@nhoma.app. Waripixel is the data controller for the personal data described below.
The short version. Your documents live in your device's own storage plus our database so the other party can open them. We set no advertising or tracking cookies, run no analytics, and never sell data. We share data only with the service providers needed to host the app, deliver email, process payments, and run the optional AI features.
Data we process
Documents and parties
- Agreement content you write or generate: terms, amounts, item lists, milestones, and every saved version of them.
- Party details: the sender's name and email, and the recipient's email address or phone number, entered so the document can be delivered and signed.
- Signatures: the drawn signature itself, the document version it binds to, the time of signing, the exact consent sentence the signer ticked, and a signing-context record containing the browser's user-agent string, the network (IP) address the signature was submitted from, and an approximate location (country, region, city) derived from it. This record exists to make a signature attributable and verifiable later, and is kept as part of the signed record.
- Document activity log: when a document is created, sent, opened, and signed, together with the time, the network (IP) address, the browser's user-agent string, and the country each of those actions came from. This is the audit trail behind a signed agreement.
- ID fingerprint (optional): if a signer chooses to link an ID document, only a SHA-256 fingerprint (hash) computed on the signer's device is stored — the ID image itself never leaves the device and is never uploaded.
- Identity check (when the sender requires it): the sender of a document can require the signer to pass an identity verification (a government ID plus a selfie face-match) before signing. The check itself runs on the verification provider's own pages (Didit — see the processor table below); Nhoma stores only the session reference, the outcome (approved or not), and the full name as read from the verified ID, which becomes part of the signature record. The ID images, the selfie, and the other data extracted from the document stay with the verification provider and never reach Nhoma's servers.
Uploads and AI inputs
- Photos and attachments you add to a document (milestone proof, receipts, item photos, files) are stored in our file storage.
- Voice recordings made in the builder are transcribed by AI and used to draft your document; photos submitted for extraction are analysed to suggest document content.
Payments
Payments are handled entirely by our payment providers (Stripe or Polar) on their own hosted checkout pages. We never see or store card numbers. We store the transaction reference, the product purchased, the resulting entitlement token, and the email address you used at checkout — the latter so a purchased pass can be recovered by mailing it back to the address that paid for it, and nowhere else.
Email log
When you send a document by email, we record the recipient address, the time, and the delivery reference. This log enforces sending quotas and prevents abuse of the email feature. Addresses that hard-bounce or mark our mail as spam are placed on a suppression list and are not written to again. If a signer chooses to verify their email before signing, we store a short-lived hash of the verification code and, in the signature record, whether verification succeeded.
Support messages
When you write to us through the form on the support page, we store what you send: the situation you picked, your email address so we can reply, your name if you give one, the document link or checkout address you supply, and your message. We also record the country the message came from and a salted hash of your IP address — not the address itself — which exists only to count how many messages come from one source in an hour and cannot be used to identify you. The message is stored before it is emailed to us, so that a delivery failure loses your message rather than hiding it.
Document access by email
To list the documents that name your email address (My Documents) we send a 6-digit code to that address and keep only a hash of it, for 10 minutes. Once you enter it, a random session token is stored as a hash on our side for 30 days or until you sign out, together with the address it stands for. You may attach further addresses of yours by confirming a code sent to each; we store the addresses and when they were attached, and we write to every attached address whenever one is added, removed or made the main one. If you ask us to link an address you can no longer read to one you can, we keep the request — both addresses, what you told us, what our records confirmed, the connection it was sent from, and our decision — as the record of that decision, and we write to both addresses when a link is made.
Technical data
Like every website, our infrastructure processes IP addresses and request metadata to serve pages, prevent abuse, and keep operational logs. These logs are used for security and reliability only.
Bot protection (Cloudflare Turnstile)
Certain actions — saving or sending a document, and the AI features — are protected against bots by Cloudflare Turnstile. The check runs invisibly in the background: there is normally nothing to click and no puzzle to solve, so you will usually not see it at all. To tell people and bots apart, Turnstile evaluates technical signals from your browser, including your IP address, TLS fingerprint, user-agent and similar browser characteristics, and our site key and page origin. Cloudflare processes these signals on our behalf to protect the service, states that it cannot directly identify individuals from them, and may also use them as an independent controller to improve its bot-detection. Details are in the Cloudflare Turnstile Privacy Policy and Cloudflare's Privacy Policy.
Purposes and legal bases
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Creating, delivering, and signing agreements | Document content, party details, signatures | Performance of a contract, Art. 6(1)(b) |
| AI drafting, transcription, and photo extraction | Your text, voice recordings, photos | Performance of a contract, Art. 6(1)(b) |
| Payments and entitlements | Transaction references, email | Performance of a contract, Art. 6(1)(b) |
| Abuse prevention, security, quotas | IP address, user-agent, email log | Legitimate interests, Art. 6(1)(f) |
| Signature verifiability | Signing-context record | Legitimate interests, Art. 6(1)(f) |
| Identity verification required by the sender | Verification outcome, verified name | Performance of a contract, Art. 6(1)(b) |
| Optional analytics (currently none running) | — | Consent, Art. 6(1)(a) — off unless you opt in |
Service providers (processors)
| Provider | What it does | Data it touches |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, AI models (transcription, drafting, search), Turnstile invisible bot-check | All service data; IP addresses and browser signals (TLS fingerprint, user-agent) for Turnstile |
| OpenAI, L.L.C. | AI drafting and photo-content extraction in the builder | Text you submit for drafting; photo-derived content. Not used to train OpenAI's models under its API terms |
| Amazon Web Services, Inc. (SES) | Delivers the emails you send from Nhoma | Recipient address, email content with document links, delivery outcomes (bounces, complaints) |
| Resend, Inc. | Backup email delivery when the primary channel is unavailable | Recipient address, email content with document links |
| Stripe, Inc. | Payment processing (hosted checkout) | Payment and billing details, handled under Stripe's own privacy policy |
| Polar Software Inc. | Alternative payment processing (hosted checkout) | Payment and billing details, handled under Polar's own privacy policy |
| Didit (Didit ID, Inc.) | Identity verification when the sender requires it, on Didit's own hosted pages | The signer's ID document, selfie, and extracted identity data, handled under Didit's own privacy policy; Nhoma receives only the outcome and the verified name |
Fonts and styling are served from our own domain — no font or CDN provider sees your visits.
Some providers are based in the United States. Where personal data leaves the EEA/UK, transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses maintained by each provider.
Cookies and on-device storage
Nhoma sets no advertising, analytics, or tracking cookies. We set two cookies ourselves: iw_cc, which stores your consent choice (kept for 6 months), and nh_access, set only after you confirm a code sent to your email address on My Documents — it keeps you signed in there for 30 days or until you sign out, is HttpOnly, and is strictly necessary for that page. Cloudflare Turnstile, our invisible bot-check, may set its own strictly necessary cookies while it verifies you are human (see Cloudflare's Cookie Policy). You can review or change your choices any time via Cookie settings in the footer, or by clearing your browser data.
The app keeps working data in your browser's localStorage (on your device, never sent to us as such):
- Document vault — the list of documents created on your device and the keys that open them. Clearing it makes those links unrecoverable, so keep a backup.
- Entitlements — your Premium Pass token or unlock code.
- Preferences — language, signature ink style, currency, country override, guide and tip states, saved wizard templates.
- Caches — exchange rates and per-document send/keep flags.
- Signing device ID (
iw_device) — a random identifier created on the signing page, and the one item on this list that is sent to us. When a signing link arrives by email, the first browser to open it is remembered by a one-way hash of this identifier, so that browser can sign without an extra code while a forwarded copy opened elsewhere is asked to confirm the signer's email. We store only the hash, with that document; it is not linked to anything else and is never used to follow you between sites or documents.
All of this is functional storage the service needs to work; none of it is used for tracking.
Retention and deletion
- Documents, versions, signatures, and attachments are kept for as long as the document exists, because a signed agreement must stay verifiable for both parties.
- Deleting a document yourself: the owner can delete a draft, declined, or withdrawn document directly from its page — this erases its content, history, photos, and activity log, and scrubs the addresses from its email log. A sealed (fully signed) agreement is both parties' record and cannot be deleted unilaterally; write to us and we will weigh both parties' interests.
- Recipient details entered by a sender: if someone entered your email address or phone number into a document and you want it removed, contact privacy@nhoma.app — for an unsigned document we remove it; for a signed one we retain only what the integrity of the record requires.
- Email logs and purchase records are kept as long as needed for quota enforcement, accounting, and dispute handling.
- Support messages are kept while we answer them and for as long as the matter they concern may come back; ask us to delete yours once it is settled and we will.
- Access codes, sessions and recovery requests: codes are discarded within a day, sessions expire after 30 days or on sign-out, and a request to link a lost address is kept as the record of our decision.
- Security logs are short-lived and rotate automatically.
Your rights
Under the GDPR (and similar laws such as the UK GDPR and CCPA) you can ask us for access to your data, rectification, erasure, restriction of processing, portability, and you can object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time. Write to privacy@nhoma.app. You also have the right to complain to your local data-protection authority, and — in California — we neither sell nor share personal information, and we do not discriminate against anyone who exercises a privacy right.
How long we take. We answer within one month of receiving a request. Where a request is complex, or where you have made several, we may extend that by a further two months; if we do, we will tell you within the first month and explain why. If we decide not to act on a request, we will say so within the same month, give our reasons, and tell you how to complain to a supervisory authority or seek a judicial remedy.
How we identify you — and why we sometimes cannot. Nhoma has no accounts, so an email address on its own proves nothing and unlocks nothing. Our records are organised by document, not by person: we have no way to search for “everything about a human being” and no way to tell, from a message alone, whether the sender is the person whose details appear in a document or somebody who would like to read it. To act on a request we therefore need enough to locate the data and to be satisfied it is yours — normally the document's link or its recovery code together with the email address saved on it. Where the information you give us is not enough to identify you in our records, data-protection law does not require us to acquire more data solely to find you, and the rights of access, rectification, erasure, restriction and portability do not apply until you provide what identification needs (GDPR Art. 11(2) and Art. 12(6)). We will always tell you what is missing, and we will never hand a document's contents to somebody who cannot show they hold its keys — that restraint protects you as much as it constrains us.
Requests that are unfounded or excessive. Answering is free. If a request is manifestly unfounded or excessive — in particular because it repeats one we have already answered — we may charge a reasonable fee reflecting our costs, or decline it, and we will explain which and why (Art. 12(5)).
Content is chosen by the person who wrote it. Where a document names you because somebody else entered your details, that person decided what it says; we provide the tool and cannot alter another person's agreement on request. We will act on what is ours to act on — removing your address from an unsigned document, stopping email to you, correcting our own records — and for the wording of the document itself, the sender is who you need.
Note that erasing a document that another person has signed affects their copy too; where both parties' interests conflict, we may retain the minimum needed to preserve the integrity of a concluded agreement.
No automated decisions. We make no decisions about you by automated means that produce legal effects or similarly significantly affect you. The AI features draft and suggest; the people using the service decide (Art. 22).
Security and breaches
Data is held on Cloudflare's infrastructure, reached over encrypted connections, and a document is readable only to someone holding one of its capability links. Nobody at Waripixel browses documents as a matter of course, and we do not have a support tool that opens one on request — see Your rights for what that means in practice.
No service is immune. If a personal-data breach occurs, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. Where a breach is likely to result in a high risk to you, we will tell you directly and without undue delay, describing what happened and what you can do about it (Arts. 33–34).
Children
Nhoma is not directed at children and is not intended for use by anyone under 16. We do not knowingly collect data from children.
Changes to this policy
We will post any changes on this page and update the effective date above. Material changes will be highlighted in the app.