Privacy Policy | Night Fox AI

Night Fox Digital, LLC makes and runs Night Fox: the app at app.nightfox.ai, its phone apps once they’re released, and this website, nightfox.ai. This policy explains what Night Fox holds about people, why, who else handles it, how long it’s kept and how to have it deleted. In it, “we” and “us” mean Night Fox Digital, LLC.

We don’t sell personal information. Night Fox has no advertising or analytics tools, so no other company tracks you through it.

Who We Are

Night Fox Digital, LLC is a marketing agency for small service businesses, at nightfox.io. Night Fox is the app our clients use to answer their leads and keep their websites up to date. We set up every account in person.

Email: help@nightfox.ai
Mail: 7901 4th St N Ste 300, St. Petersburg, FL 33702

Night Fox holds two kinds of information:

About the people who sign in: our clients’ owners and their teams, and our own staff. We decide how it’s used. What We Collect and Why covers it.
What our clients’ customers send them, such as a form sent from a client’s website. The client business is in charge of it, and we handle it for them. Data We Handle for Our Clients covers it.

What We Collect and Why

Your email address and name. We use them to sign you in, to show your team who did what, and to email you.
A profile photo, if you add one.
A mobile phone number, if you add one. Only you and our staff see it, and we don’t text it.
About You, a note in your own words, if you write one. It’s shown only to you.
The accounts you belong to, your role in each, what you can open, and how you want to hear about new leads.
If you were invited: your email address, the role you were offered, who invited you and when. The link in the invitation works for 7 days.

Everyone who shares an account with you can see your name, photo, role and email address, when you joined and when you last used Night Fox. Our staff can see every login and download the list.

Signing In and Staying Secure

Email codes. When someone asks for a code, we keep the email address, a scrambled copy of the code, the time, the tries and the IP address the request came from. We do this even when the address has no login, and email it a note saying so. That way the sign-in page never shows who has a login. These records stop people guessing codes or flooding an inbox. A code works for 10 minutes, and we clear the IP address after a year.
Passkeys. Your device keeps the passkey’s secret part. We keep its public part, which password manager holds it (such as iCloud Keychain), the device it was made on and when it was used. Removing a passkey stops it at once.
Devices. For each device you sign in on, we keep what it is (such as an iPhone or a Mac), the browser or app, when it was last used and the city it was last used from. Cloudflare works out the city from the device’s IP address; we don’t keep that address with the device. You see your devices in Settings › Sign-In & Security. The owners of your accounts see when you signed in, on what device and from what city. Our staff see your sign-ins and devices too, and can sign a device out.
Sessions. Signing in gives your device a random key. We keep only a scrambled copy of it, with when it was made and last used. A session ends when you sign out, and expires after 30 days without use.
Face ID, fingerprints and your app PIN stay on your device. We never receive your face, fingerprint or PIN. A browser keeps only a scrambled copy of your PIN.

What You Do in an Account

Every change is recorded with who made it, when and from what IP address. Most entries also keep what changed, before and after: for example your old and new name, email or phone number, or a record’s old and new words. Changes to leads are recorded without the lead’s details. We clear the IP addresses after a year.

The account’s owners see its history without IP addresses or phone numbers. Our staff see all of it. The history shows a business who did what, and helps us look into problems and misuse.

On Your Device

On the web, Night Fox sets two cookies, and only Night Fox’s own address receives them. Neither is ever sent to other websites, and both last up to 30 days and are deleted when you sign out.
- nf_session keeps you signed in. Scripts on the page can’t read it.
- nf_login is a random mark, made new each time someone signs in on that browser, with nothing about you in it. Night Fox’s other open tabs in the same browser read it to notice that someone signed in or out, so a tab never acts as the wrong person.
Your browser’s storage also keeps the account you last opened, your first name and email for the Unlock screen, a scrambled copy of your app PIN, if you set one, with the tries left, and a layout choice. Until you close the tab, it also notes that you’ve unlocked the app.
The phone apps keep your sign-in, PIN and name in the phone’s secure storage instead of a cookie.
Signing out on a device clears your sign-in, your PIN, and your name and email from it.

When Something Goes Wrong

If Night Fox hits an error, we record what failed and where. Before we save the message, we take out email addresses, long numbers and quoted text. Only our staff read this log.

When You Write to Us

Messages to help@nightfox.ai stay in our email, which Google Workspace runs, so we can help you and keep a record.

When You Visit nightfox.ai

These pages set no cookies and run no analytics, ads or other tracking. Cloudflare, which delivers them, receives your IP address and browser details with each visit, as any web host does.

Data We Handle for Our Clients

Our clients are businesses. What their customers send them through Night Fox belongs to the business: it’s in charge of it, and we handle it for them. If you sent a form to a business, that business decides how what you sent is used. To see it or have it erased, ask the business or write to us, as Your Choices and Access explains.

Forms Sent From a Client’s Website

When you send a form or book on a client’s website, the website passes it to Night Fox. Night Fox keeps:

What you typed: your name, email, phone, ZIP code, the service you asked about, your message and your other answers.
Photos and files you attached, stored privately. Photos lose their location and camera details as they arrive.
The page you sent it from, and when.
How you found the site, on your first and latest visits: the page you landed on, the site that sent you, campaign tags, and the click IDs that Google, Microsoft and Facebook add to links.
The spam check’s result, explained below.

Night Fox doesn’t keep your IP address or browser details with a form.

Some forms aren’t about a sale, such as job applications. Night Fox keeps them the same way, and emails every answer to the people on the business’s team it picks.

What the business does with it in Night Fox:

Its team sees your form, follows it up, and notes calls, texts, emails and what was said.
The people it picks get an email alert with your name, contact details, what you asked about and your message. They can include addresses outside Night Fox, such as a shared inbox.
If it turns one on, you get an automatic reply in the business’s own words, from the business’s email address.
Night Fox recognizes when you write to the same business again, by your phone number or email address.
It sees which pages, websites and ads bring it customers.
People on its team who can open its leads can download them as a spreadsheet.

The Spam Check

Before a form reaches Night Fox, a spam check on the business’s website looks at it. We run this check for our clients. It:

uses Google reCAPTCHA, which sets a cookie in your browser and receives your IP address and details about your browser, to tell people from bots
checks that your phone number and email address look real and, on websites that turn it on, asks Kickbox, an email-checking service, whether the address can receive mail
limits how many forms one network can send
asks Claude, an AI model made by Anthropic, to read what you typed and judge whether it’s a real request or a sales pitch

Night Fox keeps the result with your form, including Claude’s one-sentence reason. The website also keeps its own copy of your form, with your IP address and browser details, for 30 days.

Records, Photos and Files

A business can keep its own records in Night Fox, such as its customers, jobs, testimonials and team, with photos and files. It decides what goes in, who on its team sees it and what’s published on its websites. Fields marked Owners Only are seen only by its owners and our staff, and are never published. Night Fox also holds the business’s own details, such as its locations, hours and phone numbers.

Night Fox takes the location and camera details out of every photo when it’s uploaded: a business’s photos, profile photos and photos sent with forms. So a published photo doesn’t show where it was taken.

What the Business Decides, and What We Decide

The business decides who on its team sees what, who hears about new leads, whether an automatic reply goes and what it says, what its forms ask and what its websites publish.

We decide some things the same way for every business: how long forms are kept, how a person’s details are erased, how spam is checked, and which companies help us run Night Fox.

We use a client’s information only to run Night Fox for that client and to do the work it hired us for.

Our Staff’s Access

Our staff can open any client account to set it up and support it, and can act as one of its people to see what they see. Each visit is recorded. The account’s owners see every visit in Settings › Night Fox Access, with how long it lasted and how many changes it made. Our staff can also see an account’s people, sign-ins and history from Night Fox’s own admin pages without opening the account, and those views aren’t listed as visits.

Health Information

Night Fox isn’t built to hold health records, and we don’t sign HIPAA business associate agreements. Please don’t send medical details through a form handled by Night Fox.

Google User Data

Connecting Google to Night Fox is coming. This section says what Night Fox will do with information from Google, so a business knows before it connects.

A business gives our Google account access to its Google Ads, Google Analytics, Search Console and Business Profile, the way it would for any marketing agency. No one signs in to Night Fox with Google.

What Night Fox Will Read, and Why

Google Ads: spending, clicks and results by campaign, to show what the business’s ads cost and bring in.
Google Analytics: visits to the business’s website, to show its traffic.
Search Console: the searches its website shows up for, and how often it was seen and clicked.
Business Profile: its reviews, with each reviewer’s name and words, and how many people called or asked for directions, to show its reputation and help it reply. When the business asks, Night Fox will post its replies.

What We Won’t Do

Use it for anything but the business’s own reports and the work it asks for in its own Google accounts.
Sell it, use it to aim ads at people, such as retargeting, or use it to decide whether anyone gets credit or a loan.
Send it to any AI model, or use it to train one.
Let our staff read it, except to do the business’s marketing work, which the business agrees to when it connects, or for security or the law.
Share it with anyone but the companies that run Night Fox for us, listed in Who We Share It With.

How Long It’s Kept

Night Fox will keep Business Profile content, such as reviews, for 30 days at most before reading it again from Google, as Google requires.

When a business removes our access, its own figures, such as ad spending, clicks and website visits, will stay in Night Fox as its history. Reviews and anything else that names people will be deleted within 30 days, as will the rest of its Business Profile content.

How to Disconnect

The business can remove our access in its Google accounts at any time, or ask us to. Night Fox then stops reading.

Night Fox’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Data From Meta and Apple

These connections are coming too.

Apple

Night Fox will keep each business’s Apple Maps listing up to date through Apple Business, sending the business’s own details, such as its address, hours and phone number. This is about the business, not about people.

How Night Fox Uses AI

The spam check. Claude, an AI model made by Anthropic, reads the forms sent from our clients’ websites, with everything typed in them, to judge whether each is a real request. Anthropic does this for us under its terms for business customers.
A tool for our staff. Our staff use Claude in their work. In Night Fox it can list client accounts and draft changes to how a business’s records are set up, for staff to review. Its commands don’t read forms or people’s details.
AI Checks. Night Fox asks AI assistants, such as ChatGPT, Gemini, Perplexity and Claude, the questions a business’s customers might ask, to see whether their answers name the business. Claude Sonnet 5.5, made by Anthropic, grades each answer for the business. The answers are the assistants’ public replies, and no personal information is sent.

No information from a business’s own Google or Meta accounts goes to any AI model, and Night Fox uses no other AI on personal information. We’ll update this policy before either changes.

These companies help us run Night Fox. Each handles personal information for us, only for the job shown:

Company	What it does for us	What it receives
Cloudflare	Runs the app and nightfox.ai, and stores photos and files	What Night Fox sends and receives, with your IP address
Neon	Hosts Night Fox’s database, in the United States	What Night Fox stores
Postmark	Sends Night Fox’s emails	Each email: who it’s to, its subject and its words
Google Workspace	Runs our own email, including help@nightfox.ai	What you write to us
Google reCAPTCHA	Tells people from bots on client websites’ forms	The visitor’s IP address and browser details
Anthropic	Judges forms for spam, and helps our staff	Forms sent from client websites, and what staff show it
Kickbox	Checks whether an email address can receive mail, on websites that turn it on	The email address

Each of them processes it under its data protection terms with us, and must protect it at least as well as this policy does.

We also pass information:

to the business it belongs to, and the people and places it chooses: its team, the addresses it adds for lead alerts, and the websites and web addresses its published content goes to
to Google, Meta and Apple when a business connects them: the replies it asks us to post, and its listing details
when the law requires it, such as a court order, or to protect someone from harm or fraud

How Long We Keep It

Information	How long
Your login and profile, with your photo	Until you delete your login, then 30 more days
Your devices, sessions and passkeys	Until 30 days after your login is deleted, even after they stop working
Invitations	No end date. A deleted login’s address is cleared from them after 30 days
Records of email codes, with the IP address that asked	No end date. IP addresses are cleared after a year, and a deleted login’s address after 30 days
Each account’s history of changes, with what changed and IP addresses	No end date. IP addresses are cleared after a year. The app shows the last year
Records of our staff’s visits to accounts	No end date
Our log of emails sent: who to, the subject and whether it arrived, not the message	No end date. Addresses and subjects are cleared after a year, and a deleted login’s address after 30 days
Postmark’s copies of the emails it sends for us, with their words	45 days
Our error log	No end date
Forms sent from client websites, with their photos and files, and the alerts and replies they set off	No end date, unless a person’s details are erased
A client website’s own copy of each form, with the sender’s IP address and browser details	30 days
A business’s records, photos and files	Until deleted, then 30 days in Recently Deleted. Each record keeps its earlier versions until then, the last 50 by default
Copies of published content sent to a business’s other systems	30 days after they’re sent
A closed account	Until the business asks us in writing to delete it
Backup copies	Up to 30 days
Messages to help@nightfox.ai	In our email until we delete them

We keep forms and each account’s history with no end date, so a business always has a true record of its leads and of who did what. A person can still have their details erased, as Deleting Your Data explains.

Your Choices and Access

Your details: see and change your name, photo, email, mobile phone and About You in Settings › Profile and Devices. A new email address gets a code first, and we tell your old address it changed.
Your devices: see where you’re signed in, sign devices out and remove passkeys in Settings › Sign-In & Security.
Your alerts: an account’s owners choose who hears about its new leads, in Settings › Lead Alerts. You choose how you hear, in Settings › Notifications.
A business’s data: people on its team who can open its leads or records can download them as spreadsheets.
What we hold about you: write to help@nightfox.ai.
What you sent a business: to see what a business using Night Fox holds from a form you sent it, or to have it erased, ask the business or write to help@nightfox.ai. If you write to us, we tell the business first, then send you a copy or erase it.
Do Not Track: Night Fox doesn’t track you across other websites, and no one else can through it, so it works the same whether or not your browser sends a Do Not Track signal.
Cookies: Night Fox’s two cookies keep you signed in and keep its tabs in step. If you block them, you can’t sign in on the web.

Deleting Your Data

In the app: open Settings › Sign-In & Security and choose Delete My Login. Confirm with your passkey or a code we email you.
On the web, without the app: go to app.nightfox.ai/delete-login, enter your email address and the code we send, then confirm.

Right away, you’re signed out everywhere, your passkeys stop working and you leave every account. The accounts keep their content and leads, and any leads assigned to you are unassigned. We email you a receipt.

If you’re the only owner of an account, first make someone else an owner. If there’s no one to hand it to, write to help@nightfox.ai and we’ll close the account, as If Your Business Leaves Night Fox explains.

After 30 days, we delete your login for good, with your photo, devices, sessions and passkeys, and we clear your email address from invitations and from our records of codes and other emails sent to you. Until then, write to help@nightfox.ai to bring it back; you’d add your passkeys again.

What we keep, and why:

Each account’s history of changes keeps the changes you made, no longer tied to your login, so the business keeps a true record of what changed and when. Entries about you keep what they recorded: your old and new name, email or phone number if you changed them, the address your invitation went to, and your name where a lead was assigned to you. The IP addresses in it are cleared a year after each change.
Your name stays where Night Fox copied it to show who did what, such as on leads, records, photos and files, and in records of our staff’s visits if they acted as you.
Postmark’s copies of emails sent to you, for 45 days.
Backup copies, for up to 30 days.

Erase a Form You Sent a Business

Ask the business you sent it to, or write to us at help@nightfox.ai. If you write to us, we tell the business first, then act. Our staff erase your details from the business’s account and tell the business when it’s done.

We find everything the business holds from you by your phone number and email address: your leads, including any marked as spam, and its other forms, such as a job application. We find them even if that’s all you sent. We erase:

your name, email, phone, ZIP code, the service you asked about, your message and your answers
your photos and files
the words its team logged about you with calls, texts, emails and notes
the details in the spam check’s result
the address of any automatic reply, and a reply not yet sent is canceled
in our log of emails sent, your automatic reply’s address and any subject that names you, such as an alert’s
the website’s own copy of your form

What stays: that a lead came in, when, from which page and which ad, with its click ID, and how far it got, with nothing that names you. Alerts already delivered stay in people’s inboxes, and Postmark keeps its copies for 45 days. Backup copies last up to 30 days.

If you sent forms to more than one business, ask each one, or tell us which. Their records are separate.

If Your Business Leaves Night Fox

When a business stops working with us, we close its account and give it an export of its information. We keep the closed account until the business asks us in writing to delete it. Then we delete everything in it, and backup copies are gone within 30 days.

Information From Google or Meta

Once a business connects Google or Meta, it can remove our access in its Google or Meta settings at any time, or ask us to. Night Fox then stops reading. The business’s own figures, such as ad spending, clicks and visits, stay as its history. Reviews, anything else that names people, and the rest of its Business Profile content are deleted within 30 days. To have everything Night Fox got from Google or Meta deleted, the business can write to help@nightfox.ai.

Security

There are no passwords. You sign in with a passkey or a one-time code sent to your email. Our staff sign in with passkeys only.
Codes expire after 10 minutes and allow 5 tries, and requests are limited for each address and each network.
We keep only scrambled copies of codes and sign-in keys, never the codes or keys themselves.
Every connection to Night Fox is encrypted.
Each business’s information is kept apart by rules in the database itself, so one business can’t see another’s.
Photos and files sent with forms are private, shown only to people who can see that form.
Every change is recorded, and owners see every visit our staff make.

No system is perfectly secure. If a breach affects your information, we’ll tell you as the law requires.

Children

Night Fox is a tool for businesses and isn’t meant for children. We don’t knowingly collect information from children under 13. If you think a child’s information reached Night Fox, write to help@nightfox.ai and we’ll work with the business to erase it.

Changes to This Policy

When this policy changes, the new version goes here with a new date. If a change affects information we already hold, we’ll email the owners of every client account before it takes effect.

Contact Us

Night Fox Digital, LLC
Email: help@nightfox.ai
Mail: 7901 4th St N Ste 300, St. Petersburg, FL 33702

Privacy Policy. What we hold, why, and how to have it deleted.