Privacy policy

Last updated 13 October 2026

The short version. This website uses no cookies, no analytics and no tracking scripts, so there is no cookie banner. My apps collect only what they need to work, and I never sell personal data. Studio, my internal publishing tool, only posts to my own social media accounts, keeps its access tokens on my own Mac and shares nothing with third parties.

1. Who is responsible

The data controller for the processing described in this policy is:

Business: Nygaard Digital, a Danish sole proprietorship (enkeltmandsvirksomhed) owned and run by Daniel Høeg Nygaard
CVR: 34968861
Country: Denmark
Address: As registered in the Danish Central Business Register (CVR) under number 34968861, and sent on request
Email: hello@nygaarddigital.com

Nygaard Digital is a one-person business. There is no separate data protection officer; Daniel handles every privacy request personally.

2. This website

nygaarddigital.com and its Danish version, nygaarddigital.dk, are static websites. They have:

No cookies. The site does not set any cookies, and it does not store anything in your browser's local storage.
No analytics or tracking. There are no analytics tools, advertising pixels, social media widgets or embedded third-party content.
No third-party requests. Fonts and images are served from this website itself, so your browser does not contact Google or anyone else when you visit.
No forms and no accounts. You cannot sign up or log in here.

Like every website, the server that delivers the pages necessarily receives technical information when you visit: your IP address, the page requested, the time, and your browser's user agent. The site is hosted on Cloudflare Pages by Cloudflare, Inc., which processes this information on my behalf to deliver the site and protect it against abuse. I do not use this information to identify or profile visitors. Cloudflare keeps such logs only for a short period under its own security practices.

3. When you email me

If you write to hello@nygaarddigital.com, I receive your email address, your name if you include it, and whatever you choose to write. I use this only to answer you and, if it is a support request, to fix the problem you report. I keep the correspondence for as long as it is needed for that purpose and then delete it, normally within 24 months of our last exchange, unless Danish bookkeeping rules require me to keep it longer (for example if it concerns a purchase). The email is stored with my email provider, which acts as a data processor for me.

4. My apps

Nygaard Digital publishes Gaffa XI, Moonsy, Hjemmetavlen and GlutenTrace. The same principles apply to all of them:

Data minimisation. An app only collects what it needs to provide its features, such as an account to save your progress or your family's calendar.
No selling, no ad tracking. I never sell personal data and do not use it for third-party advertising or cross-app tracking.
Payments through Apple. In-app purchases and subscriptions in the iOS apps are handled by Apple. I never see your card details; I only receive confirmation that a purchase is active.
Trusted processors only. Where an app needs hosting, a database, subscription management or crash reporting, it uses service providers who process data on my behalf under a data processing agreement and only for that purpose.
Children. Moonsy is made for young children but is meant to be used together with a parent. I do not knowingly collect personal data from children.

The exact data each app processes is shown on its App Store privacy label and, where the app or its website has its own privacy policy, described there in detail. That app-specific policy applies alongside this one.

5. Studio, my internal publishing tool

What Studio is

Studio is a private, internal software tool that I built for myself. It runs only on my own Mac and helps me plan, prepare and publish posts for my products' social media accounts (such as Gaffa XI, Moonsy and Hjemmetavlen). Studio is not a public service. Nobody else can sign up for it, log in to it or connect their accounts to it, and it is not distributed to anyone.

Studio connects to the Meta (Facebook Pages and Instagram), X, TikTok and YouTube APIs only to publish content to accounts that I own or manage, after I have authorised it myself through each platform's official sign-in (OAuth).

What data Studio accesses

Platform	Permissions requested	What Studio does with them
Meta (Facebook Pages, Instagram)	`pages_show_list`, `pages_read_engagement`, `pages_manage_posts`, `publish_video`, `instagram_basic`, `instagram_content_publish`, `business_management`	Lists the Pages and Instagram business accounts I manage so I can pick the right one, and publishes the posts, images and videos I have approved.
X	`tweet.read`, `tweet.write`, `users.read`, `media.write`, `offline.access`	Reads the connected account's ID and username, uploads media and publishes the posts I have approved. `offline.access` keeps the connection working without signing in again.
TikTok	`user.info.basic`, `video.upload`, `video.publish`	Identifies the connected account and uploads my videos, either as drafts that I finish in the TikTok app or as posts I have approved.
YouTube (Google)	`youtube.upload`, `youtube`	Identifies my channel and uploads and publishes the videos and Shorts I have approved, including their titles and descriptions.

In practice this means Studio handles: the OAuth access and refresh tokens for my accounts; basic identifiers for those accounts (account or channel ID, username, page name); the media, captions and titles I create; and the IDs and publishing status of the posts it creates, so I can see whether a post went out. Studio does not collect or store information about other people, such as followers, commenters, viewers or anyone who messages my accounts.

Where it is stored

Everything stays on my own computer. Access and refresh tokens are stored in the macOS Keychain on my Mac. They are never written to logs, never shown in the interface and never sent anywhere except back to the platform that issued them. Post drafts, media and publishing status are kept in a local database on the same Mac. Studio has no server, no cloud database and no other users.

Sharing

Studio shares no data with third parties. Data received from Meta, X, TikTok or Google is used only to publish to my own accounts and show me the result. It is not sold, not used for advertising, not used to build profiles and not used to train AI models. Studio can use an AI writing assistant to suggest captions, but it only sends my own product information to it, never data received from the platforms' APIs.

Google API Services

Studio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Studio uses the YouTube API Services; by using them, the connected channel is also subject to the YouTube Terms of Service and the Google Privacy Policy.

Retention, revoking access and deletion

Tokens are kept only while an account is connected. When I disconnect an account in Studio, its tokens are deleted from the Keychain straight away.
Access can also be revoked at any time from the platforms themselves: Google account permissions, Facebook business integrations, X connected apps, and TikTok's Settings and privacy → Security → Manage app permissions.
Local drafts and publishing records are deleted when I no longer need them. Posts that have been published remain on the platform until they are deleted there.
Data deletion requests: if you believe Studio holds any data about you and want it deleted, email hello@nygaarddigital.com with the subject "Data deletion request". I will delete it and confirm by email within 30 days.

6. Legal bases

Website delivery and security (server logs): my legitimate interest in running a secure, working website, GDPR Article 6(1)(f).
Emails and support: my legitimate interest in answering you, Article 6(1)(f), or taking steps at your request before or under a contract, Article 6(1)(b).
App features: performance of the contract when you use an app, Article 6(1)(b), or your consent where an app asks for it, Article 6(1)(a).
Studio: Studio processes data about my own accounts. To the extent it touches anyone else's personal data, the basis is my legitimate interest in publishing my own content, Article 6(1)(f).
Bookkeeping: compliance with Danish accounting law, Article 6(1)(c).

7. Processors and international transfers

I use a small number of service providers (hosting, email and the services each app relies on) as data processors. Some of them, such as Cloudflare, are based in or process data in the United States. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. Apple, Meta, X, TikTok and Google act as independent controllers for the data you share with them under their own privacy policies.

8. Your rights under the GDPR

You have the right to:

access the personal data I hold about you and get a copy of it;
have inaccurate data corrected;
have your data erased ("the right to be forgotten");
restrict how I process your data;
data portability, meaning a copy of data you provided in a structured, machine-readable format;
object to processing based on legitimate interest;
withdraw consent at any time, where processing is based on consent, without affecting earlier processing.

To use any of these rights, email hello@nygaarddigital.com. I answer within one month, it is free, and I may ask you to confirm your identity first.

9. Complaints

If you are unhappy with how I handle your data, please tell me first so I can put it right. You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, datatilsynet.dk, or to the supervisory authority where you live.

10. Security

The website is served only over HTTPS with strict security headers. Studio's tokens never leave the Keychain on my own Mac, and the services my apps use are chosen for their security track record. No system is perfectly secure, so I keep the amount of personal data I process as small as I can.

11. Changes to this policy

If I change how I handle personal data, I will update this page and the date at the top. Significant changes affecting app users will also be announced in the relevant app or on its website.