Privacy Policy

Last updated: July 11, 2026

This Privacy Policy explains how Nicher ("Nicher," "we," "us," or "our") processes personal data when you use the FromPast mobile application, message pages, and related services (together, the "Service"). This policy is a notice, not a request for blanket consent. Where we need consent for a specific activity, such as certain analytics or personalized advertising, we request it separately.

Who We Are

Nicher is the company responsible for the Service and, where applicable, the controller of personal data described in this policy.

Nicher
807-45, 385, Gangseo-ro, Gangseo-gu, Seoul 07803, South Korea
Email: chris@nicher.io

Data We Process

Message and Service Data

When you create or receive a message, we process information needed to operate the Service, which may include:

Selected Contacts

If you choose the contact-picker feature and grant Contacts permission, the app opens your device's contact picker and reads the contact entry you select so that you can use an email address from that entry. We do not intentionally upload your address book as a whole. The selected email address is processed as recipient information. Your operating system controls Contacts permission, which you can withdraw in device settings.

Device, Network, Consent, and Diagnostic Data

We and our providers may process:

Legacy Transaction Data

The current app does not initiate new in-app purchases. To reconcile an outstanding transaction from an older app version, we may process the product ID, store source, order or transaction ID, transaction time, receipt or purchase token, package name, price, currency, country, language, and FID. Apple or Google processes payment-card information; we do not receive or store complete card details.

How We Use Data and Our Legal Bases

We use personal data for the following purposes:

We do not treat acceptance of this Privacy Policy as consent for every processing purpose. You may withdraw a consent choice without affecting processing that occurred before withdrawal, and we may continue processing when another lawful basis applies.

Recipient Data and Hashing

A sender provides recipient data to us. Current sends use email only. The raw recipient address must remain available in delivery-event records until the scheduled delivery and any operational retry are completed. After scheduling, the API attempts to clear the raw address from the primary message row, but the delivery and website-generation records may continue to hold it until their work completes.

We create a deterministic SHA-256 hash of recipient contact information for blocking and abuse prevention. SHA-256 is cryptographic hashing, not encryption, and the hash remains personal data when it can be linked or matched. We encrypt the sender IP address at the application layer using AES-256 and retain the initialization value needed for authorized decryption.

Recipients may contact us to report a message or request a block. Because we receive their information from a sender, recipients may also exercise applicable privacy rights using the contact details below.

Advertising, Analytics, and Diagnostics

The Service uses Google AdMob for production banner, interstitial, and rewarded ads. Google User Messaging Platform (UMP) manages regional advertising choices, and on iOS the UMP flow may coordinate the ATT prompt. Depending on your region and choices, Google and its advertising partners may process advertising identifiers, IP address, device information, consent signals, ad interactions, and approximate location derived from network or device signals to provide, measure, limit, or personalize ads.

You can revisit advertising privacy choices from the in-app privacy-options entry when it is available. You can also limit platform tracking or reset or restrict an advertising identifier through device settings. If a trustworthy advertising-consent result is unavailable, the app is designed not to request ads.

We use Firebase Analytics for consent-gated analytics and ad telemetry, Firebase Installations for FID, and Firebase Cloud Messaging for notifications. We use Sentry for error diagnostics, tracing, and performance monitoring. Analytics and Sentry event transmission are gated by the app's analytics choice where configured. You can change the analytics choice in the app settings.

When We Disclose Data

We disclose personal data only as reasonably necessary for the purposes above, including to:

A provider's legal role depends on the service and data involved; not every third party is necessarily our processor.

International Transfers

Nicher operates from South Korea, and providers may process data in South Korea, the United States, and other countries. Those countries may have different privacy laws from where you live.

We do not rely on passive acceptance of this policy as consent to routine international transfers. Where EU GDPR, UK GDPR, or another transfer law applies, we use an available lawful mechanism, such as an adequacy decision, approved contractual safeguards, or a specific statutory exception, and apply supplementary safeguards where required. You may contact us for information about the mechanism relevant to your data.

Retention

Retention depends on the record and operational state. The current repository implements or targets the following lifecycle:

Deletion may be delayed by a failed job or retry, a legal hold, security investigation, backup cycle, or technical recovery requirement. Service providers apply their own documented retention schedules. We delete or de-identify data when the applicable purpose and retention criterion no longer apply.

Security

We use administrative and technical measures intended to protect personal data, including access controls, recipient-contact hashing, application-layer encryption of sender IP addresses, transport security, and provider security controls. No transmission or storage method is completely secure, and we cannot guarantee absolute security.

Your Choices and Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or receive your data; restrict or object to processing; withdraw consent; opt out of certain advertising disclosures; or complain to a privacy regulator. Rights may be subject to identity, feasibility, legal-retention, and third-party-rights limitations.

You can manage Contacts, photos, notifications, advertising identifiers, and tracking through device settings. You can change analytics and available ad privacy choices in the app. You may request assistance by emailing chris@nicher.io. We will use reasonable verification for access, correction, or deletion requests but will not require verification for an advertising sale/share opt-out where applicable law prohibits it.

EU GDPR and UK GDPR

If EU GDPR or UK GDPR applies, you may request access, rectification, erasure, restriction, or portability; object to processing based on legitimate interests or direct marketing; withdraw consent; and complain to the competent supervisory authority, including the UK Information Commissioner's Office for applicable UK processing.

We respond to rights requests without undue delay and normally within one month. Where permitted because a request is complex or numerous, we may extend the period by up to two additional months and will explain the extension within the first month.

Our principal lawful bases are identified in "How We Use Data and Our Legal Bases." Contact us if you need the specific basis, legitimate interest, or transfer safeguard for a processing activity.

California Privacy Notice

This section applies only to the extent that Nicher is a "business" subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), for the processing at issue.

In the preceding 12 months, we may have collected the following CCPA categories described in this policy: identifiers; customer-record information such as contact details; commercial information from legacy transactions; internet or electronic-network activity; approximate geolocation or region signals; visual information in uploaded media; message content; and inferences or advertising information generated from interactions. Sources include you, a sender who identifies a recipient, your device, and the providers listed above. We use and disclose them for the purposes described in this policy.

We do not sell personal information for money. When personalized or cross-context behavioral advertising is allowed, disclosure of identifiers and interaction data to Google or advertising partners may be considered "sharing" under California law. You may opt out through the available in-app advertising privacy options or by emailing chris@nicher.io. We do not knowingly sell or share personal information of a consumer we know is under 16 without the opt-in authorization required by law.

Subject to the CCPA/CPRA, California residents may request to know or access personal information, delete it, correct inaccurate information, opt out of sale or sharing, limit certain uses or disclosures of sensitive personal information, and receive equal service and pricing when exercising their rights. A request to know may cover information collected beyond the preceding 12 months, for information collected on or after January 1, 2022, unless providing it is impossible or would require disproportionate effort.

You or an authorized agent may submit a request by email. For requests other than opt-out or limit requests, we may ask for information reasonably necessary to verify identity and authority. An agent may be asked for signed permission, and we may directly confirm authorization with you, subject to power-of-attorney rules. We normally respond to a verifiable request within 45 days and may extend once by another 45 days with notice when reasonably necessary.

Children's Privacy

The Service is for users age 13 or older. If you are below the age of legal adulthood where you live, a parent or legal guardian must review the Terms and permit your use. We do not knowingly collect personal data from a user under 13. If we learn that we did so, we will take reasonable steps to delete or restrict the data, subject to safety and legal requirements.

The app does not currently ask for a date of birth, so we may not know a user's exact age. A parent or guardian who believes a child used the Service contrary to this policy should contact us with enough information to locate the relevant data.

Third-Party Links and Recipient Pages

The Service may link to a third-party site or store. Its operator controls its own privacy practices. A recipient message page is part of the Service, but links contained in user Content may lead to sites we do not operate.

Changes to This Policy

We may update this policy to reflect changes in the Service, law, or data practices. We will post the updated policy with a new date and provide an in-app or other prominent notice when required. The policy applies from its stated effective date.

Contact Us

For privacy questions or requests, contact:

Nicher
807-45, 385, Gangseo-ro, Gangseo-gu, Seoul 07803, South Korea
Email: chris@nicher.io