Published: 3 October 2026.
Who we are
Niffty Witchy Supplies Limited operates the Niffty Witchy Supplies app and Community. Company number 16716304. Registered office: 28 Park Parade, Havant, Hampshire, PO9 5AD. For privacy questions, requests or complaints, email niffty@witchy-supplies.co.uk, call 02394 352984 or write to us. Kora coordinates these matters, with Chris covering her absence.
Information used by the app
Account, shopping and support use details you provide, such as contact and delivery information, account identifiers, orders, returns and messages to us. Square receives payment, transaction and device information for payments and buyer verification. Its Android SDK also sends device identifiers and payment-flow usage and performance events, including timing, technical errors, amounts, and payment-verification tokens and identifiers. Square processes information for payment services, fraud prevention, legal compliance, analytics and improving its services. We receive information needed to process and support your order, including limited card details such as brand, last four digits and expiry date.
Community processes your chosen profile details, adult confirmation, messages and photos, groups and invitations, posts, comments, events and shared content. It also uses reactions, bookmarks, blocks, reports, moderation records, delivery/read state and notifications. The relevant recipients and Community audience can see what you share. Reports may copy relevant text or photos into a separate review record. Private messages are stored by the service and are not end-to-end encrypted.
The service uses authentication and session records, notification tokens and choices, and technical and security records. App network requests use HTTPS. Fasthosts hosts our main backend in the United Kingdom. The Android app includes Google Firebase Cloud Messaging. Its default SDK setup registers the app installation and sends identifiers and configuration information to Google when the app starts, independently of whether you enable Community phone alerts. If you enable those alerts, we also register a push token with your account and send Google generic notification events with account and event identifiers to deliver and route them. We do not include private message or photo contents in notification payloads. Google processes customer data on our behalf under Firebase terms and separately handles technical service data under its privacy policy.
Why we use information
We use information to provide the account, shopping and Community functions you request, deal with orders and support, respond to rights requests, and protect the service and its members. Contract performance supports necessary requested services. Applicable legal obligations support required records and responses. Legitimate interests in security, fraud prevention and fair moderation support necessary, proportionate protection measures, subject to your rights. Optional marketing requires the applicable choice or consent and is not authorised merely by joining Community.
Optional sensitive information
You can use ordinary Community messages, shopping and private tools without sharing sensitive personal information. If you choose to share your own religious or philosophical beliefs or health information, Community Privacy offers a separate optional explicit-consent choice for each category. These choices allow us to store what you choose to disclose and display or deliver it to the audience you select. We use your consent for this optional processing, including the additional explicit consent needed for these sensitive categories.
Before saving or sending relevant Community content, you identify whether it includes your own beliefs or health information. We do not reliably detect every sensitive detail in text or photos. Your choice does not authorise another person's sensitive information or criminal allegations, and does not cover advertising or profiling. Optional profile details remain stored when merely hidden from other members. We record your account, choices, the notice you agreed to and the time so we can demonstrate your decision.
Withdrawing a choice and reviewing earlier content
You can withdraw either optional choice in Community Privacy, independently of accepting new Community rules. Withdrawal stops further sharing under that choice and restricts other members' access to affected content marked with it while removal is reviewed. Earlier unclassified information may require review with your help. Re-enabling permission does not automatically republish withdrawn material. Content containing both categories may be restricted in full when either choice is withdrawn.
Withdrawal also requests a review of your earlier self-disclosures. You can separately remove selected current profile fields or request review of older content, including items you can no longer open. The request status is not a confirmation that every copy has been erased. We explain what is removed or redacted and anything retained for a specific, separately justified legal or safety reason. Recipient copies may remain. Withdrawal does not affect the lawfulness of earlier consent-based processing.
Safety reports
Reporting and blocking remain available without optional sensitive-sharing consent. We assess reports separately from a member's consent to share their own information. We limit access to necessary reviewers, distinguish allegations from findings, and use only information needed for the particular safety or legal purpose. Sensitive details and criminal allegations require an applicable additional legal condition. We remove or redact unnecessary material and keep any justified retained material under review. A report does not authorise publication of allegations or unrelated private information.
Device data and choices
Private Grimoire, Cupboard, Moon Journal and Collections records are encrypted in the reviewed Android app's local storage. Files you choose to export are not encrypted by the app. Server account deletion cannot wipe local records, exports, screenshots or an offline device. Camera, photo and notification features use your device permissions; you can change these in device settings. Content deliberately shared through Community is processed as shared content. Contact us if you need help with information held on your device.
Retention and deletion
We keep account and ordinary Community records for the requested features while they are needed, then remove information no longer needed when an account closes or an applicable removal request is fulfilled. We review shared content carefully to protect other people's rights. Inactive conversations and ordinary report evidence have no general guaranteed expiry in days. Any information retained for a specific legal or safety reason is kept under review; we explain the reason and applicable expiry or review criterion. Hiding a conversation or removing a Community profile is not necessarily whole-account erasure.
Minimal consent and request records may be kept to demonstrate choices and how requests were handled, where necessary for that purpose or a specific legal obligation or claim. They are not permission to retain the underlying sensitive content indefinitely.
Website logs rotate by size, so their age varies with activity; custom logs are outside the verified rotation setting. UK server backups include daily incremental and weekly full copies, older manual copies and a WordPress restore point. No single fixed expiry covers all copies. We reapply completed deletions before an old backup goes live rather than returning erased information to ordinary use.
Requests and complaints
Request account and associated-data deletion through the app's account settings or https://witchy-supplies.co.uk/account-deletion/. You can email niffty@witchy-supplies.co.uk without reinstalling the app. Kora checks deletion requests daily, with Chris covering. A request starts a review, not immediate whole-account erasure.
Depending on the circumstances, you can request access, correction, erasure, restriction, objection or a portable copy of information. You may withdraw consent where we rely on it and object to direct marketing at any time. We may proportionately verify identity. We normally respond without undue delay and within one calendar month, explaining any lawful extension within that period. Complain to us using the contact details above or to the ICO at https://ico.org.uk/make-a-complaint/.
Sharing, transfers and changes
We share necessary information with service providers, recipients of your chosen Community content and, where lawfully justified, authorities or advisers. Google and Square may process information outside the UK, including in the US. Firebase's published terms provide for the UK Data Privacy Framework Extension for covered transfers and contractual safeguards where applicable. Square's data-processing terms require appropriate safeguards for its processor transfers. Contact us for relevant safeguard information.
We date notice changes and explain material new uses before they start. This notice is not blanket consent. Provider information: Firebase privacy, Firebase data-processing terms, Square customer privacy and Square data-processing terms.
Provider links: Firebase privacy; Firebase data-processing terms; Square customer privacy; Square data-processing terms.
