Privacy by design

Privacy Policy

Last updated: 6 August 2026

Next Card is built on a zero-custody principle: your Basecamp password is never seen, and the content of your boards, cards, comments, and files is never stored on our servers. This page explains exactly what we do and don't collect.

Who we are

Next Card is an independent app published by Noki LLC ("we", "us"). It is not affiliated with, endorsed by, or sponsored by 37signals, LLC. It lets you view and organize your own Basecamp Card Tables on iPhone, iPad, and Mac.

Sign-in: we never see your password

You sign in through Basecamp's own login (OAuth 2.0). Your Basecamp email and password go directly to Basecamp and are never received by us. The resulting access token is stored only in your device's Keychain — it is not held on our servers.

What we store, and why

Our backend holds only the minimum needed for push notifications and subscriptions:

  • Identifiers — a per-install device key, a numeric Basecamp identity id derived at login, and (if you enable notifications) a push token. These let push notifications and your subscription entitlement reach the right person. Used for app functionality only, never for tracking.
  • Purchases — your subscription status and product id, so we can unlock the full plan. We never receive your card or payment details; those go to Apple (and, for the team plan, Stripe).
  • Activity metadata for push — Basecamp sends a webhook when something changes. We immediately discard names, titles, content, and unknown fields before anything is stored. The durable record contains only numeric account/person/project/recording ids, event and recording kinds, recipient ids, and timestamps. Activity rows expire after 14 days; completed delivery jobs expire after 7 days and failed jobs after at most 30 days.
  • Crash reports (optional) — if the app crashes and you haven't opted out, an anonymous crash report is sent to our own diagnostics service using a blind per-install token that cannot be mapped back to your Basecamp identity. No analytics, no sessions, no content. You can turn this off in Settings → Diagnostics.

What we do not collect

  • Your Basecamp content — cards, comments, files, and covers are fetched from Basecamp and rendered on your device. They are never stored on our servers.
  • Contact info — your email and password go only to Basecamp. A display name may arrive transiently in a Basecamp webhook, but it is discarded before storage and is not retained by us.
  • Analytics or usage tracking — there is no analytics SDK and no advertising identifier.
  • Location, contacts, health, browsing/search history, or financial info.

Tracking

Next Card does not use your data for tracking. No data is shared with data brokers, and there are no cross-app or cross-site advertising identifiers.

Third parties

  • Basecamp / 37signals — the source of your data, accessed with your authorization.
  • Apple — App Store, in-app purchases, and push delivery (APNs).
  • Stripe — payment processing for the web-based team plan only.

Data retention & deletion

Signing out removes the access token from your device and unregisters that device. To delete all Next Card records linked to your Basecamp identity, open Settings → Privacy & data → Delete Next Card data. This removes linked device keys and push tokens, notification preferences, install statistics, trial/free-tier state, and our personal-subscription mirror. It does not delete anything in Basecamp or cancel a subscription billed by Apple. Shared team billing records and records we are legally required to retain may be kept without your identity link.

Children

Next Card is not directed to children under 13 and does not knowingly collect data from them.

Changes

If this policy changes, we will update the date above and, for material changes, note it in the app or on this site.

Contact

Questions about privacy? Email support@nextridge.app.