Privacy Policy

1. Information We Collect

Authentication: Email address and password (hashed) via Supabase Auth.

Profile: Display name (optional), plan tier, and IANA timezone used to keep each daily Line on your local calendar day.

Usage Data: Tasks, projects, notes, labels, daily Line commits, and idempotent first-Line/first-Done milestones are stored in our database.

Analytics: After you explicitly opt in, Umami records pageviews and anonymous product events for the landing demo, authentication mode, onboarding beats, Task actions, Line commits, mode changes, and checkout-return actions. Umami events never include user identity, UUIDs, email, Task titles, Project names, notes, or other content. No session recording.

MCP beta: For API-token calls, we store key metadata plus tool name, success, latency, a normalized client category, and error category. MCP audit rows never contain Task titles, notes, Project names, email, raw tokens, or arbitrary User-Agent text.

2. How We Use Your Data

• Provide and improve the Nowva service.
• Understand usage patterns via anonymous, opt-in Umami analytics.
• Send transactional emails (subscription changes, account recovery).

3. Data Retention & Deletion

You can delete your account and all associated data at any time via the Settings panel or by requesting DELETE /api/account.

MCP keys and MCP audit rows are retained while the account exists and are deleted with the account.

We commit to deletion within 30 days (GDPR Art. 17). Soft-deleted data is purged after 90 days.

4. Third-Party Services

Supabase: Postgres database + Auth. It is the cross-device source of truth for first Line and first Done milestones. Data Processing Agreement available.

Umami: Self-hosted web analytics. Its script and pageviews load only after opt-in, and its explicit events contain no user identity, UUIDs, email, Task content, Project names, notes, or other PII.

Stripe: Subscription processing. Stripe webhooks and the corresponding Supabase billing records are the source of truth for subscription and revenue status.

Vercel: Hosting and edge functions.

5. Your Rights

• GDPR (EU): Right to access (Art. 15), delete (Art. 17), rectify (Art. 16).
• CCPA (US): Right to know (§1798.100), delete (§1798.105).
• LGPD (Brazil): Right to access, delete, port data (Arts. 17–19).

Request data export: GET /api/account/export.

6. Security

Data in transit: TLS. At rest: AES-256 (Supabase). Database: user_id isolation via Row-Level Security (RLS).

7. Contact

Privacy questions: privacy@nowva.app

8. GDPR Disclaimer

Nowva is a task management tool, not a substitute for professional medical or mental health treatment. If you are experiencing a mental health crisis, please seek professional help.