Privacy Policy

1. What we collect

We collect only what Nabuya needs to work:

• Account details: your name, email address and profile picture from your Google or Apple sign-in. Your profile picture is shown to people in spaces you share.
• Device push token: the address used to send notifications to your phone.
• What you save: the text you type, links you share, and voice recordings you make.
• What Nabuya works out from it: titles, summaries, the kind of item, times, names and places, voice transcripts, and search data (embeddings) that let Ask find items from a vague description.
• Your questions: what you ask in Ask, and the answers.
• Technical data needed to run the service: your IP address, the time and the address of each request, in our server logs. Logs are kept for up to 30 days.

What you save into a shared space is visible to its members, together with your name and profile picture. When you ask to join, the owner sees your name and email address. Leaving a space leaves your items there. Deleting your account deletes everything you wrote, including items in shared spaces.

If you agree, the app uses Google Firebase Analytics to see how it is used, such as which screens are opened. The app asks once; it collects nothing until you say yes, and you can switch it off at any time in Settings. It is not tied to your account and is not used to track you across other companies' apps or websites. The nabuya.app website has no analytics or tracking.

For a short summary in the App Store and Google Play format, see App Privacy.

2. Why we use it

• To give you your account and keep your items in sync between the app and our servers.
• To read each item after you save it, and to show you what Nabuya understood.
• To transcribe voice notes.
• To find items and answer your questions in Ask.
• To show link previews: our server fetches the web page of a link you save to get its title and image.
• To answer your messages, keep Nabuya running, prevent abuse and meet legal duties.

Where the GDPR applies, we use your data mainly because we need it to provide the service you asked for, (performance of a contract), for our legitimate interests in keeping Nabuya secure, and your consent for app analytics and anywhere else we ask for it, which you can withdraw at any time.

3. AI processing

To read your items and answer your questions, we send the content involved to these AI providers:

• OpenRouter, which passes requests to AI model providers, for reading items and answering questions.
• Google (Gemini API), for voice transcription and for the search data that helps Ask find items.

We send only what each task needs. We use Google's paid Gemini API, under which Google does not use your content to train its models; it may keep requests for a limited time to detect abuse. OpenRouter does not store the content of requests by default.

4. Who else handles your data

We use these service providers to run Nabuya. They process data on our behalf:

• Render: hosts our servers and database, in Europe.
• Cloudflare: stores voice recordings (Cloudflare R2) and forwards email sent to our nabuya.app addresses.
• Clerk: handles sign-in with Google or Apple.
• Google Firebase: app analytics, only if you agree (how the app is used, not linked to your account), and push notifications through Firebase Cloud Messaging. For notifications it receives your device's push token and the notification text: a space's name, a member's first name, and the title of the item added, or the start of its text if it has no title yet.
• Netlify: hosts the nabuya.app website and stores the messages you send through its contact form (your name, email address and message).
• Apple and Google: sell and bill paid plans through the App Store and Google Play. They handle your payment details under their own privacy policies. We do not see or store your card number.
• RevenueCat: tells us which plan you bought. It receives your Nabuya account ID and your purchase records from the store, not your card details.

If you choose "Add to Google Calendar" on a reminder, the reminder text is placed in a Google Calendar link that you open. Google's privacy policy applies to what happens there.

We may also share data when the law requires it, or as part of a merger or sale of our business, with protection for your data. We do not sell your personal data and we do not share it for advertising.

5. How long we keep it

• Items you save, and everything Nabuya works out from them, are kept until you delete them. Deleting an item deletes it and its media files from our servers. Copies in our database backups are gone within 30 days.
• Voice recordings are kept with their item after transcription, and deleted when you delete the item.
• Your Ask history is deleted automatically after 90 days.
• Messages you send through the contact form are kept for up to 12 months after we answer you, then deleted.
• Account details are kept while your account exists. When you delete your account, we delete your account and everything you saved within 30 days; copies in backups are gone within a further 30 days.

6. Your rights

Under the Israeli Privacy Protection Law, 5741-1981, you can ask to see the data we hold about you and ask us to correct it. Where the GDPR or the CCPA apply to you, you also have the rights they give, such as deletion, a copy of your data, objecting to or limiting some processing, and complaining to your data protection authority. We do not treat you differently for using these rights.

You can fix what Nabuya understood about an item, and delete items, in the app.

You can delete your account and all its data in the app: Settings, then Delete account. To see your data or correct it, or if you cannot use the app, email [email protected]. We may ask you to confirm it is your account before we act.

7. Security

We use reasonable technical and organisational measures to protect your data, such as encrypted connections between the app and our servers, encrypted storage at our hosting providers, and access limited to people who need it. No system is free of risk, so we cannot promise that your data will be safe from every threat.

8. Children

Nabuya is not meant for children under 13. We do not knowingly collect their data. If you think a child has given us data, email [email protected] and we will delete it.

9. International transfers

Our service providers may process your data outside your country, including outside Israel and the European Economic Area. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses or a country's recognised level of data protection.

10. Links to other sites

Links you save open other websites. Their owners' privacy policies apply there, not this one.

11. Changes to this policy

We may update this policy. We will post the new version on this page and change the date at the top. If a change is significant, we will also tell you in the app or by email.

12. Contact

Questions or requests about your data? Write to us.

Privacy

[email protected]

Operator

Ozdav LTD, Israel