Privacy Policy

Your data, explicitly

Your data is yours. nodu never sells it, never hands it to advertising platforms, and never uses it for targeted or cross-context advertising. nodu uses what you share only to operate the product, generate your personalized sessions, measure how the product and its subscription flow are used (first-party event records only, never used for advertising), understand who nodu is for from the optional about-you answers you may give (§ 2), send you reminder email about nodu itself if you have been away a while (§ 4, and you can stop it in one click), document consent, protect the service, and honor your choices.

These commitments cover the data you share with nodu and the records nodu creates about your use of it. One separate, narrower practice is disclosed plainly rather than left to inference: the homepage of the public marketing site, which names no habit, carries Meta's advertising measurement pixel for site visitors from the United States, under the opt-out standard described in § 14. No page about a specific habit ever carries it, and nothing you share with nodu is ever involved.

nodu does not sell your data. nodu does not share what you tell it with advertising or marketing platforms. nodu does not use your intake responses, journal entries, or generated sessions to train nodu's own models, and nodu's AI service providers process your data only under each vendor's applicable, operator-verified terms — see § 4.1 for vendor-specific detail.

nodu is not a healthcare provider and is not covered by HIPAA, so the health-related information you share is not governed by HIPAA. nodu protects it instead under this Policy and the Consumer Health Data Privacy Policy, including the commitments never to sell it and never to use it for third-party or targeted advertising.

You can delete your account and associated nodu data from Settings. Deletion is permanent and runs synchronously: when you confirm deletion, IRJG deletes account-linked data, generated session audio, journal entries, memory-card data, session records, metrics rows, spend-ledger rows, and local fallback files, and de-identifies consent-log records by removing the fields that directly identify you (see § 9 and § 7 for exactly what the audit trail retains).

1. Provider / controller identification

This Privacy Policy applies to nodu, provided by IRJG Ventures, Inc. ("IRJG"), a Delaware corporation formed 2026-04-24. IRJG is the data controller for personal data processed through nodu.

Mailing address: 13809 Research Boulevard, Suite 500, Austin, TX 78750 Privacy contact: privacy@trynodu.com EU and UK representatives: see § 6.

2. Categories of personal data nodu collects

nodu collects:

• Account data such as email address, authentication metadata, and (where applicable) display name.
• If you create your account with Sign in with Apple: the identifier Apple assigns to link your Apple ID to nodu, the email address Apple provides, and a token IRJG stores for a single purpose — so that deleting your nodu account also withdraws nodu's access to your Apple ID, as Apple requires. If you choose Hide My Email, the address Apple provides is a private relay address and nodu never receives your real one. When you first authorize nodu through Sign in with Apple, Apple may also share the name you chose on its sign-in sheet. nodu reads no part of that name other than the first name, may use the first name to fill in your display name, which you can change, and uses it for nothing else. IRJG never receives your Apple ID password or any other Apple ID credential.
• If you turn on reminder notifications: a push token your device's operating system issues for the nodu app, the platform it belongs to (iOS or Android), and your device's UTC offset, which is used only to place a reminder in your evening rather than overnight. A push token is an address, not content: it lets nodu ask Apple to deliver a notification to that device, and it carries nothing about your habit, intake, journal, or sessions. It is held only on IRJG's servers, is never returned by the app and never written to a log. When you turn reminders off, sign out on that device, or the platform reports the device is no longer registered, the registration is revoked: it is marked inactive and is never used to send you anything again. The inactive record is kept rather than removed, so that reminders can tell a person who has a working device from a person who once had one — without that distinction, turning notifications off on one phone could silence your reminders on every channel. When you delete your account the record is deleted outright, along with everything else.
• Intake responses, journal entries, memory-card fields, rolling summaries, and generated-session metadata.
• Sensitive data that may include information about substance use (alcohol, cannabis, nicotine, other substances), gambling behavior, sexual behavior (for users working on pornography use), eating or sugar-related behavior, digital-use patterns, body-focused repetitive behaviors (such as skin picking), other habit patterns you share with nodu, and your mental and emotional state.
• Generated session audio and related storage metadata.
• Subscription and purchase data — nodu subscriptions are purchased through Apple's In-App Purchase system in the nodu iOS app. Apple collects and processes your payment information directly, under its own terms and privacy policy; IRJG never receives your payment-card number, CVC, bank-account number, billing address, or Apple ID credentials, and no payment-card data enters IRJG's systems. To connect the App Store transaction to your account, nodu uses RevenueCat, a subscription-management provider: the app gives RevenueCat a pseudonymous account reference (an internal nodu user ID), and RevenueCat processes that reference together with device information — a device identifier and routine device attributes such as device model and operating-system version — and the App Store purchase and receipt metadata Apple makes available. RevenueCat then provides IRJG limited subscription metadata, including: subscription status, the subscription product purchased, the store, the purchase, renewal, and expiration dates, and auto-renewal state. RevenueCat never receives your intake, journal, or session content.
• Support and rights-request communications.
• Technical and security data such as usage logs, timestamps, device/browser data, and IP address (stored as a hash).
• If you choose to answer, how you first heard about nodu. This is an optional one-tap question during setup with a fixed list of answers (for example a social platform, a search, a friend, or a podcast). You can skip it, and skipping it changes nothing about your account or your sessions. It is a single choice from that list; there is no free-text field, so nothing you write is collected here.
• If you choose to answer, a little about you: your age range, your gender, and where you live (the United States, with your state if you choose to give it, or another country, which you may name or not). These are optional one-tap questions on one screen during setup, each with a fixed list of answers. You can leave any or all of them blank, and doing so changes nothing about your account or your sessions; a question you leave blank is recorded as not answered. Each answer is a single choice from its list, and nothing you type is collected. The age answer is a range and never a date of birth, and the lowest range begins at 18. nodu does not use your device's location for this or for anything else: the only place nodu knows is one you choose to give. Some states treat a gender answer that shows a person is non-binary or transgender as sensitive data. Where the law of your state does, your choosing that answer is your consent to nodu keeping it for the purpose described in § 3, and clearing your answers withdraws it. If you tell nodu you live in Maryland, nodu does not keep your gender answer. You can clear these answers at any time on the Memory page in Settings (Clear age, gender and location), and they are deleted with your account.

3. Purposes of processing

nodu uses the data described above to:

• operate nodu and authenticate you;
• generate your personalized sessions, including by transmitting the necessary inputs to the AI service providers listed in § 4;
• manage subscriptions purchased through the Apple App Store, using the subscription-management provider described in § 4;
• respond to support and privacy-rights requests;
• protect the service against fraud, abuse, and security incidents;
• document consent and maintain a legal audit trail;
• send you service-related communications (account, security, material policy changes);
• send you a reminder if you have not had a session for a while, using the date of your most recent session and, depending on the channel, your email address or your device's push token — never the habit or topic you are working on. Before sending, nodu also checks your consent, your reminder opt-out, whether you already received that reminder, and whether your subscription has ended; each of those checks can only stop a message, never select one. Reminders reach you by email, or as a notification on your phone if you have turned notifications on, and never as both for the same lapse. See § 4, which describes how to stop them;
• measure how nodu and its subscription flow are used, and which channels people find nodu through, using first-party records IRJG creates itself;
• understand, from the optional about-you answers described in § 2, who nodu is for, and improve nodu. IRJG reads these answers itself, as counts. They are not used to advertise to you, are not disclosed to any advertising platform or analytics provider, and are not read by the coach or used to write your sessions;
• comply with legal obligations.

nodu does not use the data described in this section for cross-context behavioral advertising, profiling for targeted advertising, or training its own AI models. The advertising measurement on the marketing site's homepage involves none of the data described in this section and is addressed in § 14.

4. Service providers and vendors

IRJG uses the following providers to operate nodu. IRJG shares with each only the data necessary for the specific service they perform, under written contracts (DPAs and, where applicable, EU Standard Contractual Clauses) that require them to protect your data and use it only for the purposes IRJG directs.

Apple is not listed in the table above because Apple is not IRJG's service provider: when you subscribe through the App Store, Apple collects and processes your payment directly, as an independent company acting under its own terms and privacy policy, as described in § 2. The App Store transaction records Apple creates include the fact that you purchased a nodu subscription, and never the intake or session content underlying your use of the service.

The same is true of Sign in with Apple. Where you use it, Apple verifies your identity as an independent company under its own terms and privacy policy, and tells nodu only what is described in § 2: the identifier, the email address and, when Apple shares it, the name you chose to share. IRJG sends Apple nothing about your intake, journal, memory cards, or generated sessions, and Apple learns nothing from IRJG about the habit or topic you are working on. IRJG sends Apple only two messages about your account, each of which returns a credential Apple itself issued: at sign-in, IRJG's server exchanges the one-time code Apple has just created for the revocation token described in § 2 — an exchange that tells Apple nothing beyond the sign-in it has just performed — and at deletion, the request to withdraw nodu's access to your Apple ID (§ 9).

nodu may send you reminder email if you have not had a session for a while. These messages are promotional, and they are delivered through Resend — the same email provider described in the table above, acting on IRJG's behalf under its data processing agreement. nodu does not use any separate marketing-email vendor. nodu published this description before sending any such message; the controls below work from the first message onward.

Reminder email is built from two things about you: your email address, and the date of your most recent session, which decides whether a reminder is due and which of the five messages you receive, subject to the checks described in § 3, each of which can only stop a message and never select one. It never names the habit or topic you are working on, and never includes any part of your intake, journal, or session content. Each message carries its own unsubscribe link, which encodes a reference to your account together with a signature only IRJG's server can verify, so that the link can stop your reminders and no one else's; the reference is an internal account identifier, not your email address or your name, and someone who can read the email can read it. Beyond that, someone who sees your inbox learns that you have a nodu account, and nothing about what you use it for.

You can stop reminder email in either of two ways, and each works on its own: the unsubscribe link carried in every message, which works without signing in — some mail apps also offer a one-click unsubscribe on these messages — or the Reminders control in the app's Settings. Stopping reminders does not affect authentication or billing email, and does not delete anything.

nodu may also send reminders as notifications on your phone, but only if you have turned notifications on for nodu. That is a separate, affirmative step: the app explains what the reminders are before asking, and asks only after you have completed a session. Because notifications are something you choose to turn on, that sequence runs more often than the email one and then stops: a short reminder on most days in the first week after you stop having sessions, then spacing out, and nothing at all after four weeks. Whichever channel you are on, there is an overall limit of fifteen reminders in any thirty-day period. Where you have turned notifications on, a gap in your sessions produces notifications instead of emails, never both, and which channel you are on is fixed by the first reminder of that gap and does not change while it continues. A notification names no habit or topic and contains no part of your intake, journal, or session content, so a person who glances at your locked screen learns that you have nodu installed and nothing about what you use it for. Delivery is handled by Expo, named in the table above, which receives the push token and the fixed reminder text and passes them to Apple.

Both channels are governed together, by either control. Turning Reminders off in Settings stops the email and the notifications, and revokes the device registrations that make notifications possible. The unsubscribe link in any reminder email has the same effect on both channels: it records a decision that nodu keeps, which is checked before either an email or a notification is sent, and which also prevents a device being registered again until you ask for reminders once more. You can additionally turn notifications off for nodu in your phone's own Settings, which stops the notifications while leaving reminder email in place.

The optional product-update choice is a separate control with a different scope: offered in the app's Settings under Consent & Policies, it records whether you want occasional product-update messages, a category nodu does not currently send. It does not govern reminder email, which is governed by the two controls described above.

Authentication-related email (magic links, password resets, email verification, and account-security notices such as confirmation that your password was changed) is composed by Supabase Auth and delivered through Resend; purchase receipts and Apple's own subscription and renewal notices for App Store purchases are sent by Apple, not by IRJG; material-policy-change notices are operational, not marketing. IRJG may also send two subscription notices of its own: a notice before a free trial converts to a paid subscription, and the yearly reminder of the terms of an annual subscription. These are transactional, not promotional. Each goes to your account email address through Resend, the same provider that delivers sign-in email, and states the date, the price that applies and how to cancel; it carries nothing you have told nodu. If nodu adds a marketing-email vendor other than the provider named above, that vendor will be added to this section and the change will be treated as a material privacy-notice change requiring re-consent.

4.1 AI service providers — what they may and may not do with your data

The AI service providers IRJG uses to generate your sessions (Anthropic and ElevenLabs) are bound by their published commercial terms and, where applicable, executed Data Processing Addenda. IRJG does not authorize either provider to use your data for any purpose other than providing the service IRJG has contracted them to provide. Vendor-side retention and processing beyond what IRJG instructs follow each vendor's own published default terms.

Anthropic processes intake-derived prompt text and generation context to produce session text. Under Anthropic's default API terms, Anthropic does not use API inputs or outputs to train its models. Anthropic deletes inputs and outputs from its systems within 30 days. That window extends where content is flagged under Anthropic's usage policy: flagged inputs and outputs may be retained for up to two years, and the trust-and-safety scores derived from them for up to seven years. Anthropic's standard API tier offers no separate per-user deletion channel, so that contracted retention limit is itself the deletion mechanism: on account deletion, any user-associated generation data still within the window ages out and is purged by Anthropic no later than the end of it.

IRJG also uses Anthropic's AI systems as an operational tool when administering, diagnosing, and maintaining the service. In that use, Anthropic may process the specific records retrieved during an operational session, which can include the same categories of data nodu stores on your behalf. This processing occurs under the Anthropic terms governing the operator's tooling account, which the operator verifies before use: those terms do not permit Anthropic to use these inputs or outputs to train its models, and vendor-side retention follows the verified terms of that account (for standard API access, deletion within 30 days, extending to up to two years for inputs and outputs flagged under Anthropic's usage policy and up to seven years for the trust-and-safety scores derived from them). IRJG limits each operational session to the data reasonably necessary for the task at hand, and does not authorize Anthropic to use this data for any purpose other than providing the operational service to IRJG. The same operational use extends to correspondence you send to IRJG's contact addresses (for example, rights requests and support email): the operator may use the tooling to read, triage, and draft responses to that correspondence.

ElevenLabs processes generated session script text to produce session audio. ElevenLabs' processing is governed by ElevenLabs' default terms and DPA at nodu's tier. ElevenLabs' history-retention behavior is tier-dependent; on nodu's tier, generation history is retained per ElevenLabs' default retention policy, and IRJG deletes the speech-generation history — the surface that holds synthesized session script content — through ElevenLabs' history-deletion controls, on an automated schedule covering all accounts: at least monthly as this Policy's commitment, and daily in current operation.

If a vendor's default terms change in a way that materially affects how your data is used, IRJG will treat that as a material change to this Privacy Policy and require renewed consent where appropriate.

5. Washington Consumer Health Data (MHMDA)

A separate Consumer Health Data Privacy Policy provides additional detail required under Washington, Nevada, Connecticut, and Maryland law. The remainder of this section addresses Washington's MHMDA specifically.

For Washington Residents. IRJG collects and processes information that may qualify as "consumer health data" under the Washington My Health My Data Act ("MHMDA"), including information about your habits (which may include substance use, gambling, sexual behavior, eating behavior, digital use, and other behavioral patterns), your mental and emotional state, and related behavioral information. During onboarding, you provide consent under MHMDA through a separate consent step — a distinct affirmative act, separate from your acceptance of the Terms of Service — that states the categories of consumer health data collected, how they are used, who receives them, and how to withdraw. That consent covers IRJG's collection, use, processing, and sharing of your consumer health data as described in this Privacy Policy, including sharing with its AI service providers (Anthropic and ElevenLabs) to generate personalized sessions and, in Anthropic's case, to support the secure operation, diagnosis, and maintenance of the service as described in § 4.1.

You have the right to withdraw this consent at any time, either in the app or by email. In the app, Settings contains a Consent & Policies screen listing each consent you gave, with a control to turn any of them off; withdrawing there ends your access to nodu, retains your data rather than deleting it, and is reversible by turning the consent back on. By email, write to privacy@trynodu.com; a withdrawal sent by email is treated as a request for account deletion unless you specify otherwise. Either route is available to you at any time, and § 5 of the Consumer Health Data Privacy Policy describes both in full. Withdrawal does not affect processing that occurred before withdrawal. You also have the right to request access to, correction of, and deletion of your consumer health data. IRJG does not sell your consumer health data and does not share consumer health data for cross-context behavioral advertising or targeted advertising.

If IRJG denies a rights request, you may appeal by replying to the denial email; if your appeal is denied, you may contact the Washington Attorney General at https://www.atg.wa.gov/file-complaint.

6. European Users (GDPR, UK GDPR, Swiss FADP)

For Users in the European Economic Area, United Kingdom, and Switzerland. If you are located in the EEA, UK, or Switzerland, IRJG processes your personal data in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection.

Legal basis. IRJG processes your data on the following legal bases:

Your rights. You have the right to access, correct, delete, restrict processing of, and receive a portable copy of your personal data. You have the right to withdraw consent at any time, without affecting the lawfulness of processing conducted before withdrawal; withdrawal is available in the app through Settings, by the same kind of act and through the same interface you used to give the consent, and also by email (§ 5 of the Consumer Health Data Privacy Policy). For the optional about-you answers (§ 2), which you give by choosing an answer during setup, withdrawal is the Clear age, gender and location control on the Memory page in Settings, which removes them. Where you withdraw consent in the app, your data is retained rather than erased so that you can restore your access by consenting again; you may request erasure at any time, on the same screen or through the rights-request workflow described below. You have the right to lodge a complaint with your local supervisory authority (EU users: see https://www.edpb.europa.eu/about-edpb/our-members_en; UK users: https://ico.org.uk/; Swiss users: https://www.edoeb.admin.ch/). Providing intake data is necessary for the contract: without it, nodu cannot generate personalized sessions.

Right to object. You have the right to object, on grounds relating to your particular situation, to any processing nodu bases on legitimate interest (Art. 21).

Automated decision-making. nodu uses automated routing to select session templates appropriate to your intake. nodu also runs automated safety screening over inputs at generation time, which can decline to generate a session and display crisis resources instead; this screening is protective and informational, and it does not deny you the service overall. Neither the routing nor the screening produces legal or similarly significant effects on you within the meaning of GDPR Article 22.

International transfers. IRJG operates from the United States. When your personal data is transferred from the EEA, UK, or Switzerland to the US, it is processed by IRJG and its service providers under the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent transfer mechanisms, supplemented as required by the Schrems II decision. You can obtain a copy of the relevant safeguards (with commercial terms redacted where necessary) by emailing privacy@trynodu.com.

Data controller. The data controller for your personal data is IRJG Ventures, Inc., reachable at privacy@trynodu.com.

EU and UK representative (Art. 27 GDPR / Art. 27 UK GDPR). IRJG values your privacy and your rights as a data subject and has therefore appointed Prighter Group with its local partners as IRJG's privacy representative and your point of contact for the European Union (EU) and the United Kingdom (UK). Prighter gives you an easy way to exercise your privacy-related rights (for example, requests to access or erase personal data). To contact IRJG via IRJG's representative or to make use of your data subject rights, please visit https://app.prighter.com/portal/14001499687.

Switzerland (FADP Art. 14). IRJG has not appointed a Swiss representative under Article 14 of the Swiss Federal Act on Data Protection because IRJG's processing of Swiss-resident data does not currently meet that article's cumulative criteria — specifically, the processing is not "on a large scale" and "carried out regularly" within the meaning of FADP Art. 14(1)(b) and (c). Swiss residents may exercise their FADP rights directly by emailing privacy@trynodu.com; IRJG honors the same response windows and rights described in this section. IRJG monitors Swiss-resident usage on a recurring basis under an internal monitoring tripwire and will appoint a Swiss representative if and when those criteria are met.

Exercising your rights. Email privacy@trynodu.com. IRJG will respond within 30 days, extendable by an additional 60 days where reasonably necessary, with notice to you.

7. Retention and server logging

Account-linked content. Intake responses, generated sessions, memory cards, rolling summaries, journal entries, chat-derived memory records (the observations and narrative summaries nodu distills from your coach conversations to personalize future sessions), and freeform session memory (the per-session summaries and themes nodu distills from your freeform sessions, and the durable personalization facts derived from them) are retained until you request deletion. Self-serve deletion through Settings is processed synchronously for app-side data: when you confirm deletion, IRJG deletes the data described in § 9 within the request itself. Vendor-side data follows each provider's deletion mechanism described in §§ 4.1 and 9 — an automated purge for ElevenLabs speech-generation history (at least monthly as committed, daily in current operation), the contracted retention limit for Anthropic — and is gone within the rights-request response windows in § 20, in accordance with the contracts described in § 4 — except, for Anthropic, content flagged under Anthropic's usage policy, which follows the extended windows described in § 4.1.

Coach-conversation transcripts. nodu retains the raw transcript of your coach conversations for no more than 90 days from capture, for the bounded quality, diagnostic, and safety-verification purposes described in § 3 of the Consumer Health Data Privacy Policy. Transcripts older than 90 days are purged by an automated daily job, and all of your transcripts are deleted immediately when you delete your account (§ 9). Transcripts are never used to train AI models.

Generation records. For each generated session, nodu retains the assembled generation prompt (the personalized instruction text built from your intake and memory to produce that session) together with the session script it produced, for no more than 90 days from capture, for the same bounded purposes described in § 3 of the Consumer Health Data Privacy Policy. Generation records older than 90 days are purged by the same automated daily job, and all of your generation records are deleted immediately when you delete your account (§ 9). Generation records are never used to train AI models.

Browser privacy signals. The record of a Global Privacy Control or Do Not Track signal nodu received on your behalf (§ 21) is retained until you delete your account, at which point it is deleted with the rest of your account data.

About-you answers. The optional about-you answers described in § 2 are retained until you clear them in Settings or delete your account, whichever comes first.

Sign in with Apple. Where you created your account with Sign in with Apple, the Apple identifier and the revocation token described in § 2 are retained for the life of your account and deleted when you delete it, as described in § 9. The token is stored so that only IRJG's server can read it, is never included in anything the app displays or returns to you, and is never written to IRJG's logs. It cannot be used to read anything from your Apple ID; its only function is to withdraw nodu's own access.

Reminder notifications. A device registration for reminder notifications — the push token, its platform, and the device's UTC offset — stays active while your account exists and reminders are on. It is revoked — marked inactive and never used to send you anything again — when you turn reminders off, when you sign out on that device, and when the platform reports the device is no longer registered; as § 2 describes, the inactive record is kept rather than removed, so that reminders can tell a person who has a working device from a person who once had one. It is deleted outright when you delete your account. If a device stops confirming itself for 30 days, the registration is treated as no longer reachable and is not used.

Consent log. Consent-log records are retained while your account exists and for up to 3 years after your most recent consent; they are de-identified when you delete your account, and any records not previously de-identified are de-identified by an automated sweep at the end of that period: the user_id and session_id (the fields that directly identify you) are removed, and the remaining audit fields are retained for compliance audit purposes — the timestamp, the document version, the consent event type (which checkbox was presented and whether it was accepted), a request identifier, and a one-way hashed form of the IP address recorded at the time of consent. The hash is computed with a secret key held only on IRJG's servers, so the stored value cannot be turned back into your address by anyone who obtains the record without also holding that key. It is retained as part of the tamper-evident record that a given consent event occurred.

Server request logging. IRJG's server is configured not to write raw intake, journal, or memory-card content to request logs. Server logs contain only operational metadata (user ID, run ID, prompt template ID, queue cursor, error codes) and not free-text user input. This configuration was last verified by an internal code audit on 2026-09-02.

Product-usage and diagnostic event records. The first-party event records nodu creates about how the product is used (§ 3), and the per-session operational records used for diagnostics, are purged on a rolling 90-day schedule; the purge runs weekly, so an individual record can persist for several days past the 90-day mark, and all such records are deleted earlier when you delete your account. Other account-linked operational records (for example, reminder send records and spend records) are retained until you delete your account. Hosting-provider server logs follow the hosting provider's own retention, as described under Server request logging above.

Safety-screening records. nodu's automated crisis screening (described in § 3 of the Terms of Service and on nodu's published safety page) keeps a small set of records when it shows a referral notice in place of a normal response: a ledger entry counting the notice, which holds no names, no account identifiers, and no message content, and is retained indefinitely in that identifier-free form so the number of notices can be reported where law requires; a record that a session request was replaced by a notice, kept with your session records, with an operational log entry that follows the 90-day window above; and short-lived internal markers that keep the text that triggered a notice out of future session personalization. No person is notified which account was shown a notice, and none of these records is shared.

Subscription and payment records. Subscription metadata and billing records are retained for the period required by US tax and accounting law, and are removed once it expires. These records are held under a records-retention practice rather than an automatic expiry, and they are the one category that survives deletion of your account, as § 9 describes: a record that a transaction occurred is a legal obligation IRJG cannot discharge by deleting it.

Backups and disaster-recovery copies. Backups are purged on the next rotation cycle following account deletion. nodu relies on Supabase Pro daily backups, which retain a rolling 7 days of daily snapshots. The backup window varies with Supabase tier and is updated here when it changes.

Aggregated, anonymized, or de-identified data. May be retained indefinitely; this data cannot be used to identify you and is not subject to this Privacy Policy. IRJG maintains such data only in de-identified form, does not attempt to re-identify it, and contractually requires any recipient of it to commit to the same.

Support and rights-request correspondence. Retained for the period needed to fulfill the request and demonstrate compliance with the response timelines in § 20, then deleted, unless longer retention is required by an open legal matter.

Vendor-side retention. Beyond IRJG's instructions, vendor-side retention follows each vendor's own published retention policy. See § 4.1 for AI-provider specifics.

8. User rights

Depending on where you live, you may have rights to access, confirm, correct, delete, or receive a copy of your data, to withdraw consent, to object to certain processing, and to appeal a denial. IRJG honors rights workflows for CCPA and CPRA, MHMDA, GDPR, UK GDPR, Swiss FADP, and other applicable US state privacy laws through privacy@trynodu.com. See § 20 for the rights-request workflow. Three things can additionally be done directly in the app, without writing to anyone: withdrawal of consent, through the Consent & Policies screen in Settings; clearing your optional about-you answers, through Clear age, gender and location on the Memory page in Settings; and deletion of your data, as described in § 9.

9. Self-serve account deletion

You can delete your account and associated nodu data from Settings → Account → Delete My Data. The app-side deletion is synchronous and permanent. When you confirm deletion, IRJG:

• deletes account-linked database rows for intake responses, journal entries, memory cards, rolling summaries, session records, metrics rows, and spend-ledger rows;
• deletes coach-conversation transcripts and the chat-derived memory records (observations and narrative summaries) distilled from them;
• deletes generation records (the assembled generation prompt and produced session script pairs retained for the bounded diagnostic window described in § 7);
• deletes freeform session memory records (the per-session summaries and themes distilled from your freeform sessions, and the personalization facts derived from them);
• deletes the record of any browser privacy signals (Global Privacy Control, Do Not Track) received on your behalf;
• deletes reminder send records and the reminder opt-out record, and every device registration held for reminder notifications, where reminders have been active for your account. IRJG describes any such feature in §§ 3 and 4 before it begins sending, and did so for this one;
• deletes your answer to the optional setup question about how you found nodu, where you gave one;
• deletes your answers to the optional about-you questions, where you gave any;
• deletes generated session audio from storage;
• removes any local fallback files;
• de-identifies consent-log records by removing user_id and session_id (the directly identifying fields) while retaining the de-identified legal audit trail described in § 7 (timestamp, document version, consent event type and acceptance value, request identifier, and a one-way hashed IP);
• where you created your account with Sign in with Apple, deletes IRJG's stored copy of the Apple token described in § 2 and asks Apple to withdraw nodu's access to your Apple ID. Your deletion completes whether or not Apple can be reached at that moment, because a data right never waits on another company; if that request does not go through, you can also remove nodu yourself at any time from your Apple ID settings, under Sign in with Apple;
• deletes the Supabase auth identity last, after all app-owned data is gone.

Vendor-side deletion (Anthropic and ElevenLabs) is not part of the synchronous endpoint; it follows the mechanism each vendor offers, promptly, and in any event within the response windows in § 20. Subscription and billing records are retained as described in § 7 notwithstanding account deletion. For Anthropic, session-generation inputs and outputs age out under Anthropic's published 30-day default-retention purge — the deletion mechanism on its standard API tier, which offers no separate per-user deletion channel — and records processed during operational sessions follow the verified retention terms of the operator's tooling account as described in § 4.1; for ElevenLabs, IRJG's automated purge of speech-generation history (§ 4.1) — committed at least monthly, running daily in current operation — erases vendor-side script content for all accounts on a rolling basis, without waiting for any request.

If a deletion request fails partway through, IRJG remediates manually within a reasonable amount of time from when IRJG becomes aware of the deletion failure.

10. Do Not Sell or Share

IRJG does not sell personal data or consumer health data, in any circumstance, in any jurisdiction. IRJG does not use the data you share with nodu, or any data the application collects about you, for cross-context behavioral advertising, targeted advertising, or profiling for advertising purposes; this commitment applies regardless of your jurisdiction. Consumer health data is never used or shared for any advertising purpose, without exception.

One narrower marketing-site practice is disclosed here rather than left to inference. The homepage of the public marketing site, which names no habit, carries Meta's advertising measurement pixel for site visitors from the United States, under the opt-out standard described in § 14. The visit data it collects — never anything you share with nodu, never sensitive personal information, and never consumer health data — is "shared" with Meta in the sense § 18 describes, and the § 18 opt-out right and the Global Privacy Control suppression in § 21 apply to it.

11. Children

nodu is for adults age 18 and older only. IRJG does not knowingly collect personal data from anyone under 18.

nodu uses age attestation (a checkbox during onboarding by which you affirm you are 18 or older) as its age gate; IRJG relies on your attestation and does not independently verify age. The attestation is recorded in the consent log. Paid nodu subscriptions are purchased through Apple's In-App Purchase system, which requires an Apple ID with a valid payment method; this provides additional friction but is not an age check.

If IRJG learns that a person under 18 has provided personal data to nodu, IRJG will delete the account and associated data; where possible, IRJG will notify the user before deletion.

12. Security

Data is encrypted in transit (TLS) and at rest. nodu is not end-to-end encrypted: IRJG and its service providers can technically access your data to operate the service. IRJG also uses access controls, role-based permissions, multi-factor authentication on the cloud-vendor consoles through which IRJG administers the service (Supabase, Vercel, Railway, RevenueCat, App Store Connect, Sentry, Cloudflare, Resend, Google Workspace, Anthropic, ElevenLabs, GitHub, Expo), and provider-level security features. nodu does not currently expose an in-app administrative console to end users.

No system is perfectly secure. If IRJG determines that a breach has occurred that affects your personal data and triggers a notification obligation under applicable law, IRJG will notify you by email without undue delay and within any period required by the law of your jurisdiction; IRJG's goal is to provide that notice within 72 hours of confirming the breach. See § 17.

13. AI processing and AI-generated content disclosure

nodu uses AI providers to turn your intake into personalized sessions. Sessions are AI-generated, not written or reviewed by a human author before delivery. The conversational coach in nodu is likewise an automated AI system — not a human being and not a licensed professional. Sessions may reflect the limits of automated systems, including occasional inaccuracies or phrasing that does not match what you would expect.

nodu is not a substitute for professional medical, mental-health, or therapeutic care.

Crisis resources. nodu is not monitored in real time. If you're in crisis, please reach out to one of the resources below immediately.

In the United States:

• Call or text 988 for the Suicide & Crisis Lifeline
• Text 741741 to reach the Crisis Text Line
• Call 1-800-662-4357 for the SAMHSA National Helpline
• Call 1-800-GAMBLER for gambling-related crisis support

In Europe (EEA, United Kingdom, and Switzerland):

• Call 112 from any EEA country, the United Kingdom, or Switzerland for emergency services (police, fire, medical)
• Call 116 123 to reach the harmonised European emotional-support / suicide-prevention helpline (free, 24/7; coverage varies by country, operated locally by Samaritans in the United Kingdom and Ireland, Telefon-Seelsorge in Germany, and similar member organisations elsewhere)
• In France, call 3114 for the national suicide-prevention helpline (free, 24/7)
• In the Netherlands, call or chat with 113 Zelfmoordpreventie (call 113 or 0800-0113; free, 24/7)
• In Switzerland, call 143 (Die Dargebotene Hand / La Main Tendue / Telefono Amico) for emotional support
• In the United Kingdom, text SHOUT to 85258 for free, confidential text-based crisis support
• For country-specific suicide-prevention and gambling helplines anywhere in Europe, see https://findahelpline.com/ or https://www.iasp.info/suicidalthoughts/

If you're in immediate danger, call your local emergency services now.

14. Advertising, session replay, analytics, and error monitoring

Advertising, session replay, and analytics tools nodu does not use. nodu does not use ad pixels, session-replay tools, or analytics that capture free-text on health-data surfaces. Specifically, nodu does not use Google Analytics, Mixpanel, Amplitude, Segment, PostHog, Heap, Hotjar, FullStory, LogRocket, Microsoft Clarity, Smartlook, the Meta pixel, the TikTok pixel, or Google Ads pixels in the application. The nodu iOS app ships its typefaces inside the app and makes no font request to any third party; the web application loads Google Fonts to render typography, which is a font-asset request that does not place tracking cookies or build a behavioral profile.

Measurement inside the application. IRJG measures how nodu and its subscription flow are used with first-party records it creates itself: for example that a session was generated, that a subscription offer was shown or declined, or that an account completed setup. These records are created by nodu's own servers rather than by any third-party tag, which is why the tools listed above remain absent from the application. Where you have answered the optional setup question about how you found nodu, that answer is stored with your account and joined to those records so IRJG can tell which channels bring people who go on to use the product. It is a fixed choice from a short list, never free text. That answer is not used to advertise to you and is not joined to any identifier held by an advertising platform, and if IRJG ever changes that, IRJG will update this section first. The same holds for the optional about-you answers described in § 2: they are stored with your account, read by IRJG as counts, never disclosed to an advertising platform or an analytics provider, and never used to advertise to you.

The public marketing site. The public marketing and landing pages are maintained separately from the application. The marketing site uses first-party, privacy-preserving measurement: server-side page counting and campaign attribution based on the link parameters of the page you arrived on. Every page about a specific habit carries no third-party ad pixels, no session-replay tools, and no behavioral analytics, and will carry none while this Policy stands; the same is true of the site's FAQ page. No page of the marketing site carries session-replay tools or behavioral analytics.

Exactly one page, the homepage, which names no habit, additionally carries a third-party advertising measurement tag: Meta's pixel, from Meta Platforms, Inc., used to measure whether Meta's ads led people to visit and to tap through to the App Store, and to improve how those ads are delivered. Since 2026-10-05 it sends Meta a page view when the homepage loads and an event when the App Store button on it is tapped, together with the page's address and the identifiers Meta's tag collects in the browser, such as the network address, browser details, Meta's cookies, and an ad-click identifier where the visit followed an ad. It sends nothing you share with nodu and no contact details. It operates as follows: (i) IRJG disclosed it in this section first, and updates this section before any change to the pages, the events, or the platform; (ii) it operates under the opt-out standard United States law sets for such measurement — notice at collection in this section, a Do Not Sell or Share My Personal Information link on the marketing site, where a button also opts that browser out, and treatment of a Global Privacy Control signal as suppressing every such tag for that visit (§ 21); (iii) it is configured to load only for visits from the United States; and (iv) it receives visit data from the homepage only, never from any page about a specific habit: the site moves between pages by full page loads, so the tag does not follow a visitor onto another page, and links from nodu's pages pass on only the site's address.

Email collection on the marketing site. The marketing pages host no signup form and collect no email address or other information you provide about yourself. Beyond serving the pages, their processing is the first-party measurement described immediately above and, on the homepage only, the advertising measurement tag disclosed above. They link to the nodu application, where any account you choose to create is governed by the rest of this Policy. If IRJG ever collects email addresses directly on the marketing pages, IRJG will update this section before that collection begins.

Do Not Track and Global Privacy Control on the marketing site. IRJG honors Global Privacy Control on the marketing site by suppression at the point of collection, as described in § 21: for a visit carrying a Global Privacy Control signal (or Do Not Track, which nodu treats the same way there), no advertising measurement tag is loaded and nothing such a signal opts out of is transmitted. Meta's pixel on the homepage is the tag that suppression acts on, and pressing the opt-out button on the Do Not Sell or Share page has the same effect in that browser on every later visit. The pages about specific habits never carry a tag.

Error monitoring (Sentry). IRJG uses Sentry for error monitoring. Sentry is configured to:

• forward only error-level and fatal-level events;
• scrub user-input fields (intake responses, journal text, memory-card text, safe-place text, and generated session script text) from breadcrumbs, contexts, extras, request bodies, and user context before events are sent;
• drop UI-input breadcrumbs on the browser.

One thing Sentry does receive, stated plainly rather than left to the word "scrubbed": an error raised while a session is running is tagged with your account identifier, so that a fault can be traced to the run it broke. The identifier is an internal reference, not your email address or your name, and it travels without any of the content listed above.

Sentry was enabled in production only after end-to-end scrubbing was verified against a production-side test event on 2026-04-30; that verification is recorded in IRJG's internal privacy-operations records and can be re-verified on request. If at any time scrubbing cannot be verified, Sentry is disabled.

15. Legal disclosures

IRJG may disclose personal data when required to do so by law, including to comply with subpoenas, court orders, search warrants, or other lawful requests by public authorities, and to enforce IRJG's Terms of Service or protect the rights, property, or safety of IRJG, its users, or others. Where permitted, IRJG will notify affected users before disclosing their personal data in response to a legal request.

16. Business transfers

If IRJG is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, your personal data may be transferred as part of that transaction. IRJG will provide notice (through this Privacy Policy or by direct communication) before personal data becomes subject to a different privacy policy.

17. Breach notification

If IRJG determines that a reportable breach has occurred, IRJG will notify affected users by email without undue delay and within any period required by applicable law. IRJG's goal is to provide that notice within 72 hours of confirming the breach.

18. California residents (CCPA / CPRA)

This section supplements the rest of this Privacy Policy and applies to California residents.

Categories of personal information collected in the past 12 months:

• Identifiers — email address, account ID, hashed IP address, and a device identifier processed by nodu's subscription-management provider (RevenueCat) when you use the iOS app;
• Customer-record information — account credentials, subscription metadata received through RevenueCat;
• Characteristics of protected classifications under California or federal law — your age range and your gender, where you answered the optional about-you questions;
• Geolocation data — the state or country you live in, where you answered the optional about-you question. This is what you choose to tell nodu; nodu does not collect your device's location;
• Internet/network activity — usage logs, technical/security data, first-party product-usage records, and (where you answered the optional setup question) how you first heard about nodu;
• Sensory information — generated session audio created through the service;
• Inferences — internal personalization signals derived from your intake;
• Sensitive personal information — account credentials; health, mental-state, and behavioral information you provide during intake.

Sources of this information are: you, your device, and IRJG's service providers (limited to technical data and, in the case of RevenueCat, subscription metadata).

Business and commercial purposes for using this information are listed in § 3. IRJG discloses the categories above to the service providers listed in § 4 for those business purposes; IRJG does not otherwise disclose personal information for a business purpose. The retention period or criteria for each category are described in § 7.

No sale; sharing limited to disclosed marketing-site measurement. IRJG does not "sell" personal information, and does not "sell" or "share" sensitive personal information, in any circumstance. IRJG does not "share" personal information for cross-context behavioral advertising under the CCPA, with one disclosed and narrowly bounded exception: on the marketing site's homepage named in § 14, the identifiers and internet-activity information Meta's pixel collects from the visit — never sensitive personal information, never consumer health data, and never anything you share with nodu — are "shared" with Meta within the meaning of Civil Code § 1798.140(ah).

Your California rights. You have the right to know, access, correct, delete, opt out of sale or sharing, and limit use of sensitive personal information. IRJG does not sell personal information, so the opt-out of sale has nothing to act on. The opt-out of sharing applies to the marketing-site measurement described above where it occurs: exercise it through the Do Not Sell or Share My Personal Information link on the marketing site, by sending a Global Privacy Control signal (§ 21), or through the workflow in § 20.

Right to limit use of sensitive personal information. IRJG has already limited its use of your sensitive personal information to the purposes permitted by California Civil Code § 1798.121(a) and its implementing regulations — providing the service you have requested. IRJG does not infer characteristics about you from sensitive personal information for any other purpose, and does not use sensitive personal information for advertising or commercial purposes beyond providing nodu to you. As a result, no additional action is required when you exercise the right to limit. If you believe sensitive personal information is being used for an impermissible purpose, contact privacy@trynodu.com.

Authorized agents. You may use an authorized agent to submit a request. IRJG may require proof of authority and may ask you to verify your identity directly.

California "Shine the Light." Except as described in § 14 for the marketing-site advertising measurement, IRJG does not disclose personal information to third parties for their own direct marketing purposes.

Appeals. If IRJG denies your request, you may appeal by replying to the denial email or contacting privacy@trynodu.com.

19. Other US state privacy laws

For residents of Washington, Nevada, Connecticut, Maryland, and other states with consumer-health-data or comprehensive privacy laws, IRJG provides the rights and disclosures required by your state's law. Specific consumer-health-data rights are described in the separate Consumer Health Data Privacy Policy; comprehensive-privacy-law rights (access, correction, deletion, portability, opt-out) are honored through the rights-request workflow in § 20.

20. Rights-request workflow

To exercise your rights, email privacy@trynodu.com from the email address tied to your account. IRJG may request one round of clarifying questions to verify your identity. IRJG responds within:

• 30 days for GDPR, UK GDPR, and Swiss FADP requests (extendable by an additional 60 days where reasonably necessary, with notice);
• 45 days for CCPA, MHMDA, and other US state-law requests (extendable by an additional 45 days where reasonably necessary, with notice).

If IRJG denies a request, the denial email includes the reason and a short appeal path. IRJG does not retaliate or discriminate against any user who exercises a privacy right.

21. Cookies and browser privacy signals

The nodu iOS app does not use cookies; it keeps you signed in with an authentication session token stored securely on your device. Where the nodu web application is open to you, it likewise keeps you signed in with an authentication session token stored in your browser's local storage rather than in a cookie. Neither client sets advertising cookies, third-party analytics cookies, or tracking pixels.

On the public marketing site, the homepage named in § 14 carries Meta's pixel for visits from the United States, under the standard described there, and the pixel may set and read Meta's cookies in the browser on that page. No other page loads a third-party tracker, and no page about a specific habit ever does. If you press the opt-out button on the Do Not Sell or Share page, the site stores that choice in your browser so that it applies on later visits. Because no account exists on the marketing site to record a preference against, Global Privacy Control signals there are honored by suppression at the point of collection: nothing that a Global Privacy Control signal opts out of — including any § 14 tag — is loaded or transmitted for that visit.

IRJG honors Global Privacy Control (GPC) signals universally. When an authenticated browser sends a Sec-GPC: 1 header, or sets the equivalent JavaScript signal, nodu records the signal against the user's account and treats it as a valid opt-out of any sale, sharing for cross-context behavioral advertising, or targeted advertising. The application engages in none of these; on the marketing site, the only such practice is the disclosed § 14 measurement, which is suppressed for any visit carrying the signal. The recorded signal applies prospectively to any future change. To request a copy of the privacy preferences nodu has recorded against your account, use the rights-request workflow in § 20.

Some places in the app open pages that IRJG does not operate: Apple's subscription-management settings, the crisis resources listed in § 13, and a public service-status page that shows whether nodu's systems are reachable even when the app cannot tell you itself. These open outside the application — in your browser or in the relevant Apple interface — and each is governed by its operator's own terms, privacy practices, and cookie choices rather than by this Policy. nodu sends these operators no information about you or your account; when you follow such a link, the operator receives only what your browser ordinarily provides when you visit any website. The application itself remains exactly as described above: it sets no advertising cookies, no third-party analytics cookies, and no tracking pixels.

22. Changes to this policy

If this Privacy Policy changes in a material way, IRJG will update the version and effective date and may require renewed consent. Non-material updates may also be reflected through a version and effective-date update without renewed consent.

Before publishing each material version, IRJG verifies that the in-app re-consent flow surfaces the new version distinctly from prior versions and records a new consent-log row on acceptance.

23. Effective date and version

Effective date: 2026-10-03 Version: v10-2026-10-03