Privacy Policy

1) Information we collect

• Account & profile: name, email, avatar, and identifiers created by our authentication provider (Supabase Auth).
• Household data: membership, roles (owner/adult/child), child names you enter, invites you send, and settings (e.g., time zone, quiet hours).
• Items you create: meds, bills, lists, notes, reminders, and similar content you choose to store and share.
• Device & usage: app version, device tokens for notifications, basic event metadata, and crash diagnostics.
• Payments: subscription status and related metadata processed by Stripe (we never store full card details on our servers).
• Support: messages and feedback you send us.

2) How we use information

• Provide core features (households, lists, reminders, notifications).
• Authenticate users and protect accounts from abuse and fraud.
• Process subscriptions and billing via Stripe.
• Send transactional messages (invites, receipts, critical notices).
• Improve reliability and performance; troubleshoot crashes and incidents.
• Comply with legal obligations and enforce our Terms.

3) Legal bases

Where required (e.g., EEA/UK), we process personal data on the following bases: to perform our contract with you; our legitimate interests in providing and improving the Services; your consent where applicable; and compliance with legal obligations.

4) How we share information

We do not sell personal information. We share only as needed:

• Service providers: infra, auth/storage (Supabase), payments (Stripe), push notifications (Expo/OS services), email delivery, and crash/quality tooling—under agreements consistent with this Policy.
• Household members: content you add to a household is visible to that household per roles and settings.
• Legal: to comply with law, protect rights, or respond to lawful requests.
• Business transfers: in a merger, acquisition, or asset sale, subject to this Policy.

5) Data retention

We retain information while your account is active and for a reasonable period thereafter to maintain records, comply with law, and resolve disputes. You can request deletion of your account and data (subject to legal or operational needs).

6) Security

We use administrative, technical, and physical safeguards designed to protect your information (including encryption in transit and at rest where supported). No system is 100% secure—please keep your credentials safe.

7) Children

Adult users may create “child” roles in a household. We don’t knowingly collect personal data directly from children without appropriate consent. If you believe we’ve collected a child’s data improperly, contact us and we’ll remove it.

8) International transfers

We and our providers may process data in the U.S. and other countries. Where applicable, we rely on appropriate safeguards for cross-border transfers.

9) Your rights & choices

• Access, correct, or delete your data (subject to limits).
• Export data where supported.
• Object to or restrict certain processing where applicable by law.
• Opt out of non-essential emails; control device notification settings.
• EEA/UK/California residents may have additional rights—contact us to exercise them.

10) Changes to this policy

We may update this Policy from time to time. We’ll post the new date above and, when appropriate, notify you via the app or email. Your continued use means you accept the updated Policy.

11) Contact us

Questions or requests? Email nooli.helpdesk@gmail.com.

12) Data deletion

You can request deletion of your Nooli Household account or specific data at any time by emailingnooli.helpdesk@gmail.com. Once verified, we permanently delete your account data (households, reminders, and related records) within 30 days, except where retention is required for legal or billing purposes.