Privacy.
Last updated · 2026-06-16
Noumi reads your birth pattern back to you. To do that I need a small, specific set of facts from you. This page is the honest list: what I take, who sees it, how long I keep it, and how to make me forget all of it.
What I collect
- · The name you tell me to call you by.
- · Your gender (male or female) — needed for the way I read your pattern across decades.
- · Your birth date (year, month, day) and birth time (if you know it).
- · Your birthplace — city, country, and the latitude/longitude/timezone that the city autocomplete gave us.
- · The email address tied to your Apple or Google sign-in.
- · The reading I write for you.
- · Lightweight product events (which onboarding step you saw, when you started or finished a reading, whether you tapped Share or Delete). These never carry your name, birth date, email, or location.
- · Standard error and performance telemetry. Request bodies and form inputs are not auto-captured.
Why each field
- · Name — so I can talk to you by name in the reading.
- · Gender + birth date/time/place — I need these to compute your reading. Without them I can't generate it.
- · Email — to sign you in and to make sure only you see your reading.
- · Reading text — saved so you can come back to your reading and so the share page works.
- · Product events — to understand where people drop off in onboarding so I can fix it. Aggregated, never sold.
Who sees it
I keep your data with these companies, who act as processors on my behalf:
- · Supabase — Postgres database and authentication. Your row of birth data and your reading live here. [REVIEW REQUIRED: region (e.g., Seoul, eu-west) — cross-border transfer disclosure depends on this.]
- · OpenAI — your reading is generated using OpenAI's API. The prompt includes your first name and information computed from your gender, birth date, birth time, and birthplace. Your email is not sent. Per OpenAI's API policy, API inputs and outputs are not used to train their models.
- · Geoapify — birthplace autocomplete. Your typed query string (e.g., "Seo") is sent to look up city + timezone. No account identifier is sent.
- · Sentry — error and performance monitoring. Request bodies and headers are not auto-captured. Errors are tagged with sanitized context only.
- · Vercel — hosting and CDN. Standard server logs (IP, user agent, URL) for operational purposes.
I do not sell your data. I do not run ad networks. I do not share your reading or birth data with anyone outside this list.
How long I keep it
Until you delete it. Your account, birth data, reading, and product events all live in your row in my database and stay there until you tell me to delete them. There is no automatic expiry.
How to delete everything
Open Settings (gear icon, top-right on your reading page), tap Delete everything I've shared with you, type the confirmation phrase, and confirm. This wipes your auth identity, your birth data, your reading, and every product event — instantly and permanently. There is no backup. If for any reason the in-app delete fails, contact us at the contact address below and we will run the delete manually.
Cookies
I use one kind of cookie: the Supabase authentication session cookie that keeps you signed in. There are no marketing cookies, no third-party advertising cookies, no cross-site trackers.
Children
Noumi is not intended for children under 16. If you believe a child has signed up, tell me at the contact address below and I will delete the account.
Your rights
You can delete your account from Settings. For access, correction, export, restriction, objection, or any other local data-protection request, contact us at the contact address below.
EU/EEA and UK (GDPR / UK GDPR)
You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time. You may lodge a complaint with your local data-protection supervisory authority.
California (CCPA / CPRA)
You have the right to know what personal information I hold about you, to delete it, to correct it, to limit the use of sensitive personal information, and to non-discrimination for exercising any of these rights. I do not sell or share your personal information, and Noumi does not run cross-context behavioral advertising.
Korea (PIPA)
You have the right to access, correct, delete, and request suspension of processing of your personal information. You may file a complaint with the Personal Information Protection Commission (PIPC) or the Korea Internet & Security Agency (KISA).
Other regions
Wherever you are, you can delete your account from Settings, or contact us at the contact address below to exercise any local data-protection right.
Security
Transport is TLS end-to-end. Database access is row-level-scoped: my own server code can only read your row when you are the one signed in. Service-role keys are kept on the server, never shipped to the browser.
Changes to this policy
If I change this policy materially, I'll update the date at the top and, when the change affects how I treat your data, notify signed-in users at next sign-in.
Contact
Privacy questions, deletion requests that can't go through Settings, or data-rights requests:
dear@noumi.im
[REVIEW REQUIRED: legal entity name + address]