Privacy Policy
Last updated: October 2026
Data Controller
The data controller for Noova is: Noova LLC Milwaukee, Wisconsin, USA privacy@noova.app
What we collect
We collect the information you give us directly: your email address when you create an account, the tasks and notes you save, and any voice input you record for brain dumps.
How we use it
Your content is processed by AI models to turn brain dumps into structured tasks and to sync your data across your devices. We do not sell your data or share it with advertisers.
How to delete your data
You can permanently delete your account and all associated data at any time from the Profile screen using "Delete my account". You can also email privacy@noova.app and we will remove your data within 30 days.
AI Processing
Your voice and text brain dumps are processed by Anthropic's Claude AI to extract structured tasks and build your personal memory profile. Anthropic processes this data under their API terms. Your content is not used to train AI models. Data is not retained beyond the duration of the request.
Google API Services Disclosure
Noova's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs adheres to the Google User Data Policy, including the Limited Use requirements. Noova does not use Google Calendar data to develop, improve, or train generalized AI or ML models. Noova does not sell Google user data.
Google Calendar Data
If you choose to connect Google Calendar, Noova requests one permission: https://www.googleapis.com/auth/calendar.app.created This permission lets Noova create a separate calendar named "Noova" in your Google account and add events to that calendar only. Noova cannot see, read, or change your other calendars or any of your existing events. Noova does not read events from Google Calendar. What we use it for: if you turn on "Log completed tasks to calendar", Noova adds one event to your Noova calendar when you complete a task you timed with the focus timer. The event contains the task title, a short description such as "Created by Noova", and the start and end times of your session. We use Google Calendar data only to provide this feature. We do not use it for advertising, we do not sell it, and we do not share it with third parties except to operate the feature as described here. What we store: the access and refresh tokens Google issues to Noova, and the identifier of the Noova calendar. The events themselves live in your Google Calendar. Retention and deletion: we keep these tokens until you disconnect Google Calendar on the Integrations screen or delete your account. Either action deletes the tokens and calendar identifier from our database. Events already on your Noova calendar stay in your Google account until you remove them. You can also remove Noova's access at any time at myaccount.google.com/permissions.
How We Protect Google User Data
We protect Google user data in these ways: • Encryption: data is encrypted in transit using TLS and encrypted at rest by our database provider, Supabase. • Server-side token exchange: Google's authorization code is exchanged for tokens on our server. Our Google client secret is kept in server-side configuration and is never placed in the app or your browser. • Sign-in protection: every connection attempt uses a single-use random state value that expires after 10 minutes, and we confirm Google granted the expected permission before we store anything. • Rate limiting: Google Calendar connection and token requests are rate limited per account. • Minimum permission: we request the narrowest Google Calendar permission that supports the feature. • Limited human access: we do not allow humans to read your Google user data unless we have your affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data is aggregated and anonymized for internal operations.
Third-Party Processors
We use the following trusted third-party services to operate Noova: • Anthropic (Claude AI) — processes your brain dump text to extract tasks and memories. Data is not retained beyond the request. anthropic.com/privacy • Supabase — stores your encrypted data on secure servers in the US. supabase.com/privacy • RevenueCat — manages your subscription and purchase history. revenuecat.com/privacy • Stripe — processes web payments for subscriptions. stripe.com/privacy • Resend — sends transactional email such as password resets and account notices. resend.com/privacy • Twilio — delivers SMS verification and check-in messages. twilio.com/privacy • Cloudflare — CDN, bot protection, and edge security. cloudflare.com/privacy • Google — optional sign-in if you choose Google authentication, and the optional Google Calendar connection described above if you turn it on. policies.google.com/privacy • Apple — optional sign-in only if you choose Sign in with Apple authentication. apple.com/legal/privacy Each processor is contractually bound to protect your data and may not use it for their own purposes.
Data Retention
We keep your data (account, tasks, brain dumps, AI memory) until you delete your account. You can delete everything at any time from your profile screen — this is immediate and irreversible.
Your Rights
Under GDPR you have the right to access, rectify, erase, and export your personal data, and to object to or restrict its processing. Contact us at privacy@noova.app to exercise these rights. We respond within 30 days.
EU Representative
Noova LLC is based in Milwaukee, Wisconsin, USA. As we serve EU/EEA users, we are in the process of appointing an EU representative under GDPR Article 27. EU/EEA users can contact us directly at privacy@noova.app in the meantime and we will respond within 30 days.
Cookie Policy
Noova does not use tracking cookies. We use your browser's localStorage only to store your language preference and your sign-in session. No advertising, analytics, or third-party tracking cookies are set.
Contact
Questions? Reach us at privacy@noova.app.
SMS Communications
We do not share, sell, or disclose your mobile phone number to third parties or affiliates for their own marketing purposes. Message frequency varies based on your account activity and preferences. Message and data rates may apply. Contact your wireless carrier for details.