Privacy Policy

Nothing Superapp collects the minimum information needed to run the Service. This policy explains what we collect, why, and what we don’t do with it.

What we collect

• Account — email address, an optional display name, your locale preference.
• Subscription — Stripe customer ID + subscription status (Stripe holds your payment method, we never see the card).
• Your logs — meals you record, workouts you complete, pomodoros you finish. Row-level security means only your session can read your own rows.
• Preferences — theme, daily calorie goal, notifications toggle.
• Chat messages — copilot conversations are persisted server-side (row-level security means only your session can read your threads). Delete a thread from the assistant drawer to remove it permanently.

What we don’t collect

• Cookies for advertising. We use only auth-session cookies.
• Analytics fingerprints. No PostHog / Mixpanel / Google Analytics.
• Device identifiers beyond what your browser normally sends.
• Location data.

Third parties we use

• Supabase — Postgres + auth. Your data lives here, in the EU-West-1 region.
• Stripe — payment processing. Handles your card, billing address, receipts.
• Moonshot AI (Kimi K2) — the copilot backend. Your question + a JSON summary of your recent app data is sent as prompt context; Moonshot processes it to stream a response and does not (per their terms) train on customer prompts.
• Gym Visual — exercise animation media hosted from their CDN. Loading a Gym mini-app page reveals your IP to their server as any web fetch would.

Retention & export

Your data is retained while your subscription is active. Cancel and the data stays for 30 days in case you resubscribe, then it’s deleted. Email us to request an export or immediate deletion: jmadrazo7@gmail.com.

Rights (EU/UK)

You have the right to access, correct, export, and delete your data at any time. Contact jmadrazo7@gmail.com and we’ll respond within 30 days.

Contact

Questions: jmadrazo7@gmail.com