Privacy Policy

1. Who is responsible?

The controller for the processing of your personal data is Simon Hediger, Hohlenweg 41, 5072 Oeschgen, Schweiz. Please direct privacy requests to [email protected].

2. In brief

• Your journal, mood, sleep, tasks, self-tests, favorites and activity history are stored locally. If you explicitly enable an available private cloud backup, this data including media is additionally backed up with end-to-end encryption.
• Our servers hold your account, your app settings and – only if you use the community and consent – your community content together with moderation data.
• We review community content automatically, first with our own filters, then with an AI service. It receives only the text and its context, never your name, email address or user ID.
• If the review detects signs of an acute crisis, only you can see the text and we immediately offer you private help. Authorised members of our team check this automated decision.
• We do not sell personal data. For non-personalized advertising, Google AdMob processes technical connection data, device identifiers, ad interactions and diagnostic data. Private diary, mood and sleep contents are not sent to advertising services.

3. Which data we process

Account and sign-in

For registration and sign-in we use Google Firebase Authentication, either with email and password or with your Google account. We process your email address, when you sign in with Google your name and the link to your profile picture, an internal user ID and the time of registration and last sign-in. We also store your app settings (appearance, notifications) in your profile.

A profile picture you select is first processed locally and then stored with your profile in Firestore. Diary images and diary audio are stored only locally in the current Android build.

Personal data, optional backup and private companionship

Your personal app data may include health information. Unless you explicitly enable an available backup, it stays local. Private backup includes journal text, images and audio, mood, sleep, tasks with subtasks and history, self-tests, activities, favorites and personal settings. Sign-in, payment rights and consents are not restored from a backup. Operating-system backups depend on your device settings.

When private companionship is available and you activate it, you choose the person, data, date ranges and expiry yourself. Messages, selected journal entries and separately selected media, shared mood and manually recorded sleep data are transferred with end-to-end encryption. Imported Health sleep, tasks and self-tests are not shared with companions. Your private backup key is not shared. Private messages are not analysed by AI.

Our private service receives ciphertext and technical metadata such as account association, approved devices, permissions, timestamps, sizes and appointment times. Contents are decrypted on devices. You keep keys on your devices and with your recovery key; a password reset cannot replace it. Generic push notifications contain no confidential descriptions. Your connected person can see your availability and expected response time.

Revocation and disconnection stop further access. Previously decrypted copies cannot be recalled. Without a valid subscription, new backups or companionship changes pause; existing backups remain recoverable. Companion history remains readable, and shared insights are available no later than their permission expiry. Export, revocation and deletion remain free. An urgent notice guarantees no immediate reply; companionship is not an emergency service. These features are for adults.

Community (optional)

If you use the community and explicitly consent, we process:

• your posts to daily questions and challenges, your replies to other people's posts and your reactions. They appear anonymously to other members; your name is not shown.
• the internal link between a post and your account. It serves only moderation, deletion and suspensions and is not visible to others.
• reports that you submit or that concern your content, with the reason for the report.
• review decisions, warnings, suspensions and appeals, including your appeal message and our reply.
• the record of your consent (version, time, language, withdrawal).
• for crisis support offers: the private notice shown to you and your device's push token so that we can notify you.

Community posts may contain information about your mental health. This is a special category of personal data (health data). We process it only on the basis of your explicit consent. Please do not write names, addresses or phone numbers in posts.

Age declaration for community access

The new onboarding version asks for your age group when you first open the app (under 16, 16–17, or 18 and over). We initially store completion of the introduction and your selection on your device. Once the declaration is associated with your signed-in account, we also store it in Firebase: age group, age-question version, self-declaration method and server timestamp. This happens before community consent, including if you do not open the community or are under 16. We use this declaration only to manage community access, not for advertising or to assess your health. We do not collect a date of birth, ID document or selfie for this purpose. You can correct an inaccurate declaration at the community access screen or contact us. Older app versions without the age question remain excluded from the community during the transition.

Technical data

Using the app and our servers generates technical data such as IP address, time of the request and device type. Our service providers process it to provide and secure the services.

Website

When you visit nafuu.app, OVHcloud as the hosting provider and Cloudflare for delivery and security process technical connection data, in particular the IP address, time and requested page. Fonts are served directly by our website; no connection to Google Fonts is needed. With your separate consent, we use Cloudflare Web Analytics on the public website to measure visits and loading times. Your choice is saved in a cookie for six months and can be changed using the privacy options in the footer. Without consent, the analytics script is not loaded. The companion portal does not use this analytics script. Further information is in the cookie notice.

Advertising and Premium

The free app may show non-personalized banner and video ads from Google AdMob. For advertising, measurement and fraud prevention, the Mobile Ads SDK processes data including IP addresses (from which an approximate location may be inferred), advertising and app set identifiers, ad interactions, and technical performance and diagnostic data. We do not pass health contents, diary text or content keywords to AdMob. Google UMP privacy choices are requested before loading ads; you can change your choice using the advertising privacy options in your profile. Premium prevents ads from loading.

We use RevenueCat and the relevant app store to manage the optional Premium subscription. RevenueCat receives your internal Firebase user ID and purchase, transaction and subscription information to provide access rights, purchase restoration and purchase statistics. Our app code does not pass names, email addresses or health contents to RevenueCat. Payment details such as card numbers are provided to the store; Nafuu does not receive them. Deleting an account does not cancel a subscription; manage or cancel it in the store.

Device sleep and step data

With your separate permission, Nafuu reads sleep sessions and sleep stages, and today's step count, from Health Connect (Android) or your device's health data interface. Steps are displayed only on the dashboard and are not saved or transmitted. Imported sleep records are compared with your own notes and ratings in the local sleep journal; these comparisons are not diagnoses or treatment recommendations. This data is not sent to advertisers, the community or companions. Private cloud backup is disabled in the current Android test build. You can disable sleep imports in the app, revoke access in Health Connect and remove sleep data in Profile > Delete data > Sleep. Nafuu does not write health records to Health Connect.

4. What we use your data for

We process personal data for the following purposes and rely on these bases (GDPR articles where it applies):

• Providing the app, your account and sign-in: contract or pre-contractual steps (Art. 6(1)(b) GDPR).
• Age group to enforce our community age limit of 16: our legitimate interest in protecting minors and restricting access to this area appropriately (Art. 6(1)(f) GDPR). This access control is separate from explicit consent to processing community content. You may object to the processing in accordance with applicable law; without the required age declaration, the community remains closed while the other app areas remain available.
• Running the community, including automated review, warnings, suspensions and crisis support: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you can withdraw at any time.
• Protecting the community and our services against abuse, security and troubleshooting: legitimate interests (Art. 6(1)(f) GDPR).
• Complying with legal obligations (Art. 6(1)(c) GDPR).

Under the Swiss FADP we process personal data transparently and proportionately for these purposes. We process health information in the community only with your explicit consent.

5. Automated review of the community

Posts and replies are reviewed automatically to protect the community. The review has two stages:

• Filters: Rule-based filters in our own Firebase environment detect obvious violations, for example links, phone numbers, email addresses, insults or calls to self-harm. Filtered texts go to no further service provider.
• AI review: Texts that pass the filters are sent through a server we operate to an AI service for a contextual assessment (for example hidden devaluation, encouragement of dangerous intentions or signs of an acute crisis). We name the providers and locations in section 6.

What is sent is your text, the related daily question or challenge, for replies the post being replied to, and any report reasons. Not sent are your name, email address, user ID and private diary content. Whatever you write in your text is sent along, so we ask you not to include personal data. The review server stores no execution logs. We call OpenAI with store: false. Sharing API inputs and outputs for model training is disabled in the organisation account we checked. OpenAI may nevertheless normally retain content for up to 30 days for abuse monitoring and security; legal or safety-related exceptions are possible. Temporary encrypted model caches may persist for up to 24 hours. Zero Data Retention is not promised.

Consequences: The review can hide or release content. A confirmed rule violation is linked to your account and leads to a warning; after three warnings, community actions are suspended, while reading and appeals remain possible. We make these decisions automatically. You can appeal, and a person on our side reviews the appeal, and you can request human review and state your view at any time (see section 13). Technical failures of the review never lead to warnings or suspensions.

Crisis support: If the AI review detects signs of an acute personal crisis in your text, such as suicidal thoughts, the text is not published but remains visible only to you. This does not count as a rule violation and never leads to a warning. You immediately receive a private offer of support: a message written by the AI and labelled as automatically written, in the language of your text, an explanation of why others do not see the text, and helpline numbers; if push permission was granted, also a push notification with a general text. Authorised members of our team see such cases with a text excerpt, a short reason and the message in order to check the automated decision; if it turns out to be a false alarm, the text is published. In addition, another member can report a post as a possible crisis. The published text is then also assessed automatically, without any information about your account; if the result is positive, you privately receive an offer of support with helpline numbers and, where applicable, a push notification. Such a report changes neither the visibility of the post nor leads to a warning.

6. Who receives your data

We do not sell personal data. The following service providers and platform operators are involved in processing:

• Google (Firebase): sign-in, database (location Europe), cloud functions (region Zurich) and storage for app content. The provider is Google Ireland Limited or Google LLC (USA).
• Hetzner Online GmbH: operation of our review server in Finland. Public audio and images are delivered from a separate Object Storage bucket in Nuremberg, Germany, which involves technical connection data. Public media and private user data are kept separate.
• OpenAI: AI review of texts. The API uses the global api.openai.com endpoint. Processing may take place particularly in the United States and through the appointed subprocessors; exclusively European processing is not promised.
• Expo (650 Industries, Inc., USA): delivery of push notifications. Expo receives your device's push token, a general notification text and an internal notice ID.
• Website: OVHcloud (Frankfurt, Germany); Cloudflare for DNS, delivery, security and consent-based website analytics.
• Authorized Nafuu administrators have access to community content, reports and review decisions for moderation, security and support.
• When private backup and companionship are available: a separate VPS and private object storage with Hetzner in Germany, holding encrypted contents. Your chosen companion receives only explicitly shared contents.
• Google AdMob / Google Mobile Ads: non-personalized ad delivery and measurement, and fraud prevention; processes technical connection data, ad interactions, diagnostics and device identifiers. The provider is Google Ireland Limited or Google LLC (USA).
• RevenueCat, Inc. (USA): Premium access rights, purchase association, restoration and purchase statistics using the internal user ID and store transactions.
• Proton AG, Switzerland: provision of the support email address. If you contact us by email, we process your sender address, message and any information you attach to handle your request.

Authorities or other third parties receive data only where we are legally obliged to disclose it or where it is necessary to protect rights and safety. If we change service providers, we update this policy.

7. Transfers abroad

Some service providers process data outside Switzerland and the EEA, particularly in the United States. The community database is in Europe; this does not exclude processing abroad by the other services listed. The respective privacy and data processing terms apply to these services. Where required for a transfer, safeguards include the EU Standard Contractual Clauses provided in those terms, with the relevant Swiss and UK adaptations. Firebase, RevenueCat and Cloudflare publish their corresponding terms. Contact [email protected] for information on the relevant safeguards and a copy. We do not promise exclusively European processing by all providers or Zero Data Retention.

8. How long we keep data

• Account and profile: until you delete your account.
• Account-linked age declaration for the community: the current declaration until it is corrected or you delete your account. A correction replaces the previous declaration; we do not maintain a separate immutable age history. Local completion of the introduction remains stored until local app data is reset.
• Community posts and replies: until you delete them individually or delete your account.
• Challenge participation, record of consent, warnings, suspensions and appeals: until you delete your account.
• Review records (decision, short reason, text preview): as long as the reviewed content is stored.
• Crisis cases for our review (text excerpt, short reason, automatically written message, our assessment): as long as the content concerned is stored.
• Private offers of support in your account: until you delete your account.
• Push token: until you sign out or delete your account.
• Technical logs of the service providers: Google Cloud Logging: regular technical application logs for 30 days and mandatory audit logs for 400 days. HTTP access logs are not enabled on the review and website web servers. Technical container operation logs rotate within a size limit and are replaced by newer entries; there is no fixed retention period in days for these logs. The moderation workflows store neither successful nor failed execution content. Providers may additionally keep legally required security and accounting logs.
• RevenueCat processes Premium and purchase associations to manage access rights and restore purchases. We coordinate deletion requests with the provider through [email protected]; deleting the app account alone is not a confirmed automatic deletion of the RevenueCat customer record.
• Support emails: for as long as necessary to handle your request and, where applicable, meet statutory retention obligations.

Account deletion removes the account, profile and community data covered by our deletion service, as well as associated data in the private service. Technical failures can delay deletion; contact [email protected] if this happens. You can also contact us for access and deletion requests concerning the providers involved. Deleting an account does not cancel store subscriptions. Purchase and accounting records held by app stores or payment providers may be subject to statutory retention duties. Data in operational backups expires according to the backup cycle. We do not promise immediate erasure of every log and copy held by every provider.

Private cloud backups: at most seven completed versions per device within the 2 GiB account limit, until you delete them. Subscription expiry does not automatically delete them. Private messages and appointments remain stored until account deletion; permission expiry limits companion access. Operational backups of the private service are intended to be kept for at most 30 days. Deletion requests are reapplied after restoration.

9. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict processing and object to processing
• receive or transfer your data in a common format
• withdraw your consent at any time with effect for the future (in the community via the shield icon)
• human review of automated decisions and to state your point of view
• lodge a complaint with a data protection authority (in Switzerland the Federal Data Protection and Information Commissioner, FDPIC; in the EU the supervisory authority of your place of residence)

In the app you can delete community posts and replies individually, withdraw your consent and delete your account yourself (Profile → Data & Privacy → Delete account; see also nafuu.app/delete-account). For anything else, write to [email protected]. We usually answer requests within 30 days.

10. Data security

We take appropriate technical and organizational measures: encrypted transmission, access restrictions (administrator access only for authorized persons), separate storage of the link between posts and accounts, and regular backups. However, no transmission over the internet and no storage is completely secure, and we cannot guarantee absolute security.

11. Age

Our community is available from age 16. Your age group is self-declared; this is not verified age assurance. In the new onboarding version, your selection is stored locally first and also in Firebase when associated with your signed-in account, including before community consent. Sections 3 and 4 explain the details, purpose and legal basis. Meditations, music, the local journal and the other app areas remain available under 16; private companionship and available backups have their separate requirements. Community participation additionally requires separate valid explicit consent to processing content, including any health information it contains. Additional consent requirements apply to minors under applicable law. Older app versions without the new age question cannot use the community until updated.

12. Changes to this policy

We update this policy when our data processing changes, for example when we change service providers. If the purposes or risks of the community change materially, we will tell you in the app and ask for new consent where needed. The date of the last change is shown above.

13. Contact

Please direct questions about data protection or the exercise of your rights to [email protected]. Postal address: Simon Hediger, Hohlenweg 41, 5072 Oeschgen, Schweiz.