Privacy Policy - Nostelia

Effective date: May 19, 2026

Nostelia ("Nostelia," "we," "us," or "our") operates the Nostelia mobile application and related website at nostelia.vercel.app (together, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Service.

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

Contact: deccoo.prog@gmail.com

1. Who this policy applies to

This policy applies to:

Registered users who create an account (email/password or Google sign-in).
Guests who join a memory chapter via invite link or QR code, including users who use anonymous guest access without creating a full account.
Visitors to our website invite/landing pages.

2. Information we collect

A. Information you provide

Account data: email address, password (stored in hashed form by our authentication provider), and account identifiers.
Profile data: profile photo and related profile metadata you choose to upload.
Memory chapter ("chapter") data: titles, descriptions, dates, optional location text, cover images, and join settings (e.g. public or private approval).
People/contacts you add: names and optional avatars you upload for people in your vault.
User-generated content: photos you upload to chapters, and related metadata (e.g. upload time, chapter association).
Communications: messages you send to us for support.

B. Information collected automatically

Device and app data: device type, operating system, app version, and general technical logs needed to operate and secure the Service.
Authentication session data: tokens stored on your device to keep you signed in.
Invite and deep-link data: when you open an invite or chapter link, we process the link identifier to route you to the correct chapter.

C. Permissions-based data (with your consent)

Photos and camera: if you grant permission, you may select or capture photos for upload. New uploads are photos only.
Location (when in use): if you grant permission, we may use location-related features to place chapters on a map. We may convert location text you enter into map coordinates using your device's geocoding capabilities. We do not describe continuous background GPS tracking as a core feature of the app.

D. Information from third-party sign-in

If you sign in with Google, we receive information made available by Google (such as your name, email address, and profile picture) according to your Google account settings and Google's policies.

E. Information about others

If you upload photos or names of other people, you are responsible for having a lawful basis and any required permissions to do so.

3. How we use information

We use information to:

Provide, maintain, and improve the Service.
Create and manage accounts and guest sessions.
Store and display your chapters, media, people, and map-related content.
Enable chapter sharing, invites, QR codes, join requests, and collaboration.
Authenticate users and prevent fraud, abuse, and security incidents.
Respond to support requests and communicate about the Service.
Comply with legal obligations and enforce our Terms of Service.

We do not use third-party advertising analytics in the app as of the effective date above. If we add analytics or advertising later, we will update this policy.

4. How sharing works in the Service

Nostelia is designed for sharing memories with others you invite.

Chapter owners can share invite links or QR codes.
Depending on chapter settings, guests may join immediately or request access that the owner approves.
Content you upload to a chapter may be visible to members (and, where applicable, guests) of that chapter.
Media files may be stored in cloud storage with public URLs. That means anyone who obtains the direct link may be able to access that file even if they are not a member of the chapter. Do not upload content you consider highly confidential unless you accept this risk.

You choose what to share and whom to invite. You are responsible for how you distribute invite links and QR codes.

5. Legal bases (EEA/UK users)

Where GDPR or similar laws apply, we rely on:

Contract: to provide the Service you request.
Legitimate interests: security, fraud prevention, improving the Service, and communicating with you about the Service.
Consent: where required for permissions (camera, photos, location) or optional features.
Legal obligation: where we must retain or disclose data by law.

6. How we disclose information

We share information only as follows:

A. Service providers (processors)

We use trusted providers to run the Service, including:

Supabase (authentication, database, file storage, and related infrastructure).
Google (if you choose Google sign-in).
Apple/Google app distribution platforms.
Expo/React Native ecosystem providers as needed to deliver the app.

These providers process data on our instructions and under appropriate agreements.

B. Other users

As described above, chapter content may be visible to people you invite or who join your chapters.

C. Legal and safety

We may disclose information if we believe disclosure is required by law, regulation, legal process, or governmental request, or to protect rights, safety, and security of users, the public, or Nostelia.

D. Business transfers

If we are involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to this policy.

We do not sell your personal information.

7. International transfers

We and our providers may process and store information in countries other than your own. Where required, we use appropriate safeguards for cross-border transfers.

8. Data retention

We retain information for as long as your account is active and as needed to provide the Service, resolve disputes, enforce agreements, and comply with law.

When you delete content in the app (where available), we delete or deactivate it within a reasonable period, subject to backups and legal retention requirements.

9. Security

We use administrative, technical, and organizational measures designed to protect information. No method of transmission or storage is 100% secure.

10. Your rights and choices

Depending on where you live, you may have rights to:

Access, correct, or delete your personal information.
Object to or restrict certain processing.
Withdraw consent where processing is based on consent.
Data portability.
Lodge a complaint with a supervisory authority (EEA/UK).

To exercise rights, contact deccoo.prog@gmail.com. We may need to verify your identity.

Account and data deletion: You may sign out in the app. To request account or data deletion, email deccoo.prog@gmail.com from your registered email. We will process verified requests within a reasonable time unless we must retain data by law.

Device permissions: You can change camera, photo, and location permissions in your device settings.

11. Children

The Service is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children under that age. If you believe a child has provided us information, contact deccoo.prog@gmail.com and we will take appropriate steps to delete it.

12. Third-party links and services

The Service may link to third-party sites or services (including Google sign-in). Their privacy practices are governed by their own policies.

13. Changes

We may update this Privacy Policy from time to time. We will post the updated version at nostelia.vercel.app/privacy (or in-app) and update the effective date. Continued use after changes means you accept the updated policy.

14. California privacy notice (CCPA/CPRA)

California residents have rights to know, delete, and correct personal information, and to opt out of "sale" or "sharing" for cross-context behavioral advertising. We do not sell personal information as defined by California law. To exercise rights, contact deccoo.prog@gmail.com.

15. Contact

Questions about this Privacy Policy:

deccoo.prog@gmail.com
Nostelia