Privacy Policy
This Privacy Policy explains how Nook (“we”, “us”, “the App”) collects, uses, shares, and protects personal information when you use the Nook iOS application and related services. Nook helps households coordinate tasks, shopping, plants, and appliances.
Nook is operated by Erik Hindr (IČO: 23749199), Czech Republic. Contact: hindr.erik@gmail.com.
Information we collect
- Account details: email address, display name, avatar initials, and authentication identifiers (including Sign in with Apple subject identifiers when you choose that sign-in method).
- Household data: household name, memberships and roles, invite codes, tasks and completions, shopping items, plants, appliances (including optional label/receipt photos), categories/rooms/care types, and AI chat messages associated with a household.
- App settings: theme preference and notification preferences stored with your account.
- Push delivery: Apple Push Notification service (APNs) device tokens when you enable remote notifications.
- In-app notifications: notification records generated for due tasks, digests, and related household events.
- Widgets: a small on-device App Group snapshot used by Home Screen widgets. This snapshot stays on your device and is not uploaded as a separate analytics stream.
- Subscription status: whether you have an active Nook Premium subscription, product identifiers, and expiration timing as verified via Apple (StoreKit / App Store Server Notifications).
We do not collect contacts, precise location, advertising identifiers, or third-party analytics event streams in the App.
How we use information
- Provide and sync shared household content among members you invite.
- Authenticate your account and keep the service secure.
- Send optional local and remote reminders you enable.
- Operate Nook Premium features, including the Ask Nook AI assistant.
- Verify and manage subscription entitlements purchased through Apple.
- Respond to support requests and enforce our Terms of Service.
Legal Basis for Processing (GDPR)
If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process personal data on these grounds:
- Contract Performance: creating and maintaining your account; storing and syncing household data; Sign in with Apple; delivering the App’s core features; processing Premium purchases through Apple; generating AI replies you request.
- Legitimate Interest: securing the service (abuse prevention, rate limits, authenticity checks for App Store notifications), maintaining service reliability, and keeping anonymized attribution on shared household records (for example, nulling your user id on historical task completions when you leave a household) so remaining members keep a usable history.
- Consent: optional push notifications (device token registration and APNs delivery); optional upload of appliance photos; optional use of the AI assistant (which sends your message and relevant household context to OpenAI).
- Legal Obligation: retaining or disclosing information when required by applicable law, regulation, or valid legal process (for example tax, accounting, or consumer protection obligations related to paid subscriptions).
Sharing
Household content is visible to other members of households you join or create. We do not sell your personal information. We share data with subprocessors only as needed to operate the App, as described below.
Third-Party Services and APIs
Supabase (backend, database, auth, storage)
Supabase provides our cloud backend: authentication, PostgreSQL database, object storage (appliance photos), realtime updates, and Edge Functions. It receives account identifiers, household content, notification records, device push tokens, and subscription status rows needed to run the App. Our production database is hosted in the Frankfurt, Germany (EU) region. Supabase offers GDPR-oriented contractual terms (including a Data Processing Addendum) and industry-standard encryption in transit (TLS). Review Supabase’s practices at https://supabase.com/privacy and https://supabase.com/legal/dpa.
OpenAI (AI assistant processing)
When you use Ask Nook (a Nook Premium feature), a Supabase Edge Function sends your chat message and a server-loaded snapshot of relevant household context (for example open tasks, recent completions, plants, appliances, shopping items, and member display names) to OpenAI’s Chat Completions API to generate a reply and optional tool suggestions. OpenAI receives that content as a processor for the request. According to OpenAI’s published API data controls, API inputs and outputs are not used to train OpenAI models by default, and abuse-monitoring logs for Chat Completions are retained for up to 30 days (unless longer retention is required by law or needed to protect the service). We do not enable OpenAI features that persist conversation state on OpenAI’s side beyond the request/response. Details: https://developers.openai.com/api/docs/guides/your-data and https://openai.com/policies/privacy-policy.
Apple (Sign in with Apple, APNs, In-App Purchase)
Apple provides Sign in with Apple authentication, Apple Push Notification service delivery, and App Store billing for Nook Premium. Depending on the feature, Apple may process authentication tokens, device push tokens, notification payloads, purchase receipts / signed transactions, and subscription lifecycle events. Payments are handled by Apple; we do not receive your full payment card details. Apple’s privacy information is available at https://www.apple.com/legal/privacy/.
Data Retention
- Account and profile data: retained while your account exists. Deleted when you delete your account in Settings → Delete account (auth user and personal profile removed).
- Household content (tasks, shopping, plants, appliances, categories, invites, AI chat history stored by Nook): retained while the household exists. Solo households you solely own are deleted with their data (including appliance photos in storage) when you delete your account. If you leave a shared household, or delete your account as a non-sole-owner member, household content generally remains for other members; your user identifiers on certain historical rows (for example task completions, plant watering, AI messages you authored) may be set to null for continuity.
- Sole owner of a shared household: you must transfer ownership before account deletion; we block deletion until that transfer is complete.
- Push device tokens: retained while registered to your account and removed when the account is deleted or the token is invalidated.
- In-app notifications: retained while associated with your user account (and cascade-deleted with the account) or the related household, as applicable.
- Subscription records we store: retained while linked to your account and removed when the account is deleted. Apple may retain purchase records under Apple’s own policies.
- OpenAI processing copies: not retained by us beyond operating the request; OpenAI may retain abuse-monitoring logs up to 30 days as described above.
- Widget snapshots: on-device only; cleared when you remove the widget or uninstall the App.
- Legal holds: we may retain limited information longer when required by law, dispute resolution, or security investigations.
You can export a copy of your data from Settings → Export my data.
International Data Transfers
Primary App data is stored in the European Union (Supabase Frankfurt). Some subprocessors — notably OpenAI and Apple — may process data in the United States or other countries outside the EEA. Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards recognized under GDPR, such as the European Commission’s Standard Contractual Clauses (SCCs) and/or adequacy decisions implemented by those providers in their customer terms, together with technical measures like TLS in transit. OpenAI and Apple publish their own transfer and privacy terms; review those documents for the latest safeguards.
Your rights (GDPR)
Subject to applicable law, you have the right to:
- Access the personal data we hold about you
- Rectification of inaccurate or incomplete data
- Erasure (“right to be forgotten”), including via Settings → Delete account where available
- Data portability, including via Settings → Export my data
- Restriction of processing in certain circumstances
- Objection to processing based on legitimate interests
- Withdraw consent where processing is based on consent (for example by disabling push notifications or stopping use of the AI assistant), without affecting the lawfulness of prior processing
- Lodge a complaint with a supervisory authority — in the Czech Republic, the Úřad pro ochranu osobních údajů (ÚOOÚ), or your local EEA authority
To exercise these rights, use in-app controls where available or email hindr.erik@gmail.com.
Children’s Privacy
Nook is not directed to children under 13 (or the minimum digital consent age in your country, if higher). We do not knowingly collect personal information from children. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.
Data Security
We use HTTPS/TLS for client–server communication, Row Level Security on household data in Supabase, signed URLs for private appliance photos, and server-side checks for Premium-gated features. No method of transmission or storage is 100% secure; we work to protect your information with reasonable technical and organizational measures.
Changes
We may update this Privacy Policy from time to time. We will revise the “Last updated” date and, for material changes, provide additional notice where appropriate. Continued use of the App after an update means you acknowledge the revised Policy.
Governing Law / Jurisdiction
This Privacy Policy is governed by the laws of the Czech Republic, without prejudice to mandatory consumer protections that apply in your country of residence. Courts of the Czech Republic have jurisdiction over disputes arising from this Policy, subject to any mandatory rights you may have to bring claims in your local courts.
Contact
Nook is operated by Erik Hindr (IČO: 23749199), Czech Republic. Privacy questions: hindr.erik@gmail.com