Nusafa app privacy policy

What we store

Your account holds:

• Your profile: your email address, your name, and your timezone.
• Your reminders: the name, type, dates, who is handling it, how it is usually done, a link, a next step, an amount and what happens if you miss it. We keep these as ordinary data because we need to read them to remind you.
• Your households: who you share with, and the reminders you choose to share.
• Private details: things like a policy or reference number, notes, and for a vehicle its make, model, plate and VIN. These are stored encrypted.
• A record of activity on your private details: what happened and when, never the details.
• A count of reading scans you have used this month, so the monthly limit can be applied. It is a number only, never the text you pasted.

Reminder names appear in reminder and invite emails, so keep them general. Put anything private in the private details instead.

What we never accept

Nusafa does not store government ID numbers such as Social Security, passport or driver license numbers, bank account or card numbers, or passwords. If you type something that looks like one, we ask you to leave it out. This check is a safety net, not a guarantee, so please do not enter them. We do not accept uploaded documents.

How private details are protected

• They are encrypted before they are saved, using a key unique to you. That key is itself encrypted by a master key held only as a secret on our servers.
• They are private to you. People you share a household with can see a shared reminder but never your private details.
• They are not included in emails, notifications, logs, analytics, or web addresses.
• Viewing them needs you to have signed in within the last 10 minutes, and they are hidden again after a minute of inactivity.
• Browsing our database or administration tools shows only scrambled text for them.

To be honest about the limits: our application can decrypt your private details, because it must in order to show them to you. Encryption does not make them unreachable to everyone in every circumstance. It means they are not visible in the tools we use day to day, they are protected if the database alone were exposed, and every time they are viewed it is recorded for you to see in Settings.

Who else handles your data

• Vercel hosts the app. Like any host, it keeps technical logs, such as IP addresses and the pages requested.
• Supabase runs the database and the sign in system.
• Google signs you in. We receive your name and email address, not your password.
• Resend sends our emails: invites, reminders and the weekly digest. It receives your email address, and the reminder text in the message, which is the reminder name, dates, next step and what happens if you miss it. It never receives your private details.

Reading pasted text

If you paste a renewal notice or confirmation into the capture screen, our own code reads it on our server to find the dates and what to do. The text is not sent to any other company, and no AI service is involved.

• We hold the text in memory for that one request and then drop it. We do not save it, log it or keep a copy.
• We save only the fields you review and confirm. Nothing is created until you tap Confirm.
• We remove anything that looks like an ID, policy, account or card number before you see it.
• Please do not paste anything you do not want processed, such as a card number or a password.

Nothing is read unless you use the capture screen. You can always add a reminder by hand instead.

The private app is not tracked by the analytics or affiliate scripts used on our public articles, and those scripts do not run on these pages.

The Android app

• You sign in with Google. The app keeps your sign in in the phone’s secure storage.
• Your reminders are saved to your account in our database. The app schedules the reminder notifications on your phone itself, from that data. A notification shows the reminder name and its due date, so keep names general.
• The app asks for permission to show notifications. If you say no, no reminder can reach you. You can change this any time in your phone’s settings.
• The app has no ads, and no analytics or tracking software of its own.
• The Articles screen asks nusafa.com for a list of recent articles and opens them in a browser tab inside the app. That is our public website, covered by the site privacy policy.
• You can delete your account from the app: Account, then Delete my account.

Your control

• Export: download everything we hold about you from Settings.
• Delete: delete your account and everything in it, including your private details and the key that protects them, from Settings on the website or Account in the Android app. Reminders you shared with a household stay with the household. If you cannot sign in, see how to delete your account.

Questions

This describes the app as it works today. We will update it whenever that changes. For the public website, see the site privacy policy.

Questions or requests: [email protected]. To delete your account, see how to delete your account.