Privacy Policy
Effective 27 September 2026 · Last updated 27 September 2026
This Privacy Policy explains how Nura collects, uses, discloses and protects personal information when you use the Nura app for iPhone, the Nura web app at app.risewithnura.com, and the website at risewithnura.com (together, the "Service"). It also explains the choices you have and the rights you may hold under the laws that apply to you.
Please read it together with our Terms of Service. If you do not agree with this Policy, please do not use the Service.
1. Who we are
Nura is operated by Kim Appeltans, an individual based in Massachusetts, United States ("Nura", "we", "us" or "our"). For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), we are the controller of the personal information described in this Policy, except where we state that another company acts as an independent controller.
You can reach us about anything in this Policy at kimappel@me.com.
2. Information we collect
2.1 Information you provide
- Account information. Your email address and, if you sign in with email, a password. Passwords are stored only as a salted cryptographic hash and cannot be read back by us. If you use Sign in with Apple, your email may be a private relay address that Apple forwards to you.
- Profile information. Your first name, if you provide it. Other profile details, such as your pronouns and profile photo, stay on your device (see Section 3).
- Your content. The tasks, habits, projects, project steps, notes, goals and due dates you create, and anything you type or say to Nu to create them.
- Communications. Messages you send us, such as support requests, and the email address you leave if you ask to be told when the iPhone app is available.
2.2 Information generated as you use Nura
- Planner data. The state of your tasks and habits (for example, completed, snoozed or paused), your habit history, your daily plans, and records of the suggestions Nura showed you and whether you accepted, changed or passed on them.
- Working patterns. Statistics Nura derives from your use to plan better, such as how long tasks of a certain kind usually take you or which times of day tend to go well. These are numbers with a confidence level, not free text.
- Activity history. A log of what you started and finished and when. This is kept on your device only.
2.3 Information collected automatically
- Technical logs. Like almost every online service, our hosting providers record technical details of requests to their servers, such as IP address, time, the part of the Service requested and basic device or browser information, to operate and secure the Service.
- Usage counts for AI features. We count AI requests per account and per IP address each day to enforce fair use limits. We store the count, the date and the account ID or IP address, never the content of the request.
- Device identifier. If AI features are on, each request carries a random identifier generated by the app, so that weekly results return to the device that requested them. It is not linked to any advertising identifier.
We do not use cookies for advertising or analytics. The web app uses your browser's local storage to keep you signed in and to store the on-device data described in Section 3. These are strictly necessary for the Service to work.
2.4 Information from third parties
- Sign in with Google. If you choose it, Google shares your name, email address and the address of your profile photo with us.
- Sign in with Apple. If you choose it, Apple shares your email address (or a private relay address) and, if you allow it, your name.
2.5 Device permissions
Nura asks for device permissions only when a feature needs them, and you can withdraw them at any time in your device settings.
- Microphone and speech recognition. Used to let you speak to Nu. Speech is converted to text by your device's speech recognition (Apple's, on iPhone; Google's, on Android). Where your device can do this on the device itself, it does, and the audio never leaves it. Where it can't, for example in some languages or on older phones, the audio is sent to Apple or Google for recognition under their terms. On the web, your browser's speech recognition is used, and some browsers, including Chrome, send audio to their provider for processing under that provider's terms. Nura receives only the resulting text and never stores or transmits audio.
- Calendar (iPhone). Used to see how much time you have before your next event. Calendar data is read on your device and is never sent to us. If you turn on writing to your calendar, Nura adds only your focus sessions.
- Notifications. Reminders are scheduled locally on your device. We do not operate a push notification server.
- Photos. Used only if you choose a profile photo, which stays on your device.
3. Where your information is stored
Nura is designed to keep as much as possible on your device. Some information is synced to your account so it is available on your other devices.
| Synced to your account | Kept only on your device |
|---|---|
| Account details (email, first name, sign in method) Tasks and habits, and your habit history Projects and their steps Daily plans Working patterns (Section 2.2) Your responses to Nura's suggestions |
Activity history Profile photo, pronouns and other profile details Settings and preferences Working notes written by the AI (Section 5) The random device identifier |
On iPhone, on-device data lives in the app's private storage, and your sign in session is protected by the iOS Keychain. On the web, it lives in your browser's storage for app.risewithnura.com. We never receive the on-device data listed above, except for the limited parts sent to the AI when you use AI features.
4. How we use information
We use personal information to:
- create and maintain your account, authenticate you and keep you signed in;
- provide the Service, including storing your content and syncing it across your devices;
- plan your day, order your tasks and make suggestions, which is done primarily on your device;
- provide AI features, if you have turned them on;
- respond to your requests and provide support;
- send you service messages, such as sign in links and notices about material changes to our terms or this Policy;
- tell you when the iPhone app is available, if you asked us to;
- keep the Service secure, prevent abuse and enforce fair use limits; and
- comply with our legal obligations and enforce our Terms of Service.
We do not use your information for advertising, we do not build advertising profiles, and we do not use your content to train AI models.
5. AI features
Some features of Nura use Claude, a family of AI models made by Anthropic, PBC. These features are off by default and run only after you turn them on in the app. When they are off, nothing is sent to an AI model and Nura relies on your device's own processing.
5.1 What each feature sends
| Feature | What is sent | When |
|---|---|---|
| Understanding what you typed or said | The single sentence you entered | Only when your device cannot interpret it with confidence |
| Suggestions for today | Today's open tasks (title, length and priority, up to 30), a numbers only summary of how you work, your working notes and the local hour | When you ask for or open suggestions |
| Weekly working notes | Last week's working notes, a numbers only summary of the week, and how many suggestions you accepted or passed on | At most once a week |
| Planning a project | The project goal and your answer to Nu's question; when you ask Nura to revisit a plan, also the project's steps, notes and recent history | Only when you ask |
Your full activity history and any other content are never sent. Audio is never sent to the AI.
5.2 How you seem
When Nura interprets a sentence, it may note whether your words indicate how you are feeling, such as calm, busy, overwhelmed or low. In most cases they do not, and nothing is noted. This is inferred only from the words you used, first on your device and, for a sentence the device is unsure about, by the AI. It is not a diagnosis or assessment of any kind. It is used only in that moment, so that Nu can respond with an appropriate short reply, and it is not displayed as a label, stored, synced or used for any other purpose.
5.3 Working notes
Once a week, if AI features are on, the AI writes a few sentences about what tends to help you, based on the numbers described above. These notes are stored on your device only and are used to shape your suggestions.
5.4 How AI requests are processed
Requests travel from your device to our server functions hosted by Supabase, and from there to Anthropic. Our functions do not store the content of your requests; they record only the daily usage counts described in Section 2.3. Anthropic processes requests as our service provider under its Commercial Terms of Service and data processing terms, which prohibit it from training its models on our data. Anthropic retains inputs and outputs for a limited period set by its own policies for purposes such as trust and safety. Weekly notes are processed as a batch, and Anthropic retains batch results for up to 29 days. For more information, see Anthropic's Privacy Policy.
5.5 Turning AI features off
You can turn AI features off at any time in Settings, under Language and voice, AI help. From that moment, nothing further is sent to the AI. Turning them off does not affect processing that took place before.
6. Legal bases for processing
If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing your account, storing and syncing your content, support and service messages | Performance of our contract with you (Art. 6(1)(b) GDPR) |
| AI features, calendar access and telling you when the iPhone app is available | Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time |
| Interpreting how you seem from your words (Section 5.2), to the extent it reveals information about your health | Your explicit consent (Art. 9(2)(a) GDPR), given when you choose to tell Nu how you are; it is sent to the AI only if you have turned AI features on |
| Security, abuse prevention, fair use limits and technical logs | Our legitimate interests in operating a safe, reliable and affordable service (Art. 6(1)(f) GDPR) |
| Complying with the law and responding to lawful requests | Legal obligation (Art. 6(1)(c) GDPR) |
7. How we disclose information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only in the following circumstances.
7.1 Service providers
We use a small number of service providers who process personal information on our behalf, under contracts that limit their use of it to providing services to us:
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Authentication, database hosting for synced data, and the server functions that connect to the AI | United States (Amazon Web Services, Oregon) |
| Anthropic, PBC | AI features, only if you turn them on | United States |
| Netlify, Inc. | Hosting of the website and web app; storage of early access sign ups | United States and global delivery network |
7.2 Sign in providers
If you choose Sign in with Google or Sign in with Apple, Google or Apple processes your sign in under its own privacy policy, as an independent controller.
7.3 Legal requirements and protection
We may disclose information if we believe in good faith that it is reasonably necessary to comply with a law, regulation, legal process or enforceable governmental request; to enforce our Terms of Service; to detect, prevent or address fraud, security or technical issues; or to protect the rights, property or safety of Nura, our users or the public. Where permitted, we will tell you before disclosing your information in response to a legal request.
7.4 Business transfers
If Nura is involved in a reorganization, merger, acquisition or sale of assets, personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
7.5 With your consent
We may disclose information for other purposes with your consent or at your direction.
8. International data transfers
Nura is operated from the United States, and your information is stored and processed there. The United States may not provide the same level of data protection as the country where you live. Where we transfer personal information from the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum, where relevant) incorporated in our providers' data processing agreements, or on another valid transfer mechanism. You may request a copy of the relevant safeguards by contacting us.
9. Data retention
We keep personal information only as long as necessary for the purposes described in this Policy, unless a longer period is required by law.
| Information | Retention |
|---|---|
| Account and synced data | Until you delete your account |
| On-device data | Until you sign out on that device, which clears it, or remove the app or clear the browser's site data |
| Content sent to AI features | Not stored by us; retained by Anthropic as described in Section 5.4 |
| AI usage counts | 30 days, or until you delete your account if sooner |
| Technical logs | For the limited periods set by our hosting providers |
| Early access email addresses | Until you ask us to remove yours |
| Support correspondence | As long as needed to resolve your request and for a reasonable period afterwards |
After deletion, residual copies may remain in our hosting provider's encrypted backups for a limited period until those backups are overwritten in the ordinary course.
10. Security
We use administrative, technical and organizational measures designed to protect personal information, including:
- encryption of data in transit using TLS, and encryption at rest by our hosting provider;
- database row level security, so each account can access only its own records;
- hashed passwords and short lived session tokens, stored in the iOS Keychain on iPhone;
- server functions that require a signed-in session, validate the size and shape of every request, and hold AI credentials server side only; and
- a strict content security policy on the web app, which limits where it can load code from and connect to.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.
11. Your choices and rights
11.1 Controls in the app
- Access and correct: view and edit your tasks, habits, projects and profile directly in the app.
- Export: save a copy of your activity history in Settings, under Your data, Export activity log.
- AI features: turn them on or off in Settings, under Language and voice, AI help.
- Device permissions: manage microphone, calendar, notifications and photos in your device settings.
- Delete your account: in Profile, choose Delete account. Your account and all synced data are permanently deleted from our servers, and the device you delete from is cleared. Data kept only on another device remains there until you sign out on that device or remove the app.
11.2 Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy;
- correct inaccurate information;
- delete your information;
- restrict or object to certain processing, including processing based on our legitimate interests;
- receive your information in a portable format;
- withdraw consent at any time, without affecting processing that took place before; and
- lodge a complaint with your local data protection authority.
To exercise any right that is not available in the app, email kimappel@me.com from the address associated with your account. We may need to verify your identity before acting on a request. We will respond within one month, or within the period required by applicable law, and will not charge a fee unless a request is manifestly unfounded or excessive.
12. Additional information for US residents
Residents of California and other US states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Oregon, Texas, Virginia and others) have additional rights, including the rights to know, access, correct and delete personal information, to obtain a portable copy, and to opt out of the sale of personal information, targeted advertising and certain profiling.
12.1 Categories of personal information
In the preceding 12 months we have collected the following categories of personal information, as defined by the California Consumer Privacy Act, from the sources and for the purposes described in Sections 2 and 4:
| Category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Email address, name, account ID, IP address, device identifier | Service providers; sign in providers |
| Internet or other electronic network activity | Technical logs, AI usage counts | Service providers |
| Inferences | Working patterns derived from your use of the Service | Service providers |
| Sensitive personal information | Account password; momentary inference of how you seem (Section 5.2) | Service providers |
| Other information you provide | Tasks, habits, projects and notes | Service providers |
12.2 Sale, sharing and sensitive information
We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16. We use sensitive personal information only for purposes permitted without a right to limit, such as providing the Service you request.
Because we do not sell or share personal information, there is nothing to opt out of. We nonetheless treat a Global Privacy Control signal from your browser as a valid opt-out request. Our website does not respond differently to "Do Not Track" signals, since we do not track you across sites.
12.3 Exercising your rights
To submit a request, email kimappel@me.com. We will confirm receipt within 10 business days and respond within 45 days, which may be extended once by a further 45 days where reasonably necessary. You may use an authorized agent, who must provide proof of your signed permission; we may still ask you to verify your identity directly. We will not discriminate against you for exercising any of these rights.
If we decline your request, you may appeal by replying to our decision with the subject line "Privacy appeal". We will respond to an appeal within the period required by your state's law. If your appeal is denied, you may contact your state's Attorney General.
13. Consumer health data
Certain US state laws, such as Washington's My Health My Data Act and Nevada's consumer health data law, protect information that identifies a person's past, present or future physical or mental health status. The momentary inference of how you seem described in Section 5.2 could fall within these laws. For that information:
- we infer it only from words you choose to enter, on your device, and send it to the AI only if you have turned AI features on;
- we use it only to respond to you in that moment;
- we disclose it only to the service providers that process the request, as described in Section 5.4;
- we do not store it, and we never sell it; and
- you may stop any transmission of it at any time by turning off AI features.
You have the right to confirm whether we collect, share or sell your consumer health data, to access it, to obtain a list of third parties and affiliates with which it has been shared, and to request its deletion. Because we do not retain this data, a request will typically confirm that none is held. Contact us at kimappel@me.com.
14. Children
The Service is not directed to children, and you must be at least 16 years old to use it. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided us with personal information, please contact us and we will delete it.
15. Automated decision making
Nura uses automated processing to order your tasks and suggest plans. These are recommendations only: you decide what to do, and nothing happens without your action. Nura does not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you within the meaning of Article 22 GDPR.
16. Changes to this Policy
We may update this Policy from time to time. When we do, we will revise the "Last updated" date above. If we make material changes, we will notify you in the app or by email before the changes take effect. We encourage you to review this Policy periodically.
17. Contact us
If you have questions, requests or complaints about this Policy or our privacy practices, contact:
Kim Appeltans (Nura)Massachusetts, United States
kimappel@me.com
See also our Terms of Service and Support page.