> legal

privacy policy

effective [EFFECTIVE DATE]

This Privacy Policy explains what Nolemo, operated by [COMPANY LEGAL NAME] (“Nolemo”, “we”, “us”), collects, why we collect it, and the choices you have. We collect the minimum needed to run a paid learning product. We do not sell your personal data.

1. What we collect and why

Account and authentication. When you register we store your email address and account settings. Sign-in is passwordless: you use one-time email links, so there is no password for us to store. If you sign in with Google, GitHub, or Apple, we receive a basic identifier and email from that provider to create and link your account; we do not receive your provider password. Session and sign-in tokens are stored only as cryptographic hashes.

Payment data. Paid access is processed by Stripe. Your card number and full payment details are entered directly with Stripe and never touch our servers. We store only non-sensitive billing metadata that Stripe returns, such as your plan, subscription status, and a Stripe customer identifier, so we can grant and manage access.

Regional pricing and abuse protection. Price quotes shown before checkout may use your approximate country, derived from the network request. That quote is then checked against your card's issuing country as reported by Stripe: mismatched subscription discounts are corrected on future invoices, and mismatched one-time purchases are refunded. We also use IP addresses for rate limiting and to protect the service from abuse. We do not use them to build an advertising profile.

Learning and engine data. As you use the product we record your answers, attempts, timing, mastery and retention state, diagnostic results, and code you write in the labs. Project work you push to our hosted git repositories is stored with its commit history, including the author name and email set in your git client. Some of this content is graded with the help of an AI provider: free-text checkpoint answers and submitted project code are sent to Anthropic for assessment, without your name or email attached. This is the core data that powers placement, scheduling, and your atlas. Without it the product cannot work.

Email. We use your email address to send transactional messages such as sign-in links, receipts, and account notices. Transactional email may be delivered through a third-party email provider on our behalf.

Nomo development interest. If you join the optional Nomo development list, we store the email, country, technical profile, hardware and price interest, components owned, learning goal, acquisition source, and the contact permissions you submit. We use this information only to assess whether the proposed hardware should be built, send the updates you requested, and invite you to research interviews or beta testing when you separately agree. Joining is not a preorder or a condition of using Nolemo.

Cookies and session tokens. We use a session token to keep you signed in and essential cookies to operate the service. These are required for the product to function. Our product analytics runs without cookies and without cross-site tracking: usage events are not tied to an advertising identity and are not used for advertising.

2. Service providers

We share data with a small set of processors strictly to run the service: Stripe for payments, Resend for transactional email, Anthropic for AI-assisted grading of free-text answers and project code, PostHog for product analytics (hosted in the United States), Sentry for error monitoring, our hosting and database infrastructure, and the OAuth identity providers you choose to sign in with (Google, GitHub, Apple). Each processes data only as needed to provide its part of the service.

Connected AI assistants. If you connect an assistant such as ChatGPT or Claude to Nolemo, it receives only what the permissions you approved on the connection screen allow: with read, your mastery, review dates and next steps per planet; with practice, the exercises it serves you and the grading of the answers you give through it; with log, nothing is read, it can only record that you studied a planet elsewhere. The assistant's own provider processes that data under its own privacy policy. Nolemo never receives your conversation with the assistant, only the tool calls it makes. You can see and disconnect every assistant from your profile, under account, which revokes its access at once.

3. Data retention

We keep account and learning data for as long as your account is active so the engine can track mastery and schedule reviews over time. If you delete your account, your personal data is removed at that moment, except where we must retain certain records to meet legal, tax, or accounting obligations (for example, billing records kept by our payment processor as required by law). Copies in operational backups expire as those backups rotate.

Nomo development-interest data is kept while the research and development list remains active or until you withdraw consent. A matching-email record is included when you export or delete your Nolemo account. If you joined with another address, contact us to access or remove it.

4. Your rights (GDPR and CCPA)

Depending on where you live, you have rights over your personal data, including:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to fix inaccurate or incomplete data. You can update most account details directly in your profile.
• Deletion: delete your account and its data yourself, from your profile (atlas · profile · delete account). This removes your learning history, code, hosted project repositories, and billing profile, subject to the legal retention exceptions above.
• Portability: download a machine-readable copy of your data at any time from your profile (atlas · profile · export my data).
• Consent: withdraw Nomo development-update or research-contact consent at any time by contacting us.

Both deletion and export are self-serve and immediate. If you prefer, or to exercise any other right, email us at [CONTACT EMAIL]. We do not sell personal information and do not discriminate against you for exercising these rights.

5. Security

We use industry-standard measures to protect your data, including hashed session and sign-in tokens, encrypted transport, and access controls. No system is perfectly secure, so we cannot guarantee absolute security, but we work to limit what we collect and how long we keep it.

6. International transfers

We and our processors may store and process data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards for such transfers under applicable law, such as standard contractual clauses or an adequacy framework the processor participates in.

7. Changes to this policy

We may update this policy as the product changes. When we make material changes we will update the effective date above and, where appropriate, notify you.

8. Contact

For privacy questions or to exercise your rights, contact us at [CONTACT EMAIL]. See also our Terms of Service.