Nubia Privacy Policy
Effective date: 2026-09-13
Last updated: 2026-10-17
Policy version: 1.0
Nubia helps you organize skincare, learn about products, and keep track of your routines. This policy explains how information is handled when you use the Nubia app, visit heynubia.com, or contact us. Some features are optional or available only in particular versions, subscription plans, or regions.
1. Who is responsible for your information
Nubia is operated by Emine Kuzhan, an individual based in Türkiye. This operator is the controller, or equivalent responsible business, for the processing described here. “Nubia,” “we,” and “us” refer to that operator, not to a separate company unless one is identified above.
App Store publisher/seller: Emine Kuzhan.
For privacy questions, access or deletion requests, consent withdrawal, or a privacy complaint, email privacy@heynubia.com. For general assistance, email support@heynubia.com.
Privacy contact: Emine Kuzhan can be reached at privacy@heynubia.com for the matters described in this policy. This contact does not imply appointment of a separate data protection officer or regional representative. Any locally required representative details must be provided for the service offered in that region.
The separate Consumer Health Data Privacy Policy explains consumer health data practices and rights under applicable US consumer health privacy laws. The Cookie Notice explains website cookies and similar storage. Our Terms of Use explain the service contract; this Privacy Policy is an information notice, not blanket permission to process sensitive information.
2. The main points
- Your account, skincare profile, product Shelf, routines, and information you choose to log can include sensitive health-related information.
- The current Apple Health integration reads selected information on your device with your permission. It does not send the current HealthKit readings to our server. Manually entered wellness information is handled differently and can be stored with your account.
- Journal entries are stored on your device in the current app. Optional Shelf photo recognition sends one product photo that you take or choose to OpenAI. It is a separate feature from the journal and is not a face or skin diagnosis service.
- Friends and shared activities can reveal information to people you connect with. Device notifications, widgets, and anything you choose to export or share can also be visible outside the app.
- Website analytics is optional and starts after consent. The app uses separate first-party product analytics, including a default-enabled measurement system; website choices do not control app analytics.
- We do not sell personal information or use it for cross-context behavioral advertising. We do not use Apple Health data for advertising, marketing, or data-broker activities.
- You can contact us about your privacy rights without buying a subscription. Deleting an account, cancelling a subscription, removing device data, and exercising rights with an independent provider are different actions.
3. Information we handle
The information depends on what you use. You do not need to give us every category below to read the public website.
| Category | Examples and source | What it is used for |
|---|---|---|
| Account and authentication | Email address, display name, account identifier, sign-in provider identifiers, verification status, account/session dates, and authentication credentials or tokens. These come from you, your device, Firebase Authentication, and Apple or Google when you choose their sign-in options. Apple may provide a relay email address. | Creating and securing the account, signing in, account recovery, connecting your data to the right account, and preventing unauthorized access. |
| Profile and preferences | Age band, language, time zone, skin type, skin tone or related profile choices where supplied, goals, preferences, budget or product preferences, routine timing, and notification choices. | Personalizing features and presenting suitable language, scheduling, and product information. |
| Sensitive skincare and safety information | Skin concerns and severity, symptoms and reactions, allergies or sensitivities, treatment and medication context, pregnancy, breastfeeding or trying-to-conceive information where you provide it, recent procedures, and answers about care needs or warning signs. | Building and adapting skincare guidance, applying product and routine safety rules, recording changes, and presenting suggestions to seek professional care. |
| Products and routines | Products searched for, saved or owned; Shelf entries; product experience and tolerance; routine steps, completion or skipped steps, changes, reminder schedules, and recommendation interactions. | Maintaining your collection, organizing routines, tracking use, and explaining recommendations. Product and routine information can reveal health interests. |
| Check-ins and wellness | Reactions, concern check-ins, water and SPF logs, sleep information you enter, freshness and movement-related choices, lifestyle modes, occasion plans, shared-night preferences, and dates or outcomes you save. | Progress views, reminders, wellness tools, routine adjustments, and the features you request. |
| Apple Health information | With your permission, selected sleep, workout, and menstrual-flow timing information is read on your device. See section 4 for the distinction between on-device readings and account data. | Displaying optional wellness context and device-side suggestions. |
| Journal and images | Current journal notes are stored on your device; older local entries may include photos. A Shelf product photo that you take in the app or choose from your photos is transmitted only when you request product-photo recognition. | Personal journaling or, separately, suggesting catalog matches for products in your photo. |
| Location and environment | Your device can supply coordinates with permission for local UV/weather and seasonal context. The app rounds weather coordinates to two decimal places (roughly 1 km) before sending them, which can still identify a general area. Associated information can include time zone, hemisphere, climate/season categories, and weather indicators. | Providing local UV/weather information and seasonal skincare context. We do not use this feature to track visits to health facilities or build an advertising movement history. |
| Social activity | Friend code, display name, username or initials where available, invitations and responses, connections, blocks, sharing preferences, routine activity, shared-night plans and related state. Information can come from you or someone who invites or connects with you. | Finding the intended friend, handling invitations, showing the activity you enable, and managing shared features. |
| Purchases | Store and RevenueCat identifiers, products and entitlements, purchase/renewal/expiry/refund status, receipt or transaction information, and subscription history. | Providing paid access, restoring purchases, reconciling billing events, and handling support or fraud. We do not receive your full payment-card number from an App Store purchase. |
| Technical and security information | IP address and request metadata received by hosting or service providers, app/OS version, device model, cellular carrier, country, language, time zone, errors, session and installation identifiers, push-permission status, consent records, request limits, and account-deletion or analytics-suppression records. | Delivering and securing the service, troubleshooting, preventing repeated abuse, maintaining privacy choices, and completing requests. |
| Product and website measurement | App screens/features used, timing and completion counts, coarse interaction/result categories and pseudonymous identifiers; separately, consented website page categories, language, coarse campaign attribution, link placements, and reading-duration buckets. | Understanding use and reliability and improving Nubia. Some app events can imply a skin or wellness interest even without the underlying health answer. See section 7. |
| Website searches and communications | Website search terms and filters, requested page/resource paths, emails, attachments you send us, and information needed to verify and resolve requests. | Returning search results, responding to you, and managing legal/privacy requests. Website search text is excluded from our optional website analytics payload, but is still processed by the website and content API. |
We do not ask for access to your entire photo library or address book for these features. If you take the Shelf photo in the app, the camera is used only for that one photo, with your permission. We do not use facial recognition or create a biometric identity template from a Shelf photo. A photo may nevertheless contain personal or sensitive information if you include it. Please use product-only photos and avoid faces, prescriptions, addresses, and other people's information.
With your location choice and device permission still enabled, Nubia may reuse a previously obtained location to refresh weather and widgets while the app is not open. These refreshes send cached coordinates through Nubia's server to Apple WeatherKit. This cached copy is rounded to two decimal places, tied to your account, and held in protected storage on that device. It is usable for up to 24 hours; an expired copy is deleted when the app next checks it or a relevant cleanup runs, so physical removal may happen later. Background refreshes do not request a new device location. Coordinates are not included in the widget or Live Activity display data. Foreground weather requests use the same two-decimal precision described above.
If you enable automatic UV reminders, we also save a location rounded to two decimal places with your account reminder settings, so our server can check local UV conditions for scheduled reminders while the app is closed. This saved server setting is separate from the 24-hour device cache. Disabling automatic reminders stops their scheduled use but does not necessarily clear the stored location; it may remain until cleared, replaced, or included in account deletion. Revoking device location permission alone does not necessarily disable a reminder plan already saved on the server. To stop scheduled use, switch off Regular reminders in the UV reminder settings and select Save changes. Contact us to request removal of the saved location.
4. Apple Health, journal, and device storage
Apple Health
You decide whether to connect Apple Health and which supported types to allow. The current integration is read-only: sleep information, workout information, and menstrual-flow timing can be used to produce local wellness context. It does not read heart-rate variability in the current implementation, write data to Apple Health, or send current HealthKit samples or summaries to Nubia's server.
If you previously used a version that synchronized wellness summaries, historical summaries may remain in your account until removed. Manually entered wellness logs and settings can also be stored on our server even when a similar type of information is available in Apple Health. A screen being called “Wellness” does not mean all its data stays on the device.
You can withdraw Health access in Apple's Health/privacy settings and disable the integration in Nubia. Revoking access stops future permitted reads; it does not erase information you independently entered or any historical account data. Nubia account deletion does not delete the original records in Apple Health.
We do not use information obtained from Apple Health for advertising, marketing, sale to data brokers, or insurance/employment decisions. We do not send it to OpenAI for product recognition or use it to train general-purpose AI models.
Journal, cache, widgets, and exports
The current journal stores notes locally under your account on the device. Legacy journal entries may include local image files. The app also uses local storage for preferences, cached service data, drafts, and pending operations, and protected device storage for certain credentials and identifiers. Some local stores are ordinary app storage rather than an end-to-end encrypted personal vault.
Widgets and notification extensions can receive limited information from the app to show routine or friend activity on your device. People who can see your device, notification previews, or widgets may see that information. You can control previews and widgets through device settings.
An export or system share action creates or sends a copy to a destination you choose. That copy is outside Nubia's account-deletion workflow. Device or computer backups may also contain app data depending on your settings and the platform's backup behavior. Deleting your Nubia account does not guarantee removal of those copies or all locally retained journal files. You can delete visible journal entries from the journal before deleting your account. For help identifying and removing other local data, including legacy files, contact us before uninstalling or replacing your device.
5. Optional AI product-photo recognition
Optional AI-assisted features, currently Shelf product-photo recognition, are for users aged 13 and over. If you are 13–17, you need a parent or guardian’s permission to use these AI features. Higher local age or digital-consent requirements for AI use still apply. Do not use these AI features if you are under 13, below a higher applicable AI minimum age, or without required permission. Parent/guardian permission does not override these requirements.
You can take one photo of your products in the app, or choose one from your photos, and ask Nubia to identify likely catalog matches. Before upload, the feature requires an eligibility declaration and separately asks you to agree to sending that selected photo to OpenAI for catalog matching. The age, permission and higher local requirements above apply to each use. Permission previously given for another provider does not authorize this upload. Manual product search remains available without uploading a photo.
The request includes the selected image, a product-identification instruction, and catalog context. It does not include your skincare profile, Apple Health readings, journal, or email as part of the recognition prompt. OpenAI also receives technical information needed to provide and protect its API. Nubia receives suggested product matches, which you review before saving products to your Shelf. Our routine generation and safety rules do not send your full health profile to a general-purpose AI service in the implementation covered by this policy.
Our recognition service processes the image for the request and does not save it to your account or our product-photo database. We ask OpenAI not to save the response as application state (store: false). This is not a promise of zero retention by OpenAI. OpenAI does not use API content to train its models by default unless the customer opts in to data sharing. Its default abuse-monitoring logs may contain submitted content and are retained for up to 30 days, or longer where required by law or reasonably necessary for safety. Automated safety checks and review may apply; image safety exceptions and provider-managed prompt caching have their own retention rules. See OpenAI data controls and the OpenAI Services Agreement.
We do not claim an OpenAI Zero Data Retention arrangement. Zero Data Retention requires separate provider approval; setting store: false does not enable it. OpenAI's under-18 guidance says not to process personal data of children under 13 or the applicable age of digital consent without first implementing Zero Data Retention. Nubia's AI minimum remains 13, with higher applicable local requirements. Parent or guardian permission alone does not override these restrictions.
When you use the photo flow, Nubia records the time and version of the photo-sharing permission and eligibility declaration alongside usage limits. These are self-attestations, not proof that a parent's identity or a user's age has been independently verified. We do not send these account consent records as part of the recognition prompt.
Recognition can be wrong. It identifies possible products; it does not analyze your skin or diagnose a condition. Information visible in the photo is transmitted with it. Declining or cancelling before upload prevents that upload. A later withdrawal cannot undo an already completed transmission; contact us to request deletion or restriction where applicable.
To prevent repeated free-use abuse, the app keeps an installation identifier in protected device storage. The server keeps derived installation/account identifiers and usage counts. These can remain after sign-out or account deletion for the restricted security purpose and retention described in section 9; they are not advertising identifiers.
6. Why we process information and our legal grounds
Where a law requires a legal basis, we use the basis appropriate to the particular purpose. In the EEA and UK, the following grounds apply to the stated purposes; other regions may require a different or additional ground, including separate or explicit consent.
| Purpose | Legal ground |
|---|---|
| Provide the account, saved products, purchase access, and requested non-sensitive service functions/support | Performance of our contract or steps you request before entering it (GDPR Article 6(1)(b)); only data objectively needed for that purpose. |
| Process sensitive skin, medication, reproductive, or other health-related information for personalization and optional wellness features | Explicit consent (Articles 6(1)(a) and 9(2)(a)). Contract necessity alone does not remove the additional protection for health information. |
| Read and use Apple Health information | Explicit consent (Articles 6(1)(a) and 9(2)(a)), alongside the permissions you select in Apple Health. |
| Obtain/use location for optional weather, UV or seasonal features | Consent (Article 6(1)(a)); explicit consent under Article 9(2)(a) as well if the processing reveals protected health information. |
| Transmit a selected product photo for optional recognition | Consent (Article 6(1)(a)); we ask for product-only photos and do not request health images. If processing nevertheless involves protected health information, an additional valid special-category condition is required. |
| Handle ordinary friend requests and deliver sharing you instruct us to perform | Performance of the requested service (Article 6(1)(b)) for connection administration; consent (Article 6(1)(a)), and explicit consent under Article 9(2)(a) where needed, for optional disclosure of health-related activity. |
| Optional website measurement and non-exempt device-based analytics | Consent (Article 6(1)(a)); explicit consent under Article 9(2)(a) if the measurement involves protected health information. Any use of a local exemption must meet that exemption's conditions; calling analytics “first party” does not itself create an exemption. |
| Necessary technical delivery, account security, limited abuse prevention, and service diagnostics | Legitimate interests in running a reliable, secure service, where lawful and balanced against your rights; a legal obligation when one applies. This does not authorize unrelated sensitive-data analytics. |
| Privacy requests, transaction records, legal obligations, and disputes | The relevant legal obligation, or establishing, exercising, or defending legal claims where permitted, with an additional condition for sensitive information when needed. |
We explain mandatory and optional information in the relevant flow. Device permission alone is not a substitute for any additional legal consent. Without information necessary for a feature, we may be unable to provide that feature. Refusing optional analytics, Apple Health, location, or photo processing does not authorize us to collect it anyway. You can withdraw consent through the relevant control or by emailing us. Withdrawal does not invalidate processing that was lawful before withdrawal.
We use automated rules to personalize recommendations using your choices, products, routine history, and safety information. Their purpose is skincare organization and education. They do not determine legal eligibility, employment, insurance, or other similarly significant rights. You can change inputs and ask us to explain or correct the information used. This is not a clinical diagnosis or a medical decision made by a healthcare professional.
7. Analytics and communications
In the app
Nubia operates first-party product measurement using pseudonymous device/session identifiers, which may be linked to your account after sign-in. The current app starts its main measurement system enabled, including before sign-in. It can record screen views, feature interactions, timing, completion counts, and coarse outcomes. Older measurement events can include article identifiers and result categories such as improvement or worsening. These events exclude unrestricted notes and raw health-answer fields through defined payload restrictions, but their context may still reveal health interests. Pseudonymous data is not the same as anonymous data.
The analytics setting in Data & Privacy controls the main measurement system and requests server-side suppression and erasure. Once the server records the account opt-out, it also suppresses storage of the older account analytics stream. The older app queue can still collect and attempt to send events locally, so the switch does not stop all local analytics activity. Contact us if you need help with a full analytics objection or deletion request. This behavior does not override an applicable consent requirement or your right to object.
Turning off optional measurement does not stop requests necessary to sign in, retrieve your routine, verify a purchase, deliver an enabled feature, or process a privacy request. We keep only the information needed for those separate purposes under the grounds described above.
On the website
Optional Google Analytics, loaded through Google Tag Manager, starts only after you accept analytics in the website's privacy controls. It measures generic page categories, language, approved broad campaign attribution, app-link placement, language switches, and a reading-duration bucket. It does not receive article titles/topics/slugs, search text, raw URLs or referrers, contact details, or account IDs in our defined event payload. Google receives technical connection information when its service loads.
Our configured measurement does not use advertising personalization, Google Signals, advertising pixels, or session replay. You can reject analytics or withdraw through Privacy choices in the website footer. Closing the dialog does not accept, and a failure to save your choice does not enable measurement. “Accept all” enables analytics only, not advertising. Our consent controls are self-hosted; they are not a certified or commercial consent platform. Advertising user data, automatic/enhanced measurement and user-provided data collection are disabled in this configuration. Website delivery, searches, and security requests still occur without optional analytics.
Your versioned privacy choice in nubia.consent.v2 expires 90 days after saving; ordinary website activity does not extend it. The necessary refusal cookie nubia_analytics_denied can last 90 days. Google’s first-party _ga and _ga_* cookies can last up to 90 days after the latest consented use, and its session cookie may refresh during activity. Approved campaign attribution in nubia.campaign.v1 lasts at most 30 minutes or until the tab session ends. Before consent it remains only in page memory. Rejection, withdrawal and expiry stop optional collection and clear analytics cookies and campaign state, including across open tabs where browser events permit; a tag-free reload is used when needed. An expired choice or a change requiring renewed consent prompts a new choice.
Google Analytics says it does not log or store individual IP addresses, but Google receives your IP and browser connection information when consented services load. This is not a claim of anonymous processing. Google event-level and user-level retention are set to two months, with no reset on new activity. Aggregated reports have separate retention; we do not promise all reports disappear after two months. Deleting cookies does not itself delete previously collected data. The Cookie Notice explains the full storage inventory and controls.
The website and app do not currently implement a special response to browser “Do Not Track” or Global Privacy Control signals. We do not sell or share information for cross-context behavioral advertising. Where a legally required opt-out signal applies to any processing, it must be honored; the absence of a technical signal feature does not take away your rights to contact us or use the available privacy controls.
Notifications and messages
Nubia and its notification providers use account/device identifiers, subscription status, language, notification preferences, timing, and the content needed to send enabled reminders or social updates. The app uses OneSignal and Apple's push infrastructure, and can also schedule local notifications. OneSignal's SDK also handles device/app information, country, connection information including IP addresses subject to regional settings, session times/counts and usage duration. See its SDK collection documentation. Disabling system notifications stops their display but does not necessarily erase the provider's device registration or stop all SDK processing.
You can adjust reminder categories in Nubia and notification permissions in device settings. Some operational messages, such as security or privacy-request responses, may be necessary. Contacting support does not sign you up for promotional email. We do not currently provide a public website newsletter subscription form.
8. Who receives information
| Recipient | Information and reason |
|---|---|
| Google Firebase / Google Cloud | Authentication data, server-stored account and feature data, service requests, and first-party analytics stored for us; hosting and delivery of public content and assets. |
| Apple and, if chosen, Google sign-in | Information required for identity verification and authorization under the sign-in method you choose. |
| Apple App Store and RevenueCat | Store transactions, app/customer identifiers, receipts or transaction status, device/app metadata, and subscription entitlements to process purchases and provide access. Apple handles its store/payment relationship under its own terms. RevenueCat processes subscription information for Nubia; contacting us remains a route for requests about that processing. |
| OneSignal and Apple push delivery | Device/push identifiers, Nubia account identifier, locale, premium status, SDK data described in section 7, and delivery/content information for notifications. Health-related reminder context can be sensitive even when a message does not include your full profile. |
| Apple WeatherKit | Requested location coordinates rounded to two decimal places and weather request context, sent through our server to obtain local conditions. Background cache and server reminder requests use the same two-decimal locations described in section 3. |
| OpenAI | The product-photo recognition input and technical request information described in section 5, when you choose that feature. |
| Google Analytics / Tag Manager | The consented website measurement and connection data described in section 7. These are separate from our app's first-party analytics. |
| Website host, public media hosts, and email/support provider | Requests to deliver the website and images, technical/security logs, and communications you send us. These recipients are website and content-delivery hosts serving pages and public images, and email-routing and mailbox providers handling messages you send us. Google Cloud/Firebase hosting and content services are identified above. |
| People you connect with or choose to share with | Information necessary for friend previews, accepted connections, shared activities, or the content you explicitly share. |
| Authorized staff and professional advisers | Limited information necessary to support the service, respond to requests, investigate issues, or meet legal/accounting duties, subject to confidentiality and access restrictions. |
Friend previews and shared features may show your display name, username or initials where available, and relevant activity or invitation details. Accepted friends can see routine completion/activity where sharing is enabled; shared nights or care-circle features may reveal the selected theme, date, time zone and invitation response state. These features do not give friends general access to your medical profile, private journal, or Apple Health store. Review the screen before inviting or sharing. Disconnecting, blocking, or withdrawing sharing prevents future authorized access as implemented, but cannot recall a screenshot or independent copy another person has already made.
We may disclose information to comply with a binding legal obligation or valid legal process, protect safety where law permits, or establish/defend a legal claim. Requests are assessed for lawful scope; a broad request is not automatically permission to disclose an entire health profile.
A business reorganization or transfer may involve personal information only with appropriate legal safeguards and notices, and any fresh consent required for a materially different use. It is not permission to sell consumer health information or repurpose Apple Health data.
We require third parties that receive Nubia user data to provide the same or equal protection as required by this Privacy Policy and the applicable Apple App Review Guidelines. Service providers must process information under appropriate contractual restrictions. Some providers separately control data for their own platform, account, security, or legal purposes; those activities are also explained in their policies. Linking to a provider's policy does not replace our responsibility for our use of that provider.
9. Retention and deletion
We retain identifiable information for the purpose for which it was collected, subject to applicable law. Retention depends on the category, your choices, operational deletion processes, and any specific legal hold. De-identified statistics may be kept longer only if they are no longer reasonably linkable to you; merely removing an email address is not sufficient.
| Information | Retention rule |
|---|---|
| Active account, profile, Shelf, routines, check-ins, and server wellness history | While needed to provide your account and requested history, until you remove information or request erasure, subject to lawful exceptions. Inactive-account policy: Inactivity alone does not start a fixed automatic deletion period. We assess continued need by whether you retain an account and saved history, whether you have asked for deletion, and whether a specific legal or security reason requires limited retention; we do not retain information merely because storage is available. |
| Current Apple Health readings | Read and processed in device memory for the feature; no current server synchronization. Historical imported data, if any, follows the account-history rule. |
| Local journal, drafts, cached copies, and exported files | On the device or destination where stored until removed or cleared according to that storage's behavior. Account deletion alone may not remove all local or independently exported copies. |
| Shelf image in Nubia's recognition service | Processed during the request without saving an account/server image; OpenAI retention is described in section 5. Saved product matches become ordinary Shelf records. |
| App metrics event receipts | Configured retention of 97 days. |
| Main app metrics compact activity facts | Configured retention of 400 days; reporting windows are not an earlier deletion promise. |
| Older account analytics buffer | Pruned to a maximum of 500 retained events and a 90-day window when the buffer is processed; related receipts are configured for 97 days. This is not a promise that inactive storage is physically purged exactly on day 90. |
| Friend codes, requests, and activity | Codes/requests ordinarily have seven-day validity; activity is generally visible for 48 hours. Closed request/delivery histories are eligible for cleanup after about 30 days. Validity or visibility expiry is not proof of immediate physical erasure. Ongoing relationships and sharing preferences remain until changed or deleted. |
| UV/location cache | Foreground forecast responses use a server memory cache with a two-hour default validity, configurable up to six hours. The on-device background location copy is usable for at most 24 hours and removed on an expired read or relevant cleanup; expiry is not immediate physical deletion. Request logs are subject to the separate log rule. Derived seasonal history may remain with your account. |
| Saved automatic UV-reminder location | Two-decimal coordinates stay with account reminder settings until cleared, replaced, or deleted with the account; turning off reminders alone does not necessarily clear the stored setting. They are not covered by the device cache's 24-hour expiry. |
| Website privacy choices and analytics cookies | Generally 90 days, with the different expiry/refresh rules in the cookie notice; approved campaign storage is at most 30 minutes or the tab session. |
| Google Analytics user/event data and aggregate reports | Google event-level and user-level retention are set to two months, with no reset on new activity. Aggregated reports have separate retention; we do not promise all reports disappear after two months. Cookie expiry and report retention are different. |
| Service, security, and access logs | Only for the time needed to diagnose delivery failures, investigate a specific security incident, enforce request limits, or meet a legal preservation duty. Relevant factors are the incident or support case’s status, the period in which the event can reasonably be investigated or challenged, and any applicable legal deadline. Routine request data is not kept as an indefinite record of your skincare activity. |
| Support and privacy-request correspondence | While resolving the request and for the period needed to document our response, handle a related appeal or dispute, and meet applicable recordkeeping or limitation periods. Identity-verification materials and health attachments should be removed when no longer needed for that task; retaining a minimal response record does not require keeping a full medical attachment. |
| Billing and transaction records under our control | While needed to provide or restore purchased access, reconcile a transaction, or resolve a refund or charge dispute, and then only the records required by applicable tax, accounting or legal-claims periods. The applicable period depends on the transaction and the recordkeeping law, not the lifetime of the health profile. Apple may retain store records under its independent legal obligations. |
| Firebase Authentication provider records | Google describes authentication IP logs as retained for a few weeks; other authentication information remains until we request user deletion, followed by removal from live and backup systems within 180 days. This provider window does not override a shorter mandatory deadline. See Firebase privacy information. |
| Notification-provider records | OneSignal describes API message deletion as typically about 30 days after delivery, while dashboard messages remain until manually deleted or the provider app is deleted. User profiles and subscriptions require the applicable deletion process; the message period is not a blanket limit for all provider data. See OneSignal data handling. |
| Account-erasure completion records, analytics suppression records, and installation/account abuse-prevention records | Minimal pseudonymous records remain to prevent erased data being recreated, preserve your opt-out, reconcile deletion status, and enforce photo-use limits. Current duration: These records have no automatic expiry in the current service. Suppression can be needed beyond a backup cycle because an old device, queue or retry may return later; a continuing opt-out also needs continuing protection. Installation/account counters support the current lifetime photo-use limits. Review and removal: Removal requires a purpose-specific review of remaining clients, recovery sources, status-recovery needs, and the applicable limit or investigation. Any continued retention must have an applicable legal ground and remain necessary for that purpose. Records no longer needed must be removed or irreversibly de-identified without allowing erased data to return or silently resetting a still-applicable limit. These are retained personal data where linkable, not anonymous traces. |
| Minimal records of server deletion operations | The server keeps a separate record of supported deletion operations, including completion time, broad scope and method counts, for three calendar years. It does not include the erased health content, images or source record paths. Automatic expiry is asynchronous. This evidence is separate from the safeguards preventing erased data from returning and from any request correspondence or longer recordkeeping duty. |
| Backups and recovery copies | Recovery copies are retained only for the recovery period needed for the underlying system and any specific lawful preservation duty. On a valid deletion request, remaining recovery copies must be deleted or kept isolated from ordinary use until their permitted replacement or deletion, with the deletion reapplied before restored data is used. A backup cycle does not extend an applicable statutory deletion deadline; the specific Washington and Nevada rules are in the Consumer Health Data Privacy Policy. Deleted data must not be restored into ordinary use without reapplying the deletion; any shorter mandatory regional deadline controls. |
Configured expiry and validity periods are not guarantees of physical deletion at that exact instant. Some cleanup occurs when a record is next read or processed; account erasure uses the staged workflow below. Manual handling may be needed for support requests, provider records or exceptions. We remain responsible for completing a valid request within its applicable deadline and explaining any lawful retention, even when automated cleanup is delayed.
You can request account deletion in the app. The service verifies account ownership, queues deletion, and processes account data, social references, notification-provider removal, and first-party analytics in stages. Acceptance of a request is not the same as completed deletion. If verification or a provider step fails, contact us; you do not lose a statutory right because an in-app route is unavailable.
Account deletion does not cancel an App Store subscription or automatically erase all Apple/RevenueCat transaction records. Cancel billing separately in Apple account settings. We remain responsible for assessing deletion requests for subscription data processed on our behalf and explaining any applicable retention exception. No exception allows us to retain an unrestricted copy of your health profile merely because you once subscribed.
10. International processing
Nubia uses providers that may process information outside your country, including in the United States and the European Economic Area. Google states that Firebase Authentication processes data exclusively in the United States. A service's main hosting region does not describe every database, backup, support-access, telemetry, or subprocessor location. See Firebase's location information.
The recipients and information involved are identified in section 8. Transfers occur electronically when you use the relevant feature or communicate with us, and can include provider support or recovery access as well as primary storage. Optional website analytics can involve Google processing in the United States. Optional product-photo processing, when you use it, involves OpenAI; no Zero Data Retention arrangement is claimed. Provider location and retention information does not by itself establish that a particular transfer is permitted under the law applicable to you.
Where required, transfers must use an applicable adequacy decision, valid contractual safeguards, or another permitted mechanism. This may include EU standard contractual clauses, UK transfer arrangements, Swiss adaptations, Türkiye's approved mechanisms, or other locally required protections, depending on the transfer. We do not treat your acceptance of this policy as blanket consent to all international transfers. You can request details and a copy or explanation of relevant safeguards at our privacy email, with appropriate redaction of unrelated confidential information.
Some countries require recipient-specific disclosures, additional consent, local representatives, local storage, or regulatory steps before a feature can be offered. A translated policy alone does not satisfy those requirements. Features or availability may be limited where the required arrangements are not in place.
11. Your choices and rights
Depending on the law that applies, you may have rights to:
- Know whether we process your information, the purposes, sources, recipients, and retention; access it and receive a copy.
- Correct inaccurate information, delete information, or restrict particular processing.
- Receive information in a portable format or request transfer where the law provides that right.
- Withdraw consent, object to relevant processing, and opt out of covered sales, sharing, targeted advertising, or significant automated profiling.
- Obtain additional information about sensitive information, recipients, or automated decisions, and challenge a decision where applicable.
- Use an authorized representative, appeal a refusal where provided by law, and complain to a competent regulator.
Use the relevant app setting or email privacy@heynubia.com. Tell us what you need and the account email or other information reasonably needed to locate the relevant records. Do not send identity documents, medical records, passwords, or payment-card details unless we request an appropriate verification method. We request only proportionate verification and, for a representative, evidence of authority where needed. You do not need to create a new account to submit a request.
The current in-app export contains selected account/profile, concern, product, routine, and wellness information. It is not a complete statutory access response and does not include every reaction, completion, journal, social, analytics, or billing record. Contact us for a fuller request; locally stored material may need to be obtained from your device.
We respond within the deadline applicable to your request and tell you about a permitted extension and its reason. Relevant periods include ordinarily one month under the EU/UK GDPR, 30 days for an application under Türkiye's law, and generally 45 days for covered US state consumer requests, with any different consumer-health deadline set out in the separate health notice. Under Brazil's LGPD, confirmation/access can be supplied immediately in simplified form or as a complete declaration within 15 days; Canadian PIPEDA access requests ordinarily have a 30-calendar-day response period. In New Zealand an access decision is ordinarily due as soon as reasonably practicable and within 20 working days, followed by provision without undue delay. These periods are subject only to the exceptions/extensions the applicable law permits. Requests are ordinarily free; any fee or refusal must be permitted by law and explained.
We do not discriminate against you for exercising privacy rights. A feature may cease to work if you ask us to remove information objectively necessary for that feature. If we refuse a request, we explain the reason and any available appeal/complaint route. To appeal, email the same privacy address with “Privacy appeal”; the subject line is helpful but not required.
Regional information
EEA, UK, and Switzerland. You can complain to the data-protection authority where you live or work or where a possible infringement occurred, including the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner where appropriate. Our grounds, sensitive-data treatment, and transfer details are above. Section 1 identifies our privacy contact; this policy does not remove any duty to provide a local representative where required.
California and other US states. Where applicable, the categories in section 3 also describe identifiers; account/customer records; commercial information; internet/electronic activity; geolocation; images; inferences; and sensitive personal information, including health, reproductive information, credentials, and potentially precise location. Sources, purposes and recipient categories are in sections 3–8, and retention is in section 9. We do not collect biometric templates to identify you. We do not sell information or share it for cross-context behavioral advertising, and do not knowingly sell/share minors' information. Sensitive information is used to provide requested features and the limited purposes described here, not advertising profiling. The categories and purposes described above apply according to the features you use; listing an optional category is not a statement that every user supplied it. Where a law entitles you to information about collection or disclosure during a particular look-back period, you can request that account-specific information and recipient details at privacy@heynubia.com. Applicable rights may include authorized-agent requests, correction/deletion/access, limits on certain sensitive-data uses, and appeal. The separate health notice applies to covered consumer health data even where a general state privacy law's business threshold is not met.
Türkiye. Information is collected electronically from your interactions, device, providers and contacts as described above, and through correspondence. The grounds and recipients are identified in this policy. Subject to Law No. 6698, you may learn whether and why your data is processed, know recipients at home or abroad, request correction or deletion where applicable and notification to recipients, object to adverse results produced exclusively by automated analysis, and seek compensation for unlawful processing. Submit a request to the controller using section 1. A Turkish information notice and any necessary explicit-consent text must be supplied for the Turkish service; they are separate from accepting Terms.
Brazil. Where the LGPD applies, rights can include confirmation, access, correction, anonymization/blocking/deletion of unnecessary or unlawfully processed data, portability as regulated, information about sharing and consent choices, consent withdrawal, and review of qualifying automated decisions. You can contact us at privacy@heynubia.com and petition the ANPD. Sensitive-data and international-transfer requirements apply in addition to the general rules above.
Canada, including Québec. You can request access/correction, challenge our compliance, and withdraw consent subject to lawful restrictions and reasonable notice. We use an appropriate form of consent for sensitive information. Processing outside your province/country can expose information to lawful access there. Where applicable, Québec rights also include additional transparency, portability, and rights concerning certain automated decisions or dissemination. Contact the operator in section 1 or the appropriate federal/provincial commissioner.
Australia and New Zealand. You may request access/correction and complain about our handling of your information; contact us first if you wish, without losing the right to approach the OAIC or New Zealand Privacy Commissioner. Overseas-recipient details are in section 10. Applicable health-information rules may apply even to a small business.
Other regions. Local rights and mandatory protections continue to apply, including in Japan, South Korea, Singapore, and other countries where Nubia is offered. Where required, a local notice identifies overseas recipients, contact details, data items, transfer timing/method, purposes, retention, and how to refuse or withdraw. This English policy does not replace such mandatory notices or required translations.
12. Children
The 13+ AI eligibility rule in section 5 applies only to optional AI-assisted features. This AI-only restriction does not set a minimum age of 13 for the Nubia app, accounts, or non-AI features. Separate children's-data, health-data, consent and legal-capacity requirements still apply. Where local law requires legal capacity or a parent or guardian’s consent for an account, sensitive information, or a non-AI feature, that requirement applies separately. A child must not use a feature for which they are ineligible or for which required permission is missing.
The optional photo flow described in section 5 uses a declaration of age eligibility and required parental permission, plus separate consent for the selected upload to OpenAI. It does not independently verify age or parental identity and is not a general parental-account program. Availability to minors depends on the age assurance, parental-consent, sensitive-data and safety requirements applicable to that feature and market. OpenAI's under-18 API guidance also imposes developer responsibilities. Account eligibility or parental permission alone does not override those requirements.
If you believe an ineligible child has supplied information, or that required parental permission is missing, contact privacy@heynubia.com so we can investigate, restrict inappropriate processing, and delete data as required. We will not use information collected solely to investigate such a report for marketing. A public educational website being accessible does not mean a child is eligible for an app account.
13. Security
We use safeguards designed for the risks of the processing, including authenticated access, authorization checks, protected credential handling, restricted administrative access, and service security controls. No service or device can guarantee absolute security. We do not describe all app storage as end-to-end encrypted, or claim HIPAA certification or universal regulatory certification.
Keep your device and sign-in credentials secure, and use care with shared devices and exported files. If a breach occurs, we assess it and notify affected people and authorities when required, including applicable health-data breach rules. Contact privacy@heynubia.com to report a privacy or security concern without including unnecessary sensitive details.
14. Changes and accessibility
We update this policy when our practices or obligations change, identify the new effective date, and provide additional notice for material changes where required. If a new purpose needs consent, a policy update or continued use alone does not supply it. We do not retroactively apply a materially different use to previously collected information without a lawful basis.
Contact us if you need this notice in an accessible format or assistance understanding a privacy choice. Mandatory local-language and consumer rights are not displaced by the English master version.