Privacy Policy

Effective: July 9, 2026  ·  Last updated: September 8, 2026

This Privacy Policy explains how Ivan Borisov ("we", "us", or "our") collects, uses, stores, and protects your personal data when you use the Nelo application ("App").

1. Who We Are

Nelo is developed and operated by Ivan Borisov, an individual developer. If you have any questions about this policy, contact us at johanintheuk@gmail.com.

2. Data We Collect

We collect the following categories of personal data:

• Account data — your account identifier and the name and email address made available when you sign in with Apple or Google. Depending on your provider settings, we may receive a relay email address instead of your personal email address.
• Thought content — the thoughts, answers, interim notes, reflections, and other text you submit within the App.
• AI-generated content — questions, snapshots, insights, comparisons, summaries, and thinking patterns generated from your content.
• Usage and analytics data — interactions with App features, completed reflections, thread and return counts, subscription status, and activity timestamps. We do not send the text of your thoughts or answers to Firebase Analytics.
• Notification data — device messaging tokens, random installation identifiers, notification delivery status, and notification interactions when notifications are enabled.
• Technical and security data — device and app information, network metadata, and App Check attestation data used to operate, secure, and diagnose the App.

We do not ask for access to your precise location, contacts, or photos. Service providers may derive general location information from technical data such as your IP address.

3. How We Use Your Data

We use your personal data to:

• Provide Nelo's core functionality — storing your content, generating AI-powered questions and insights, and showing how your thinking evolves over time.
• Authenticate you and protect the App against fraud, abuse, and unauthorised access.
• Send re-entry reminders and inactivity notifications when you have enabled notifications.
• Manage purchases, subscriptions, and free-tier allowances.
• Understand feature usage and improve the App's reliability, performance, and design.

We do not sell your personal data or use your thought content for advertising.

4. AI Processing

Nelo uses AI models provided by OpenAI to generate questions, snapshots, insights, comparisons, summaries, and thinking pattern analyses. Before sending content to OpenAI, Nelo asks for your explicit permission. The content needed for a particular feature is transmitted to OpenAI's API for processing only when you have allowed it. You can decline or turn off new AI requests on this device in Settings under AI & Privacy; your saved history remains available. Turning this off does not recall content already transmitted. OpenAI does not use API content to train its models unless the API customer explicitly opts in. For more information, see OpenAI's API data controls.

Your content may include sensitive personal reflections. We send only the context needed to provide the requested feature. Under OpenAI's standard API controls, prompts and outputs may be retained in abuse-monitoring logs for up to 30 days, unless a longer period is legally required.

5. Third-Party Services

We use the following third-party services to operate the App:

• Google Firebase (Firestore, Authentication, Cloud Functions, Cloud Messaging, Analytics, and App Check) — data storage, authentication, backend logic, push notifications, product analytics, and app security. Google Sign-In is also available as an authentication method. Operated by Google LLC.
• OpenAI — AI processing of the content needed to generate questions, snapshots, insights, comparisons, summaries, and patterns. Operated by OpenAI, L.L.C.
• Apple — Sign in with Apple, App Store distribution, and in-app purchase processing. Operated by Apple Inc.
• RevenueCat — subscription entitlement and purchase management. Operated by RevenueCat, Inc.

These providers process data under their own terms and privacy policies. We do not sell your personal data to them or to any other third party.

6. Data Storage and Transfers

Our service providers may store or process personal data in the United States and other countries where they or their subprocessors operate. Firebase Authentication is operated from the United States; other Firebase services use global or service-specific infrastructure. OpenAI, Apple, and RevenueCat may also process data outside your country. Where required, we rely on safeguards made available by these providers, such as Standard Contractual Clauses, for international transfers.

7. Data Retention

We retain your account and App content while your account is active. When you delete your account, Nelo immediately requests deletion of your active Firebase account data, including your thoughts, answers, snapshots, insights, patterns, and registered notification tokens.

Some providers may retain limited records for security, fraud prevention, transaction accounting, legal compliance, or backup lifecycle purposes under their own retention rules. Apple controls App Store purchase records, and deleting your Nelo account does not cancel an active App Store subscription. OpenAI may retain API abuse-monitoring logs as described in Section 4.

8. Your Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a portable copy of your personal data, and to object to or restrict certain processing. You may also withdraw consent where processing relies on consent.

You can delete your account via Settings → Delete Account, export your threads and reflections as a PDF via Settings → Export as PDF, and disable notifications via Settings → Notifications or your device settings.

To exercise another right, contact us at johanintheuk@gmail.com. We will respond within the period required by applicable law. You may also have the right to complain to your local data protection authority.

9. Legal Basis for Processing (EEA and UK Users)

If you are in the EEA or UK, we rely on the following legal bases:

• Contract performance — providing your account, storing your content, generating requested AI features, and administering your subscription and free-tier access.
• Consent — sending push notifications after you enable them; you can withdraw this permission at any time.
• Legitimate interests — securing the App, preventing abuse, diagnosing failures, and using proportionate product analytics to improve reliability and design.
• Legal obligation — retaining or disclosing limited records when required by applicable law.

10. California Privacy Rights (CCPA)

If California privacy law applies to our processing of your information, you may have rights to know, access, correct, or delete personal information and to non-discrimination for exercising those rights. We do not sell or share personal information for cross-context behavioural advertising. To submit a request, contact us at johanintheuk@gmail.com.

11. Children's Privacy

Nelo is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

12. Security

We use reasonable technical and organisational measures to protect personal data, including encrypted transmission (TLS), Firebase Authentication, App Check, recent reauthentication for account deletion, and Firestore rules that enforce per-user data isolation. No method of transmission or storage is completely secure.

13. Changes to This Policy

We may update this Privacy Policy as the App or legal requirements change. We will update the "Last updated" date and, when required, provide additional notice or request consent before a material change takes effect.

14. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at johanintheuk@gmail.com.