Privacy policy

By default, and without any account, everything you enter is stored only in the app's storage on your device: tasks, habits, routines, moods, journal, sleep, hydration, cycle, weight, calories and meals, budget, notes and photos in the external memory, medical appointment preparation, emergency contacts and profile, settings and customization.

This data is never read, transmitted or backed up elsewhere unless you enable one of the features below. It is gone if you uninstall the app or use the reset option in Settings.

This storage happens in your own device's memory. It exists solely to make the app work, with no tracker and no analytics.

Théia is an artificial intelligence, not a person. This is stated inside the app, from the very first message.

What is sent

• The message you write, and the previous turns of the current conversation.
• Context the app adds so answers are useful: for example your first name if provided, any conditions you listed in your profile, and recent indications about your mood, sleep, tasks or streaks.
• Photos you choose to analyze (meal scan for calorie estimation, or a photo sent to Théia).

None of this leaves your phone until you open an AI feature. Using Théia is a choice: if you do not use her, none of this information goes anywhere.

To whom

• Anthropic (Claude model), through an intermediate server hosted on Google Cloud in Europe (europe-west1) owned by the publisher. That server does not keep the content of your messages: it relays the request and returns the answer. Anthropic is based in the United States; the transfer relies on the European Commission's standard contractual clauses. You can request a copy at the contact address.
• Pollinations, a free third-party service used as a fallback when the first service is unavailable, and for the synthetic voice of the SOS fake call.

What is never sent

Your full journal, your budget, your personal notes, your external memory photos and the detailed history of your health data are not sent to the AI. Only the items described above are, at the moment you use an AI feature.

Training and retention

Your exchanges are not used by the publisher to train models. Your conversation history with Théia is kept on your phone, and you can erase it from Settings, with "Erase Théia's memory".

A daily usage quota is tied to your account to prevent abuse. It only stores counters, not the content of your messages.

No automated decisions

Théia makes no decision producing legal effects or significantly affecting you. What she answers is a suggestion, which you follow or not. An artificial intelligence can be wrong: her answers never replace professional advice.

The app works entirely without an account. If you create one, it is used to sync some data across your devices and to use the close circle.

• Account data: email address, password (handled by Google Firebase Authentication, never visible to the publisher), nickname, four-digit tag, profile picture if you add one.
• Sync: only your journal is stored on Google Firestore, tied to your account ID. Everything else (tasks, moods, trackers, settings) stays on your phone, even with an account.
• Close circle: links between accounts, and location sharing if you enable it.

Hosting: Google Firebase (Google Ireland Limited for the European Union), acting as a processor on the publisher's behalf. Security rules restrict access to your own account and, for location sharing, to people you have accepted.

A close circle involves two people: each must accept the link, and each can break it alone, which immediately stops sharing both ways. Only add someone who agrees to see this information and to let you see theirs.

None of this is required. Without an account the app still works, simply without sync and without the close circle.

Location is only used when you enable a feature that needs it:

• Routes and nearby places: your position is sent to the mapping services used by the app (HERE, Photon, the French National Address Base, OpenStreetMap and Overpass) to compute a route or find a shop or a safe place.
• Sharing with your circle: if enabled, your position is stored on our servers and visible only to the people you accepted. It is deleted as soon as you turn sharing off.
• Background location: only to keep that sharing going when the app is not in the foreground. It is never collected for advertising nor sold.

You can refuse location access, or withdraw it later in your phone settings. The related features then stop working; the rest of the app carries on normally.

• Health Connect (Android): if you allow it, the app reads your sleep, steps and heart rate data so you do not have to type it, and can write nights recorded in Nœma. This data stays on your phone.
• Open Food Facts: when you search for a food or scan a barcode, the search term or code is sent to this open database to retrieve nutrition information.

What Nœma never does with your health data. Health and fitness data read through Health Connect is never shared with a third party, never sold, never passed to data brokers, never used for advertising, including personalized advertising, never used to train an artificial intelligence model, and never sent to Théia. It is only used to fill in your own trackers inside the app, on your phone.

What you record yourself about your sleep, mood, cycle, weight or meals is health data under article 9 of the GDPR. It is processed on the basis of your explicit consent, given when you turn the matching feature on, and withdrawable at any time in Settings, with no justification needed.

This data stays on your device: sync only covers the journal.

• Microphone: used only for voice dictation, when you press the matching button.
• Camera and photos: used for your profile picture, the external memory and the meal scan. Images stay on your device, except those you deliberately send to the AI for analysis (see the Théia section).

None of these permissions is asked for at launch: each one is requested when you use the feature, and you can decline.

• Crash reports: Google Firebase Crashlytics receives technical information when an incident occurs (device model, Android version, error trace), in order to fix bugs.
• Notifications: reminders you schedule yourself. They are handled by your phone.
• Optional services you connect: Last.fm and YouTube for your listening statistics, Steam for the Games page. Read-only, displayed in the app, never sold.
• Update check: the app fetches a file on noemaworks.net to know whether a new version exists. No personal data is sent.

There is no advertising, no ad tracker and no advertising identifier in Nœma. No data is sold or traded.

Here is the full list of outside services that may receive something, what they receive, and in what capacity. "Processor" means it acts on our instructions and on our behalf. "Independent controller" means it decides for itself what it does with the data, under its own policy.

No other recipient. No ad network, no data broker, no analytics tool.

Each feature has its own legal basis. The table also says what you lose if you decline: in every case, the app stays usable.

• Local data: kept as long as the app is installed, until reset or uninstall.
• Account and synced data: kept as long as the account exists, deleted with it.
• Shared location: deleted as soon as sharing is turned off.
• Messages sent to the AI: processed for the time needed to generate the answer, not retained by the publisher.
• AI quota counter: a date and a number of requests, reset every night.
• Crash reports: per Firebase Crashlytics retention policy, 90 days maximum.

Under the GDPR you have rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time. Withdrawing a consent does not undo what was done before.

• Delete your account and its data: directly in the app, Profile then "Delete my account". Deletion is immediate and permanent. The full procedure, including if you no longer have the app, is on the account deletion page.
• Delete your local data: Settings then "Reset app".
• Get your data back: what is on your phone is already yours and never left it. To receive a copy of your account data in a reusable format, email the address below and it is sent to you.
• Contact us: support@noemaworks.net, subject "My data". Answer within one month, extendable by two months for complex requests, in which case you are told.
• Complaint: you may lodge a complaint with the French CNIL, cnil.fr, or your local authority.

Exchanges with servers are encrypted (HTTPS). Access to account data is restricted by server-side security rules. The app does not store access keys on your behalf, and screenshots are blocked when the app goes to the background.

Nœma is intended for people aged 15 and over. In France, below 15 a minor cannot consent alone to the processing of their data: the agreement of a parent or legal guardian is then required, in particular for the account, sync, close circle and the AI assistant.

This policy may change along with the app. The last update date is shown at the top of this page, and significant changes are announced in the app's release notes. If a change alters what is done with your data, you are told inside the app before it applies.

Nœma is not affiliated with, endorsed by or sponsored by Google, Anthropic, Last.fm, YouTube, Steam or Open Food Facts. Trademarks belong to their respective owners.