Nomu Privacy Policy

Nomu stores everything you track locally on your device, in a SQLite database, your device's app preferences, and the app's private files folder. This includes:

• Your fasts: start and end times, fasting plan, goal hours, and every edit you make to them
• Your streak, grace days, achievements and Nomu's wing evolution progress
• Water intake logs and mood check-ins
• Weight entries and body measurements
• Progress photos you take or choose, stored as files inside the app's own folder
• Supplements you set up and the doses you mark as taken or skipped
• Goals you set, and the articles you have read
• App preferences: fasting plan, theme, accent colour, units, language, notification times, sound and haptics settings

Nomu uses Firebase Analytics and Firebase Crashlytics (Google), and PostHog (product analytics, processed on servers in the United States), to understand how the app is used and to catch bugs. These are anonymous. What is collected:

• A randomly generated identifier for your installation of the app, not linked to your name, your email, or any advertising ID
• Device model, operating system version, app version, language and country setting
• Which screens you open and how long you spend in the app
• That an action happened — for example fast started, fast completed, fast edited, phase reached, weight logged, progress photo added, supplement taken or streak maintained
• A few low-detail values attached to those actions: how many minutes a fast ran and how many you had planned, the mood you tap on a check-in, the amount of water logged, how many measurement fields you filled in, and which fasting plan and goal you chose
• Broad ranges from onboarding: your age range, your experience level, and your starting height and weight as a band such as "70–79 kg" — never the exact number
• Which paywall and subscription steps you reached, so we can see where the purchase flow confuses people
• Crash and error diagnostics if the app misbehaves, including the stack trace and device state at the moment it failed

You can turn all of this off. See section 11.

This is the one thing in Nomu you would not guess, so we want to be direct about it — including about what it does not protect.

For the first four days after you first open Nomu, the app takes periodic screenshots of the Nomu interface, records where you tap, and sends them to PostHog, whose servers are in the United States. Think of it as a rough screen recording of the app. After four days it stops on its own and does not start again.

What is hidden

Masking happens on your device, before anything is sent. These never appear in a recording:

• Every image. Your progress photos can never appear in a recording, on any screen
• Your weight values and weight charts, and any goal figure based on your weight
• Your BMI — the number, and the marker on the BMI scale, because where the marker sits gives the number away on its own
• Your body measurements and their history
• Your mood check-ins
• Everything you enter about supplements and medication — names, brands, dosages, injection sites and your notes
• The custom measurement names you created
• Everything you write in the feedback form, both your message and your email address
• The barcode scanner's live camera preview — what your camera is pointed at is never recorded
• The data preview on the export screen
• Anything typed into a password, email, phone, name or address field — always and automatically, wherever it appears in the app

What is visible

Nomu's own interface text is not masked, and that is deliberate. Buttons, labels, headings and the rest of the app's wording appear as they really look on your screen. Nomu ships in 16 languages, and the only way to see that a German button label is cut in half or that an Arabic layout has flipped the wrong element is to look at the actual rendered screen. A recording with every string greyed out shows rectangles moving around and answers none of that.

So a recording shows the ordinary surface of the app as you experienced it — your fasting timer running, your streak count, the plan you are on, the articles you open. That is the trade we have made, and we would rather state it than imply the recordings are blanker than they are: the personal and health details listed above are masked; the interface around them is not.

This exists to show us where Nomu is confusing and where a translation has broken the layout, in the first days — when a confusing app is the reason people give up. It is not used to profile you, it is not sold, and it is not shared with advertisers.

If you choose to send feedback, report a bug, or request a feature from inside Nomu, the app sends the following to Tappect's server at tappect.com, where it is stored in our Supabase database:

• Your message
• The type of feedback (feature request, bug report, or general feedback)
• Your email address, only if you choose to enter one so we can reply
• App version and platform (iOS or Android)
• Your device's locale (language and region setting)

This is sent only when you tap send, and only the fields shown above are transmitted — none of your fasting data, weight, photos or health readings go with it. We use it to reply to you and to improve Nomu. We do not sell this information or share it with advertisers. If sending fails, Nomu offers to open your email app instead, which puts you in control of what is sent.

Both fields on this form are masked in session replay, so what you write reaches us only when you choose to send it — never as a side effect of a recording. See section 4.

Nomu is a paid app, and subscriptions and the lifetime purchase are handled through the App Store and Google Play. Nomu uses RevenueCat to check whether your purchase is valid and whether your subscription is still active.

RevenueCat receives your store purchase receipt, an anonymous identifier it generates for your installation, and basic device and country information. We never give RevenueCat a name or an email address, and it never receives your fasts, your weight, your photos or anything else you have entered in the app.

Your actual payment details — card number, billing address — are handled entirely by Apple or Google. Tappect never sees them.

Nomu asks for these permissions, all of them optional:

Nomu does not request access to your microphone, your contacts, or your location.

Nomu contains no third-party advertising SDKs, shows no ads, and does not use your advertising identifier (IDFA on iOS, or the Advertising ID on Android). Nothing Nomu collects is used to track you across other companies' apps or websites.

We do not sell, rent, or trade your personal information to anyone, for any purpose, ever. The companies named in this policy — Google, PostHog, RevenueCat and Supabase — process data on our instructions to run the app, and for nothing else.

If you choose to connect Apple Health (iOS) or Health Connect (Android), Nomu reads and writes a small, fixed set of data:

• Reads your weight, so your weight chart stays in step with the rest of your phone
• Writes weight back, so a weight you log in Nomu shows up in your health app too
• Reads your step count and active energy for today — iOS only, to show them on the home screen. The Android build never asks for these, because it does not display them

You can revoke the connection at any time in Nomu's settings, or in the Health app on iOS, or in Health Connect on Android.

Nomu is a wellness and tracking tool, not a medical device. It is not intended to diagnose, treat, cure or prevent any disease. Talk to a healthcare professional before starting a fasting routine, especially if you are pregnant, nursing, diabetic, underweight, or managing a medical condition.

Everything you track stays on your device. The limited information described in sections 3 to 6 is processed by these companies on our behalf:

• Google (Firebase Analytics, Firebase Crashlytics) — anonymous usage events and crash diagnostics. Firebase privacy information
• PostHog — product analytics and the four-day session replay, processed on servers in the United States. PostHog privacy policy
• RevenueCat — purchase receipts and subscription status. RevenueCat privacy policy
• Supabase — stores the feedback messages you choose to send us. Supabase privacy policy

If you are in the UK, the EU or another region with data transfer rules, this means some anonymous usage data is transferred to and processed in the United States under the standard contractual protections those providers offer.

How long it is kept

• Everything on your device — your fasts, weight, measurements, photos and settings — is kept until you delete it or uninstall the app. We do not expire it, because we never hold it.
• Session replay recordings are deleted automatically by PostHog at the end of the retention window set on our project, and we do not download, copy or archive them anywhere else. Once that window passes, the recording is gone.
• Analytics events are kept while they are useful for spotting trends. They carry no identifier that we could trace back to you, so what remains after that is counts and averages.
• Crash reports are held by Firebase Crashlytics under Google's own retention schedule, and we do not keep a separate copy.
• Feedback you send us is kept so we can act on it and honour any support conversation. Ask us and we will delete it — see section 11.

Because everything you track lives only on your device, you already hold almost all of it. For the rest, here is how to exercise your rights:

• Opt out of analytics and session replay: use the switch in Nomu's Settings described in section 4. It switches off Firebase Analytics, Firebase Crashlytics and PostHog, including session replay, straight away. Nomu keeps working exactly as before — nothing is gated behind it.
• Access: everything you have tracked is visible in the app at any time, and Nomu can export it to a file you keep.
• Deletion on your device: uninstalling Nomu permanently deletes your fasts, weight, measurements, progress photos and settings from your device.
• Deletion of analytics and replays we hold: email us at hello@tappect.com with the subject line Nomu Data Deletion Request. Tell us the platform you use and roughly when you installed Nomu, and we will locate and delete the analytics events and any session replays associated with your installation. We will confirm within 30 days.
• Deletion of feedback you sent: ask in the same email and we will delete your feedback message from our database.
• Objection and correction: if you object to any processing described here, or believe something we hold is wrong, write to us and we will act on it within 30 days.

Cancelling a subscription is separate from deleting data. Subscriptions are billed by Apple or Google, so cancel in App Store → your name → Subscriptions on iOS, or Google Play → Payments & subscriptions on Android.

If you have any questions or concerns about this privacy policy, please contact us:

We will respond to your inquiry within 30 days.