Privacy Policy
Last updated: 23 June 2026
Introduction
This Privacy Policy describes how Nourvo ("we", "us") collects, uses, and protects your personal information when you use our nutrition tracking service. The final version of this policy is being prepared for our public beta launch; this draft reflects our current intent and serves as the basis for that final document.
Who we are
Nourvo is operated by CLICKMIX LLC, a Florida (USA) limited liability company. For privacy-related questions or to exercise your rights under this policy, contact us at legal@nourvo.app. Our infrastructure and data are in the United States; if we begin actively serving the EU/UK or Brazil, we will designate any legally required representative.
Data we collect
Account information (email, display name), health-adjacent profile data (date of birth, height, weight, biological sex, GLP-1 medication regimen), behavioral data (meal logs, dose logs, weight logs, daily targets), daily check-in data (mood, GLP-1 side effects, physical activity, and an optional free-text note), and technical data (timezone, locale, error reports). Your mood and GLP-1 side-effect entries are special-category data concerning health. We do not collect data beyond what is needed to calculate your protein target and operate the tracking features. If you use the optional barcode scanner, your device camera reads a product barcode on your device to look it up — no photo or image is captured, stored, or transmitted.
Why we process your data (lawful basis)
We process your account and profile data to provide the service you signed up for (GDPR Art. 6(1)(b) — performance of a contract). Special-category health data — weight, medication and body metrics, together with the daily check-in's mood and GLP-1 side-effect entries — is processed with your explicit consent gathered at onboarding (GDPR Art. 9(2)(a); LGPD Art. 11(I)). You may withdraw this consent at any time by deleting your account.
Third-party processors
We use Supabase (United States — database and authentication), Vercel (global edge — application hosting), PostHog (United States — privacy-respecting analytics with autocapture disabled and no user identification), and Sentry (United States — error monitoring with PII scrubbing enabled). Each operates under our Data Processing Agreement. When you scan a product barcode, the decoded barcode number — not your identity or health data, and never an image — is sent to USDA FoodData Central and the FatSecret Platform API to look up that product; see our Data Sources page for details and attribution. The final policy will link each processor's privacy policy.
Your rights
Under GDPR, LGPD, and CCPA you have the right to access, rectify, erase, restrict processing of, port, and object to processing of your personal data. You may also opt out of behavioral analytics. To exercise any right, email legal@nourvo.app; we respond within 30 days, and within 5 business days during the voluntary tester program.
Data retention
We retain your account and health data for as long as your account is active. When you delete your account, all personal data is permanently erased within 30 days. Anonymized aggregate statistics may be retained for product improvement and clinical research where lawful basis permits.
Cross-border data transfers
Your data is stored in the United States (Supabase US East region). For users in the EU/EEA and Brazil, transfers rely on Standard Contractual Clauses (SCCs) under GDPR Art. 46 and LGPD Art. 33. The final policy will publish copies of the relevant SCCs upon request.
Children's data
Nourvo is intended for users aged 18 and over. We do not knowingly collect data from minors. If you believe we have inadvertently collected data from a person under 18, contact us immediately at legal@nourvo.app so we can delete the account and associated data.
Cookies and analytics
We use essential cookies to maintain your authenticated session. PostHog analytics may set additional cookies for usage measurement; these are disabled by default and set only after you accept the analytics consent banner shown on first visit. Declining leaves analytics off. You may also opt out later by emailing us with your account email.
Security and breach notification
Data is encrypted in transit (HTTPS) and at rest (Supabase default encryption). We follow Sentry's PII scrubbing protocols for error monitoring. In the event of a breach involving your personal data, we notify affected users without undue delay and within 72 hours where required by GDPR Art. 33.
Changes to this policy and contact
We may update this policy as the product evolves; material changes will be announced via email at least 14 days before they take effect. Contact us at legal@nourvo.app for any privacy-related question or to exercise your rights.