Privacy Policy

To run Numina, we rely on a small number of carefully chosen service providers (subprocessors). Each one processes your data only to provide the service — never for advertising, and never to train AI models:

• OpenRouter — routes our AI requests to the model providers below. We don't let it send your content to providers that keep or train on it.
• Anthropic — generates your companion's responses and scores questionnaire answers (Claude models, via API). Under Anthropic's API terms, API data is not used to train their models.
• OpenAI — writes Compass insights, extracts memories from your conversations and uploads, and creates the search index for your memories (via API). Under OpenAI's API terms, API data is not used to train their models.
• DeepInfra, Parasail, Microsoft Azure, or DigitalOcean — run an open-weight model (DeepSeek) that splits uploaded files into journal, dream, meditation and journey entries. Requests go only to these US hosts, under terms that neither keep nor train on your content, never to DeepSeek's own service.
• Arize — AI monitoring: stores records of AI requests and responses, including the context described above, in its EU region, so we can find and fix poor or unsafe responses.
• Supabase — hosts our database and file storage, encrypted at rest and in transit.
• Vercel — hosts the Numina application.
• Resend — sends transactional emails (e.g., account and service notices).
• Google Analytics — measures visits to our public pages when you are not signed in. Its cookies are set only if you accept the cookie banner, and declining changes nothing about how Numina works. Clearing this site's cookies and storage in your browser lets you choose again.
• Memory-index provider (Mem0 or Zep, if configured) — indexes memories so your companion can recall context.

When you are signed in, we record how Numina's features are used — for example, that a questionnaire was completed or an import finished — so we can see what works and fix what doesn't.

• What is recorded: the name of the action, when it happened, and simple details such as which map or step it concerned, or a count. It never includes what you write — not your conversations, journal entries, questionnaire answers or imported content.
• Where: in our own database (Supabase), linked to your account. No cookies are used and nothing is shared with advertisers or analytics companies.
• Why: our legitimate interest in understanding and improving the service.
• How long: records are deleted automatically after 13 months.
• Your choice: you can object at any time by turning off Product analytics in Preferences. We stop recording immediately and delete what we have already recorded. Nothing else about your account changes.

We use industry‑standard safeguards to protect your information, including:

• Infrastructure-level encryption — TLS in transit and encrypted storage at rest. Application-layer encryption of sensitive fields is in development.
• Secure authentication and database row-level security, so your records are scoped to your account
• Regular security reviews and good‑practice operational processes

Your personal journey content is stored securely and accessed only to provide the service to you.

You are in control of your information. You can:

• Access your personal information
• Update or correct your details
• Export your data from Account settings
• Delete your account and all personal data from Account settings, or remove individual memories from the Memory dashboard

You can manage these options in Account settings or by contacting us. We are committed to GDPR principles and will process requests promptly and securely.