Privacy Policy

This Policy explains how Nousfy collects, uses, stores and protects personal data under Brazil’s General Data Protection Law (Law 13,709/2018, LGPD) and other applicable laws, including the European General Data Protection Regulation (GDPR) where its territorial scope applies.

The GDPR may apply to offering services to people in the European Union / European Economic Area, even when the service provider is outside that region. Its applicability depends on the circumstances established by law. This Policy explains data handling; it does not replace specific consent where legally required. See also our Terms of Use.

Nousfy involves intimate personal reflections, emotional responses and self-awareness exercises. For this reason, everything you write in tools and journeys remains exclusively on your own device.

We do not send or store reflection text in a cloud database. Server infrastructure holds only the minimum required for account operation: basic login data, subscription status and general usage preferences.

This reduces exposure and the risk of reflection leaks from our servers, without eliminating risks on the device itself. We do not keep copies of those texts, synchronise or transfer them to a new phone at sign-in, or recover them through our systems.

2.1. Account data in server infrastructure: name or display nickname, email and protected password credentials; language and focus/goal preferences, records of acceptance of the Terms and basic progress indicators without personal writing; and Premium subscription status. Payment details are handled by the App Store, Google Play or a payment partner. We do not store complete credit card details.

2.2. Local data: reflections, chapters, responses and tool records are saved only on your device in its local storage. In dynamic writing stages, text is temporary, used for the exercise and not saved after completion.

2.3. Basic technical data: essential information such as device type, operating system and authentication IP address, for account security, fraud prevention and stability.

2.4. What we do not do: store reflection text on our servers, sell personal data, display ads, share data with advertisers or use reflections to train AI models.

Account data and preferences enable authentication, sessions, language and focus settings; subscription validation and management with the store; platform security and fraud prevention; and essential account or subscription communications, such as password resets, subscription confirmations or significant changes to the Terms.

We do not use data for targeted advertising.

Under the LGPD, processing relies on performance of a contract (article 7(V)) for app access, preferences and subscription management; legitimate interests (article 7(IX)) for security, fraud prevention and stability, respecting your rights; and legal obligations (article 7(II)) where relevant to fiscal or regulatory duties.

Where the GDPR applies, the corresponding bases are performance of a contract (article 6(1)(b)), compliance with legal obligations (article 6(1)(c)) and legitimate interests (article 6(1)(f)), where appropriate and balanced against your rights. Processing that legally requires consent depends on obtaining that consent; accepting the Terms is not blanket consent for every processing activity.

Minimum account data may be shared with technical infrastructure providers for authentication and profile/subscription databases; app stores and payment or subscription validation providers, limited to necessary identifiers; and public authorities where legally required or ordered by a court.

Account data, subscription status, preferences and necessary technical data are stored and processed in international infrastructure outside Brazil. This is separate from personal reflection text, which stays on your device and is not sent to that infrastructure.

International transfers must meet the requirements of applicable law, including the LGPD and, where applicable, the GDPR. For information about processing locations and applicable transfer mechanisms, contact igor@nousfyapp.com.

We do not share reflection text with third parties because it remains local. No additional usage analytics or crash-reporting services are currently implemented in the app. Essential account and subscription infrastructure may process the basic technical data described here, never reflection text.

6.1. We use technical and organisational measures to protect account data, including HTTPS/TLS encryption in transit, protected password credentials and access controls, as well as protection of local app storage.

6.2. Account data and preferences are retained only as needed to provide the service or meet legal obligations. Local reflection records are erased from the device if you uninstall or clear the app’s storage in phone settings.

6.3. No system is completely risk-free. Relevant account-data security incidents will be communicated as required by applicable data protection law.

6.4. Guest mode. Only free-writing entries are recorded locally. Creating an account erases guest entries without linking or migration. Premium access on other devices does not transfer these or other local texts.

6.5. Rolling histories. Saves in Autodireção and Ressignificar, writing in Kairos and Resumo de Jornada use limited local histories. Once the relevant limit is reached, new records replace the oldest, which become unavailable. This happens with new saves, not after a fixed number of months.

Autodireção and Ressignificar are reflection tools; Kairos includes writing entries; Resumo de Jornada means journey summaries. Names are retained to match the app.

Rolling histories prioritise recent experiences and attention to the present rather than permanent reflection archives. We do not send these texts to our servers or keep copies to recover replaced records.

Under the LGPD, you may request confirmation of processing, access, correction, anonymisation, blocking or erasure of unnecessary or unlawfully processed data, portability, erasure of data processed with consent, withdrawal of consent, information about recipients, and review of automated decisions where applicable.

Where the GDPR applies, you also have the applicable rights to access, rectification, erasure, restriction, portability and objection, and protections concerning solely automated decisions where relevant. You may withdraw consent without affecting prior lawful processing and lodge a complaint with the competent supervisory authority, including the authority in your country of habitual residence, work or the alleged infringement.

Email igor@nousfyapp.com to exercise your rights. Requests follow statutory deadlines: under the LGPD, confirmation and access may be provided immediately in simplified form or through a complete statement within 15 days. Under the GDPR, responses are generally provided within one month, with legally permitted extensions communicated to you. These deadlines are not the general support response time.

8.1. Delete your account and associated data directly in the app through Configurações → Minha Conta → Excluir Conta. This is the recommended path: deletion is immediate, without waiting for support.

The app path above means Settings → My Account → Delete Account. Portuguese labels are retained to identify the controls.

8.2. If you cannot access the app or complete deletion, send a request from the same email address registered to your Nousfy account to suporte@nousfyapp.com.br. The request will be fulfilled within 30 days, without prejudice to applicable statutory rights and deadlines.

8.3. In-app deletion removes registration data and preferences from active systems and clears local records on the device used for deletion. Support requests delete data under our control within 30 days; we cannot remotely erase texts on devices we cannot access. Clear local app data on those devices yourself. Only data needed for legal obligations may be retained.

Deleting the account or uninstalling does not cancel an active subscription. Cancel separately through the purchasing store.

Nousfy is intended for people aged 16 or older, not children. Users under 18 need a legal guardian’s knowledge and agreement.

Age is declared by the user without document verification. We do not intentionally collect data from people under 16; such accounts may be deleted when we become aware of them, including through a guardian’s report to suporte@nousfyapp.com.br.

The app may use local identifiers and similar technologies to remember preferences and login sessions. We do not use them for advertising tracking across third-party apps.

Nousfy currently does not send reminders or notifications through the app.

We may update this Policy periodically. Significant changes will be communicated through the app or email with reasonable advance notice.

To exercise rights, ask questions or submit privacy requests, contact the developer of Nousfy at igor@nousfyapp.com.

For general app support, use suporte@nousfyapp.com.br.