Privacy Policy

Last updated: March 25, 2026

Dual Photon Labs ("we", "us", "our") operates the Nonori mobile application ("the App"). This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

Account Information

• Email address (when you sign up with email, Google, or Apple)
• Display name (optional)
• Profile photo (optional)

App Data

The following data is created by you within the App and stored to provide the service:

• Daily mood check-ins (mood level, notes)
• Gratitude entries
• Thought journal entries
• Tasks and progress
• Personal values selections

AI Analysis

When you use the thought analysis feature, your thought text and mood level are sent to Google Gemini API for cognitive bias detection. This data is processed in real-time and not stored by Google for training purposes. We log AI requests (timestamp, user ID, token count) for rate limiting and abuse prevention.

Technical Data

• Push notification tokens (if you enable reminders)
• Device platform (iOS/Android)
• App language preference

2. Legal Basis for Processing

We process your data based on the following legal grounds under the GDPR:

• Contract performance — to provide the App's features (mood tracking, gratitude, thought analysis, tasks)
• Consent — for push notifications (you can opt out at any time)
• Legitimate interest — for security, abuse prevention, and service improvement

3. Data Storage and Security

Your data is stored securely on Supabase (hosted on AWS infrastructure). All data is transmitted over HTTPS. We use Row Level Security (RLS) to ensure you can only access your own data. Your data is also cached locally on your device for offline access.

4. Third-Party Services

We use the following third-party services:

• Supabase — Authentication, database, and storage (Privacy Policy)
• Google Gemini API — AI thought analysis (Terms)
• RevenueCat — Subscription management (Privacy Policy)
• Expo — Push notifications (Privacy Policy)
• Apple / Google — OAuth sign-in and in-app purchases

5. Data Sharing

We do not sell, trade, or rent your personal data to third parties. Your data is only shared with the third-party services listed above, solely to provide the App's functionality.

6. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our third-party service providers (Supabase, Google, RevenueCat, Expo) operate. These transfers are protected by appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Your Rights

Under the General Data Protection Regulation (GDPR) and other applicable laws, you have the right to:

• Access your data — You can export your history as a PDF from the App
• Delete your data — You can delete your account from the App's settings, which permanently removes all your data
• Portability — You can export your data as PDF
• Withdraw consent — You can disable notifications or delete your account at any time
• Lodge a complaint — You have the right to lodge a complaint with the Portuguese data protection authority (CNPD — Comissão Nacional de Proteção de Dados) at www.cnpd.pt

8. Data Retention

Your data is retained as long as your account is active. When you delete your account, all associated data is permanently deleted from our servers.

9. Children's Privacy

The App is not intended for children under 13 years of age. We do not knowingly collect data from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the App or by email.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at:
nonori@dualphotonlabs.com

We do not have a Data Protection Officer (DPO) as we are a small organization. For any data protection inquiries, please use the email above.

Dual Photon Labs · Portugal