NovaLife is a health and lifestyle tracking app. This policy explains, in plain language, what data the app handles, where it lives, what leaves your phone, and the controls you have.
On your phone: everything you log is stored in a local database encrypted with SQLCipher (the encryption key is held in your phone's secure keystore).
In your account on our servers (when Sync & Backup is on; it is by default): your food, water, exercise and workout records, weight and body measurements, manually logged sleep, meal and workout plans, saved meals, milestones and streaks, and profile and targets. This exists so your data survives a lost or broken phone, syncs across devices, and is available on the NovaLife web app. Server data is protected by row-level security (only your account can access your rows) and encrypted in transit. You can turn Sync & Backup off in Settings at any time; that stops future syncing, and you can remove everything from our servers with "Delete my account and all data."
Never synced, no matter the setting:
The Coach AI (an optional download of roughly 550 MB in Settings) runs entirely on your device. Your health data is never sent anywhere for coaching, guidance, or chat. Coaching numbers are computed locally; the model only rewords them, on the phone.
| Data | Where it goes | Why | Stored there? |
|---|---|---|---|
| Email address (and password hash, or your Google account ID if you sign in with Google) | Supabase (our backend provider) | Creating and signing in to your account | Yes, until you delete your account |
| Fitness and lifestyle logs (food, water, workouts, weight, manually logged sleep, plans, saved meals, milestones, profile and targets) | Supabase, under your account | Sync & Backup (on by default; Settings toggle): backup, restore, multi-device sync, and web access | Yes, until you delete your account (turning sync off stops future syncing) |
| Progress photos | Supabase Storage (private bucket; only your account can access them) | So your photos survive a lost phone and sync across devices | Yes, until you delete the photo or your account |
| Meal photos (only when you use "Log meal from photo") | Our server function, which forwards the photo to Anthropic's Claude API for analysis | To identify foods and estimate portions in the photo | No. The photo is analyzed and discarded; it is not stored by us. You are asked for consent before the first use, and nutrition numbers always come from a food database, not the AI |
| Anonymous photo-correction records (only when you correct a photo-detection result) | Our servers | To improve food detection for everyone. Contains only: the detected food, the database food you chose instead, and a portion-size bucket. Never the photo, never custom foods you typed, never your identity | Yes, but it contains nothing that can identify you or your device. Turn off in Settings ("Help improve food detection") |
| Food search text (what you type, or a scanned barcode) | USDA FoodData Central and Open Food Facts | To look up nutrition data | Queries are not linked to your account by us |
| Crash reports (device model, OS version, stack trace) | Firebase Crashlytics (Google) | To find and fix crashes | Yes, retained per Google's Crashlytics policy. Crash reports contain no health values and no log content |
| Push notification token | Firebase Cloud Messaging (Google) | Reminders you schedule (meals, water, workouts, weekly summary) | Yes, while the app is installed |
| Mood & journal entries (only if you opt in) | Supabase, under your account | Backup/restore you explicitly requested | Yes, until you opt out or delete your account |
We do not sell your data, use it for advertising, or share it with data brokers. We do no behavioral analytics: no screen tracking, no advertising profiles, no engagement tracking.
With your permission, NovaLife reads steps, heart rate, active calories, and sleep from Google Health Connect, and writes back workouts, water, weight, and active calories you log. Health Connect data is displayed in the app and stored only in the encrypted local database. Health Connect data is never uploaded to our servers and is never included in Sync & Backup or the web app.
Per Google's Health Connect policy: we use this data solely to provide the app's tracking features. We do not use Health Connect data for advertising, do not sell it, and do not share it with third parties. You can revoke access at any time in the Health Connect app, and the app keeps working without it.
The NovaLife web app (app.thenovalife.app) gives you access to the same account and synced data from a browser: viewing and editing your logs, plans, and progress. All traffic is encrypted (TLS) and the same row-level security applies. Data kept in your browser for the web app to work is protected by your device's own login rather than the app's database encryption, so sign out when using a shared computer. Phone-only features (camera, barcode scanning, GPS tracking, Health Connect, and the on-device Coach AI) are not available on the web.
Camera (barcode scanning, meal photos, progress photos), location (live run/walk tracking only; routes stored on-device), calendar (showing and adding your planned workouts/meals, with permission), notifications (reminders you set), and Health Connect (section 4). Each is optional; the app functions without any of them.
Local data is encrypted at rest (SQLCipher, key in the platform keystore). All network traffic uses TLS. Server data is protected by row-level security so each account can only access its own rows and photos.
NovaLife is not directed at children under 13 (or the equivalent minimum age in your region) and we do not knowingly collect data from them.
Local data stays until you delete it or the app. Server data (account, synced logs, photos, opted-in backups) stays until you delete your account. Anonymous correction records contain nothing identifying and are retained in aggregate. Crash reports are retained according to Google's Crashlytics retention policy (90 days as of this writing).
We will update this policy as the app changes. Notable change on July 6, 2026: Sync & Backup (cloud sync of fitness logs, with the Settings control described above), the web app, and anonymous photo-correction records were added to this policy. Material changes will be announced in the app.
Questions or privacy requests: [email protected].