Privacy Policy

Last updated 11 August 2026

Nularo is an app that reacts to how you slept and moved. To do that it reads your Apple Health data. This page explains exactly what happens to it, in plain language, with no gaps.

Who we are

Nularo is made by Sidewndr Studios ("we", "us"), a sole proprietorship based in Pennsylvania, United States. You can reach a human at sidewndrstudios@gmail.com.

Health data

What we read

With your permission, Nularo reads the following from Apple Health: sleep analysis, steps, workouts, resting heart rate, and heart rate variability. We request read access only. Nularo cannot write to Apple Health, cannot change your Health records, and cannot see any other Health category.

You grant this permission in Apple's own dialog, and you can change or revoke it at any time in the Health app under Sharing, or in iOS Settings under Privacy and Security. If you revoke it, the creature simply stops knowing things and says so.

Where it lives

Your Health data is processed on your device. Your history, your daily moods, your baselines, and your Creature Age are all calculated on the phone. That raw Health data is never uploaded to our servers, never included in a backup we control, and never placed in iCloud by us.

The one thing that leaves, and only if you allow it

If you do allow it, then once a day, to write your verdict, the app sends a small set of numbers to our server, which passes them to Google's Gemini API to generate one sentence. That request contains only:

• a mood label (for example "wrecked")
• minutes slept last night, and what time you went to bed
• step count
• resting heart rate, and your own rolling average resting heart rate
• how many short nights you had in the last week
• how many good days you have strung together

It contains no name, no date, no device identifier, and no history. The request is signed in as you so that we can enforce a one-per-day limit and stop someone abusing the endpoint, but the numbers themselves are not stored against your account, and we keep only a per-day counter.

We use the paid tier of Google's Gemini API for this, specifically because of what that tier's own terms promise: Google does not use anything sent through the paid API to improve or train its products, and it logs prompts and responses only briefly, solely to detect abuse of the API, not for any other purpose. That is a meaningfully different, more limited hand-off than sending data to a free consumer AI product, and it is why we picked it.

If you have not switched this on, if you are not signed in, or if the request fails for any reason, the creature falls back to a line we wrote ourselves and nothing leaves your device at all.

One more distinction worth being explicit about: this daily line is written by an AI model, not a person. Nobody at Nularo reads it before it reaches you. An automated check rejects anything that breaks our rules (advice, diagnosis, comments about body or weight) and swaps in one of our own pre-written lines instead, but the check is a set of rules, not a human reviewer, and the model can still say something inaccurate or oddly phrased. Treat every line as entertainment with a personality, the same way you would a caption a friend wrote, not as a judgment issued by an authority.

What we never do with it

• We never sell your health data, to anyone, for any amount.
• We never share it with data brokers.
• We never use it for advertising, marketing, or targeting.
• We never send it to an advertising SDK or an analytics SDK.
• We never use it to make decisions about you outside the app.

Your account

Nularo uses Sign in with Apple or Google to create an account. Our authentication provider, Supabase, stores your user ID and the email address associated with that sign-in. If you use Apple's Hide My Email, we only ever see the relay address Apple gives us, never your real one.

An account exists for one reason: so your creature survives a new phone.

What backs up when you are signed in

While you are signed in, we store the following on our servers:

• your daily verdicts: the date, the mood label, and the line the creature said
• your journal entries: the evening date, mood, hydration, any note you typed, a pledge target, and confessions you chose to record
• your settings: your age, savagery preference, notification time, and whether the egg has hatched

Note the difference from raw Health data: what backs up is the creature's interpretation and your own writing, not your Apple Health records. Every row is locked to your user ID by database-level security, so no other user, signed in or not, can read it.

Purchases

Subscriptions are sold and processed by Apple. We never see your card, your billing address, or your Apple ID password. We use Superwall to display the subscription screen and to confirm whether your subscription is active. Superwall receives standard app and device information (such as device model, operating system version, app version, locale, and a per-vendor identifier) along with purchase events. It does not receive your health data.

Everyone who touches your data

This is the complete list. There is no sixth company, no advertising network, and no data broker anywhere in it. If we ever add one, this table changes before it ships.

Everyone on that list is bound, by the agreement we have with them, to protect your data to at least the standard described on this page. None of them may sell it, use it for advertising, use it to build a profile of you, or use it for anything beyond the job in the "What for" column. That applies equally to any parent, subsidiary, or related company of theirs that touches the data. Before we add anyone to this list we check they can commit to the same terms, and we update this page before the change ships.

Notifications

The morning verdict notification is scheduled and delivered locally by your phone. Notification content is generated on the device. We do not run a push server and we do not send your health data anywhere to produce a notification.

Analytics

Nularo does not currently include a third-party analytics or advertising SDK. If we add product analytics in future, it will measure how the app is used (screens opened, features tapped) and it will never carry health values or anything you have written. We will update this page before that ships.

Children

Nularo is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, email us and we will delete it.

Your choices and your rights

• Stop sharing health data: revoke Nularo's access in the Health app at any time. The app keeps working, with less to say.
• Stop the AI hand-off: in the app, go to Settings and switch off "Personalize my verdict with AI." From the next morning, nothing about your nights goes to Google, and the creature writes from our own lines. Switching it back on is the same tap.
• Use the app without an account: sign out, and nothing backs up. Your history stays on the phone.
• Delete it, right now: in the app, go to Account and tap "Delete account." It is permanent and immediate, the same request the app makes also removes your Apple sign-in record, not just the visible data.
• Get a copy of your data, or delete it without the app: email sidewndrstudios@gmail.com from the address on your account and we will export or permanently delete your account and everything stored with it within 30 days.
• Delete the app: removing Nularo removes everything held on the device. Anything backed up is removed when you delete your account.

Depending on where you live, you may have additional rights over your personal information, including the right to access, correct, port, or delete it, and to complain to your local data protection authority. Email us and we will help.

If you are in the UK, the EU, or the EEA

Under the GDPR and the UK GDPR, Sidewndr Studios is the "controller" of the personal data described on this page. Here is the part those laws require us to spell out.

Why we are allowed to process it

• Your consent for anything to do with health. Reading Apple Health happens only after you allow it in Apple's own dialog. Sending numbers to Google's Gemini happens only after you separately switch that on. Health data is a "special category" under Article 9, and explicit consent is the only basis we rely on for it. You can withdraw either consent at any time, and withdrawing does not make what happened before it unlawful.
• Performing our contract with you for your account, your backup, and your subscription. You asked for an app that remembers you, and these are what that takes.
• Our legitimate interests for keeping the service standing up: the per-day counter that stops someone hammering the roast endpoint, and basic security. We keep this narrow on purpose, and it never covers health data.

Where it physically goes

We are based in the United States and so are our providers, so data about you is processed there. For transfers out of the UK, the EU, and the EEA we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our agreements with Supabase and Google, plus the fact that the transfer is minimal by design: the only health-derived thing that crosses a border is a handful of unnamed numbers, and only if you turned that on.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, hand it to another service in a portable format, restrict what we do with it, or object to it. You can withdraw consent whenever you like. We do not charge for any of this, and we will answer within one month. Email sidewndrstudios@gmail.com from the address on your account.

If you think we have got it wrong, you can complain to your national data protection authority (in the UK, the Information Commissioner's Office at ico.org.uk). We would rather you told us first so we can fix it, but you do not have to.

We have no establishment in the EU or the UK. If we appoint a representative under Article 27, their details will appear here.

State-specific privacy rights (US)

A handful of US states, starting with Washington, now treat health-adjacent data (sleep, heart data, and anything inferred from it, like a mood) as a protected category with its own rules, separate from general privacy law. We built Nularo the same way for every user, in every state, rather than give some users fewer protections than others:

• Washington (My Health My Data Act): we keep a separate, dedicated Consumer Health Data Privacy Notice covering exactly what health data we collect, who it goes to, and how to exercise your rights over it. We give every user this notice and these rights, not only Washington residents.
• Nevada and Connecticut: both states have similar consumer health data laws. The practices described on this page and the notice above reflect them too, we did not build a separate version per state.
• California (CCPA/CPRA): California treats health information as "sensitive personal information." We do not sell or share it, and you can ask us to limit its use, access it, correct it, or delete it at any time using the contact below.

We do not use geofencing (detecting when you are physically near a clinic, hospital, or other health facility) for any purpose. We do not collect your location at all.

If something goes wrong

If we ever discover a security breach involving your data, or that your data was disclosed somewhere this policy does not describe, we will notify you without unreasonable delay, and in any case within the timeframe the law requires, by email and, where practical, an in-app notice. That notice will say what happened, what was involved, and what we are doing about it. We would rather over-notify than have you find out from someone else.

How long we keep things

Backed-up verdicts, journal entries, and settings are kept while your account exists, because the entire point is a creature that remembers. Delete your account and they go. Per-day roast counters are kept briefly for abuse prevention.

Changes to this policy

If we change how any of this works, we will update this page and change the date at the top. Material changes will be surfaced in the app.

Contact

Questions, deletion requests, or anything that reads wrong here: sidewndrstudios@gmail.com.