Privacy Policy

1. Introduction

Nomi is operated by Otter and Pebble Studio LLC, a New York limited liability company ("we," "our," or "us"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Nomi, our baby name discovery application ("Service"). Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service.

2. Information We Collect

2.1 Personal Information

When you create an account, we collect:

• Email address (required for account creation and authentication)
• Username and display name (optional)
• Password (encrypted and never stored in plain text)
• Sign In with Apple or Google: if you choose social login, we receive your name and email from the provider. We do not receive or store your social account password.
• Friend code (automatically generated emoji code for connecting with friends)

2.2 Payment Information

For premium purchases, we collect:

• Payment card information (processed and stored by Stripe, not by us)
• Billing information as required by Stripe
• Transaction history and premium tier status

We do not store credit card numbers or payment details on our servers. All payment processing is handled by Stripe, a PCI-compliant third-party payment processor.

2.3 Usage Information

When you use the Service, we automatically collect:

• Name interactions (likes, dislikes, favorites)
• User preferences and recommendation history
• Insight feature usage (for free tier limit tracking)
• Friend connections and comparison data
• Device information and browser type
• IP address and general location data
• Usage patterns and feature engagement

2.4 Cookies and Tracking Technologies

We use authentication cookies to maintain your login session. These are essential for the Service to function properly and cannot be disabled if you want to use the Service.

3. How We Use Your Information

We use your information to:

• Create and manage your account
• Provide personalized name recommendations
• Process premium purchases and manage subscriptions
• Track insight feature usage and enforce free tier limits
• Enable friend connections and preference comparisons
• Analyze trends and improve our algorithms
• Send important service notifications and updates
• Respond to customer support requests
• Prevent fraud and ensure security
• Comply with legal obligations

4. Information Sharing and Disclosure

We do not sell your personal information. We may share your information with:

4.1 Service Providers

• Stripe: Payment processing (see Stripe's Privacy Policy)
• Apple: Sign In with Apple authentication and in-app purchases
• Google: Sign In with Google authentication
• RevenueCat: Subscription management and receipt validation
• Supabase: Database hosting and authentication
• OpenAI / Anthropic: For generating name recommendations and cultural context
• PostHog: Product analytics and usage insights (session data, feature usage, page views)
• Sentry: Error tracking and crash reporting (anonymized error data and stack traces)

4.2 Friend Connections

When you connect with a partner, friend or family member, they can see:

• Your username and display name
• The names you like and favourite, and how your taste compares with theirs (for example by origin, theme, era and ranking)
• Insights Nomi draws about you and the people you connect with, as a group, including automatically written comparisons and summaries

You choose who you connect with, and you can remove a connection at any time from Our Names.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety, or that of our users or the public.

5. Data Storage and Security

5.1 Data Storage

Your data is stored securely using Lovable Cloud infrastructure (powered by Supabase), which is hosted on secure servers. All data transmissions are encrypted using industry-standard SSL/TLS protocols.

5.2 Security Measures

We implement security measures including:

• Encrypted password storage (bcrypt hashing)
• Row-Level Security (RLS) policies on database tables
• Secure authentication via JWT tokens
• Regular security updates and monitoring
• Restricted access to personal information

5.3 Data Retention

We retain your information as long as your account is active or as needed to provide services. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are legally required to retain it.

6. Your Rights and Choices

You have the following rights regarding your personal information:

6.1 Access and Update

You can access and update your profile information, preferences, and name interactions through your account settings.

6.2 Data Export

You can export your name lists (favorites, liked, disliked) as CSV or JSON files at any time through the Service.

6.3 Account Deletion

You can request account deletion by contacting [email protected]. This will permanently delete your account and personal information within 30 days.

6.4 Marketing Communications

We send tips, news and offers by email only to people who said yes. When you create an account with your email address, the sign-up form has a box saying “Email me tips, news and offers from Nomi”. It is ticked for you unless your device's language or time zone points to the European Union, the European Economic Area, the United Kingdom or Canada, where it starts unticked and you tick it yourself if you want these emails. You can untick it before you sign up. If you sign up with Apple or Google there is no box, and these emails stay off until you turn them on in Settings, under Email. We keep a record of your choice: the words you saw, whether the box was ticked for you or by you, your device's region and time zone, and when. You can turn these emails off at any time in Settings, or with the Unsubscribe link at the bottom of any of them, which works without signing in. Some emails are about your own account and are not affected by this choice: sign-in codes, password resets and receipts; a one-time welcome email when you sign up; and, when they are sent, emails telling you that you and your partner both liked a name, which have their own link to stop them.

7. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information promptly.

8. International Users

If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer.

9. GDPR Compliance (EU Users)

If you are located in the European Union, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to Access: You can request a copy of your personal data
• Right to Rectification: You can correct inaccurate data
• Right to Erasure: You can request deletion of your data
• Right to Restrict Processing: You can limit how we use your data
• Right to Data Portability: You can export your data
• Right to Object: You can object to certain processing activities
• Right to Withdraw Consent: You can withdraw consent at any time

To exercise these rights, please contact us at [email protected]. We will respond within 30 days.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or shared
• Right to opt-out of the sale of personal information (we do not sell data)
• Right to request deletion of personal information
• Right to non-discrimination for exercising CCPA rights

To submit a request, email [email protected] with "CCPA Request" in the subject line.

11. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to read the privacy policies of any third-party sites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on the Service. The "Last Updated" date at the top of this policy indicates when it was last revised. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: