Privacy Policy

1. Introduction

For the Normi marketing website and DSA Chamber at normiapp.com, see our Cookie and browser storage policy. Optional analytics stays off until you allow it, and signing in does not give analytics consent.

Welcome to Normi ("we," "our," or "us"). We are committed to protecting your privacy and ensuring you understand how we collect, use, and safeguard your personal information.

This Privacy Policy explains our practices regarding the collection, use, disclosure, and protection of information when you use the Normi mobile application (the "App" or "Service").

2. Information We Collect

2.1 Information You Provide Directly

Account Information:

• Email address, full name, and display name
• Username and password (encrypted)
• Profile picture/avatar
• Bio/description, university, field of study (optional)
• Account type (student, researcher, professor, professional, other)

Content You Create:

• Messages and chat conversations
• Files and documents you upload
• Notes and reminders
• Project information and collaboration data
• AI conversation history

2.2 Information Collected Automatically

• Online/offline status and last seen timestamp
• Device type, model, and operating system version
• App version and unique device identifiers
• IP address and connection type

2.3 Information from Third-Party Services

When you authenticate using Google or Apple Sign-In, we receive:

• Email address and profile name
• Profile picture URL (Google) or full name on first sign-in (Apple)

3. How We Use Your Information

• Provide and Maintain the Service: Create accounts, enable messaging, facilitate collaboration, process files, and deliver AI features
• Improve and Personalize: Understand feature usage, develop new functionality, optimize performance
• Communicate: Send service announcements, respond to inquiries, provide account notifications
• Ensure Safety: Detect fraud, enforce Terms of Service, process reports, maintain platform integrity
• Process Payments: Manage subscriptions and in-app purchases through RevenueCat, and answer refund requests from Apple and Google

4. AI Features and Data Processing

Normi integrates AI capabilities powered by OpenAI (GPT), Anthropic (Claude), and Google (Gemini). AI conversations are processed by the selected provider based on your tier and preferences.

Certain AI features operate locally on your device, including text recognition (OCR), PDF text extraction, and local embeddings for private projects.

You can delete your AI conversations, uploaded files, and notes at any time. We do not use your content — including the files and documents you upload, your notes, or your AI conversations — to train AI models.

When you use AI features, the relevant content is sent to the applicable provider (OpenAI, Anthropic, or Google) solely to generate your response. These providers process this content under their API terms and do not use content submitted through their APIs to train their models.

5. Data Sharing and Disclosure

We share information with service providers who assist in operating our Service:

Refund requests. If you ask Apple or Google for a refund of a Normi purchase, you agree that we may share information about your use of that purchase with the store, through our subscription provider RevenueCat, so the store can decide whether to approve the refund. This may include how long you have had Normi, how much of the purchase you have used, the total you have spent with us, and the total refunded to you before. We share this only as needed for that decision. We never share your notes, chats or files, and this information is not used for tracking. The store uses and protects it under its own privacy policy. If you would rather we did not share it, email [email protected] before you request a refund, and we will not.

We may also disclose information for legal reasons, to protect our rights, or in the event of business transfers.

6. Data Storage and Security

Account data and content are stored on Supabase infrastructure with encryption in transit (TLS/SSL) and at rest (AES-256), secure authentication, row-level security, and regular security assessments.

You are responsible for maintaining the confidentiality of your login credentials and logging out of shared devices.

7. Your Rights and Choices

You can control your privacy through in-app settings:

• Profile visibility (public, friends-only, or private)
• Email visibility and online status
• Friend request and notification preferences

You have the right to:

• Access and request a copy of your data
• Update or correct your information
• Delete individual messages, AI conversations, notes, or your entire account
• Block and report other users

8. Children's Privacy and Parental Consent

Normi is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13.

Users aged 13-17: If you are between 13 and 17 years old, you must have your parent or legal guardian's permission to use Normi. By using the Service, you confirm that you have obtained such consent. Parents or guardians who permit minors to use the Service agree to:

• Supervise the minor's use of the Service
• Assume all risks associated with the minor's use
• Accept this Privacy Policy on behalf of the minor
• Be responsible for the minor's compliance with these terms

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at [email protected] and we will promptly delete such information.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy in the App, updating the "Last Updated" date, and sending notifications for significant changes.

10. Contact Us

If you have questions about this Privacy Policy, please contact us:

Email: [email protected]

Response Time: We aim to respond within 30 days.

11. Additional Jurisdiction Information

EEA Residents (GDPR): You have rights to access, rectification, erasure, restrict processing, data portability, object to processing, and withdraw consent.

California Residents (CCPA): You have rights to know what data is collected, whether it's sold or disclosed, to opt-out of sale, access your data, and receive equal service. We do not sell your personal information.

UK Residents: Your data is protected under UK GDPR and the Data Protection Act 2018.