This policy describes exactly what data Nowable collects, where that data goes, who else can see it, how long it is kept, and how you get rid of it. Some of what the app handles — your live position, your motion, and which of your contexts are active right now — never leaves your device at all.
Nowable is currently distributed by invitation only through Apple TestFlight. It is operated by an individual developer, not a company.
This is the legal text. For the same facts written as a walkthrough of how the app is built, see how Nowable handles your data.
1. Who is responsible for your data
Nowable is a service operated by Alon Yakobovich, an individual developer established in Israel. For data protection purposes, that individual is the data controller for the personal data described in this policy.
- Contactsupport@nowable.io
- ControllerAlon Yakobovich, Israel
- ServiceNowable — nowable.io
There is no company behind Nowable at the time of writing. If that changes, this policy will be updated to name the entity and you will be told before the change takes effect.
2. Your rights, and how to use them
If you are in the EEA or the UK you have the rights below, and we extend the same handling to everyone else. Exercising them is free and we will answer within one month.
- Access — a copy of the personal data we hold about you.
- Rectification — correction of anything inaccurate. Most of your content you can simply edit in the app.
- Erasure — deletion, as described in section 10.
- Restriction — ask us to hold processing while a dispute is resolved.
- Portability — your content in a machine-readable format. There is no in-app export yet, so ask us by email and we will produce one.
- Objection — object to processing based on legitimate interests, which in practice means analytics. Ask and we will switch it off for your installation.
- Withdraw consent — revoke any device permission in Settings → Nowable at any time. Withdrawal does not undo processing that already happened.
To exercise any of these, email support@nowable.io from the address on your account. We may need to confirm it is really you before acting on a request.
You also have the right to complain to a data protection authority — in the EEA or UK, the supervisory authority where you live, work, or where you believe the problem occurred. We would rather you told us first, but that is your choice, not a precondition.
3. What stays on your device
Nowable is offline-first, and some of the most sensitive data it handles never leaves your phone at all. This is a design property enforced in the source code: the sync configuration excludes these tables, and the background wake path reads a local cache with no network client at all. Ask us at support@nowable.io and we will walk you through the relevant code.
Your live location never reaches our servers. Nowable asks iOS to watch regions around the places you have saved. When you cross one, iOS wakes the app, and the app decides — entirely on the device, against a local read-only cache — which of your contexts became active and how many tasks that makes possible. The resulting notification is generated locally. No coordinate, no region crossing and no timestamp of your movement is transmitted anywhere.
Specifically, the following are computed and stored on your device only:
- Your current position. Read from iOS Core Location, used to evaluate place conditions, then discarded. Never uploaded, never logged.
- Your motion activity (still, walking, running, cycling, in a vehicle). Read from iOS motion services, evaluated locally, never uploaded.
- Which of your contexts are currently active. This is deliberately excluded from synchronisation and stays on the device that computed it. A separate device of yours does not learn where you are.
- The wake cache — a local, condensed copy of your conditions that the background wake path reads without starting the full app.
- Notifications. Nowable uses local notifications only. It does not register for Apple push notifications and holds no push token.
Nowable also keeps a full local database of your tasks so the app works with no network connection. Attachments you have opened are cached locally so they remain readable offline.
4. What we collect and why
4.1 Account data
To give you an account we process your email address, a password (stored only as a hash by our authentication provider; minimum twelve characters), an account identifier, the date the account was created, the time you last signed in, an identifier and a name for each device you sign in on, how much storage you have used, and whether the account holds administrator rights. Invitations are processed as an email address plus a single-use token valid for seven days.
4.2 The content you create
Content you author is stored on your device and synchronised to our server so it reaches your other devices and survives losing your phone. That content is:
| Record | Fields synchronised |
|---|---|
| Tasks | Title, notes, context, project, list, time-of-day, energy, duration, created and completed times, ordering, attachment references |
| Contexts | Name, icon, the condition text you typed, the parsed condition, its summary, last reviewed date |
| Places | Name, latitude, longitude, address, radius |
| Devices | Name |
| Projects and lists | Name, description, last reviewed date |
| Resources | Title, body, project, attachment references |
| Inbox items | Title, body, tier, created and archived times, attachment references |
| Attachments | File name, size, content type, description — and the file itself |
| Settings | Time-of-day buckets, inbox tiers, your preferences |
Places deserve a note. The coordinates of a place are content you chose and saved, so they synchronise like any other record. That is different from your live location, which does not (see section 3).
4.3 Device permissions
iOS will ask your permission before Nowable can use any of the following. You can grant or revoke each of them at any time in Settings → Nowable, and refusing any of them leaves the rest of the app working.
| Permission | What Nowable does with it | Leaves the device? |
|---|---|---|
| Location, while in use | Determines which of your saved places you are at | No |
| Location, always | Lets iOS wake the app on arrival so it can notify you what became possible | No |
| Motion & fitness | Evaluates conditions tied to how you are moving | No |
| Camera | Take a photo to attach to a task | Yes — the photo you attach |
| Photo library | Choose an existing photo to attach | Yes — the photo you attach |
| Files | Choose a file to attach | Yes — the file you attach |
| Notifications | Shows the local notification when a context activates | No |
| Calendar | Reserved for fitting tasks into the gaps around your events | No — see below |
| Local network | Only used when a developer runs the app against a self-hosted server | No |
Calendar, precisely. Nowable is able to request calendar access, and iOS will show you that prompt. In the current build the app does not read any calendar events — the code path that would use them is not connected. Nothing from your calendar is read, stored or transmitted today. When that feature is switched on, calendar events will be read on the device only, and this policy will be updated before it ships.
4.4 Attachments
Files and photos you attach are written to a local cache first, then uploaded through our own API to a private storage bucket. They are never given a public or shareable link, and they are never sent to the AI services described in the next section.
4.5 Technical data
Our API and our vendors necessarily see the IP address your device connects from, together with ordinary request metadata such as timestamps and the endpoint called. Our application error logs record the HTTP method and path of a failing request and never its body.
4.6 The website
nowable.io sets no cookies, runs no analytics and embeds no third-party scripts. Each page is a single self-contained file with nothing loaded from anywhere else — no fonts, no images, no CDN. Cloudflare, which hosts it, sees your IP address and which pages you request.
5. Text you write that is sent to AI services
This is the disclosure most likely to surprise you, so it gets its own section. When you use Nowable's natural-language capture or its semantic search, text you wrote is sent from our server to third-party AI providers outside the European Union in order to be interpreted. Those requests carry no account identifier, no email address and no location.
5.1 Understanding what you typed (OpenRouter, routed to Google)
When you capture a task in plain language, or describe when a context should be active, our server sends the text to a language model through OpenRouter, which routes the request to a Google Gemini model. To resolve names like "the office" or "the kitchen project" into the right records, the request also includes some of your own vocabulary.
| When you… | What is sent |
|---|---|
| Capture a task in plain language | The sentence you typed, plus your context names, your project names and their descriptions, recent task titles within those projects, your list names, and your time-of-day bucket names and hours |
| Describe when a context is active | The sentence you typed, plus the names of your places and devices. Place coordinates and addresses are never sent |
| Create a context and accept an icon suggestion | The context name |
Never sent to the language model: your task notes, resource bodies, inbox item bodies, attachments of any kind, your location or place coordinates, your email address, your account identifier, or any device identifier.
The request travels from our server, not from your phone, so the AI provider does not see your IP address. The model returns a structured result; we keep the result, and we do not retain a copy of the prompt.
Training, and what we have and have not enforced. Our OpenRouter account is configured to exclude from routing any endpoint that trains on request data — paid or free — and any endpoint that publishes prompts to public datasets. That is a routing rule applied to every request rather than an assurance we are asking you to take on trust. We have also declined OpenRouter's standing offer of a discount in exchange for letting it use our traffic to improve its own product.
Retention at the provider is a different question, and the answer is weaker. We do not require zero-retention endpoints, because doing so would refuse requests whenever no such endpoint was available and leave you retyping what the app should have understood. So the provider serving a given request may hold the text for a period under its own terms — commonly for abuse monitoring or a legal obligation — even though it may not train on it. If that is more than you want to accept, do not use plain-language capture: section 5.3 describes an app that works without it.
5.2 Making search work by meaning (Voyage AI)
So that searching for "call the plumber" can find "ring about the leak", some of your text is converted into numerical vectors by Voyage AI. The text sent for this is: your context names, project names, list names, task titles, resource titles and bodies, and inbox item titles and bodies. Task notes are not sent. When you run a search, the words of your query are sent so the query can be compared the same way.
The resulting vectors are stored on our server, in the same database as your records. They are never synchronised to any device, never returned to the app, and the vector built from a search query is used once and discarded.
5.3 If the AI services are unavailable
Nothing breaks. Task capture falls back to storing exactly what you typed, and search falls back to plain text matching on your device. You can use Nowable indefinitely without ever triggering either service.
6. Analytics
Nowable uses PostHog, on its European instance, to understand whether the app is being opened and whether the server is healthy. The configuration is deliberately narrow.
The rule that governs every analytics event, including the ones we have not written yet. No text you wrote ever goes into one. Neither does your account identifier, your email address, your device name, your exact time zone, your location, or anything derived from your location. Every property is a number, a boolean, or a value from a fixed list — enforced in the code that sends events rather than decided case by case. We count what happens; we do not read what you wrote.
From the app, one event is recorded today: that the app was opened. It carries whether this was a cold start, and a coarse bucket for how long it had been since the previous open (for example "30 minutes to 6 hours" — never an exact time). Every event also carries the platform, OS version, app version, language and build mode.
These events are tied to a random installation identifier generated on your device. It is not derived from your account, and it is regenerated when you sign out or reinstall. Your account identifier, email address, device name and precise time zone are never sent. Person profiles are disabled, automatic event capture is disabled, and session recording is not present in the app at all.
From the server, we record counts and durations only: that a parse finished and how long it took, that a search finished and how many results it had, that a batch of changes was applied, and that an invitation was issued or redeemed. These carry a fixed identifier that is the same for every user, so they cannot be attributed to anyone. No user-written text is ever attached to an analytics event.
The complete list, as of 1 September 2026. From the app:
app_opened. From the server: server_upload_applied,
server_parse_completed, server_search_completed,
server_invitation_issued and server_invitation_redeemed. One more,
deploy_smoke_test, is emitted by our own post-deployment check and never by
anyone's device.
We expect to add events as the app grows, and this list may briefly lag a release behind the app. Anything we add obeys the rule above — that is the part worth holding us to, because it is the part that cannot be satisfied by a longer list. If we ever needed an event that broke the rule, section 14 requires us to tell you before it ships.
PostHog receives the IP address the event was sent from, as any web service does, and our project is set to discard it. It can be used at the moment the event arrives to derive a country and to filter out bot traffic; it is then dropped rather than stored alongside the event. So the events we can read carry no network identifier at all — only the random installation identifier described above.
Opting out. Analytics is on by default and there is no in-app switch — that is a deliberate choice rather than an oversight, and no switch is planned. What you can do instead is tell us: email support@nowable.io and we will disable analytics for your installation, normally within two working days. You do not have to give a reason, and asking costs you nothing else in the app.
The server-side counters described above are unaffected by that, because they cannot be attributed to you in the first place — every one of them carries the same identifier for every user, so there is nothing in them to switch off.
7. Third parties who process your data
The services below act on our instructions. No one buys your data from us, because we do not sell it, rent it, or share it for advertising, and we are not paid by any of them.
What each one may do with the data it receives is governed by the standard terms we accepted when signing up; we have negotiated no bespoke agreement with any of them. Ask us at support@nowable.io and we will tell you which terms a given provider is under. The one place where a provider's own policy — rather than ours — decides what happens to text you wrote is the language model, and section 5 says so explicitly.
| Service | What it receives | Why |
|---|---|---|
| Fly.io |
All traffic between the app and our API, including your synchronised content and attachments in transit | Runs our API |
| Supabase | Your account, email, password hash, all synchronised content, and your attachment files | Database, sign-in, and file storage |
| PowerSync | Your synchronised content, delivered to your devices | Keeps your devices up to date |
| OpenRouter |
The text you capture and the vocabulary described in section 5.1 | Routes requests to the language model |
| Google |
The same text — Google operates the Gemini model that interprets it | Interprets what you typed |
| Voyage AI |
The titles, bodies and search queries described in section 5.2 | Makes search work by meaning |
| PostHog |
The anonymous events described in section 6, and the originating IP address, which it discards on arrival | Product analytics |
| Apple | Your TestFlight participation and any feedback you send through TestFlight. Separately, when you search for an address while creating a place, the address text you type is sent to Apple's geocoding service by iOS | App distribution; address lookup |
| OpenStreetMap Foundation | Your IP address and which map tiles you view, while you have the place map open | Draws the map in the place editor |
| Cloudflare | Your IP address and request metadata when you visit nowable.io — the website only, not the app | Hosts this website |
| Zoho | Anything you put in an email you send us | Handles our support mailbox |
We may also disclose data if the law genuinely requires it, or to establish or defend a legal claim. If that ever happens and we are permitted to tell you, we will.
8. Legal bases for processing
If you are in the European Economic Area or the United Kingdom, we rely on the following bases under the GDPR and UK GDPR.
| Processing | Basis |
|---|---|
| Running your account, storing and synchronising your content, serving your attachments | Performance of a contract (Art. 6(1)(b)) |
| Interpreting text you deliberately submit for parsing, and building search indexes over your own content | Performance of a contract (Art. 6(1)(b)) — these are features you invoke |
| Accessing location, motion, camera, photos, files, calendar and notifications on your device | Your consent, given through the iOS permission prompt and withdrawable in Settings at any time (Art. 6(1)(a)) |
| Analytics, security logging and keeping the service running | Our legitimate interests in operating and improving a working product (Art. 6(1)(f)), balanced by keeping the data anonymous and minimal |
| Keeping records we are legally obliged to keep | Legal obligation (Art. 6(1)(c)) |
Nowable does not ask for, and has no field for, special categories of data such as health or beliefs. If you type such information into a task, it is treated like any other content you wrote.
There is no automated decision-making that produces legal or similarly significant effects about you. The language model interprets text; it does not make decisions about you.
9. How long data is kept
| Data | Kept for |
|---|---|
| Your account and everything in it | Until you delete your account — see section 10 |
| A record you delete | Removed immediately; a deletion marker is kept for 90 days so your other devices learn about it, then removed |
| An unused invitation | 7 days, then it expires |
| A password reset link | 1 hour, single use |
| Analytics events | 1 year, then deleted by PostHog |
| Server logs | Up to 7 days, in our hosting provider's log search. Our database provider's own API and database logs are kept for 1 day. We ship logs nowhere else and keep no copy |
| Database backups | None are taken — see section 10 |
10. Deleting your account
You can delete your account from inside the app: Settings → Delete account. The app asks you to confirm, then schedules the deletion.
- A 30-day grace period runs first. During it your data is untouched and the app keeps working.
- Signing in cancels the deletion automatically. There is no other way to call it off, and no way to shorten the wait.
- After 30 days the deletion runs, and it is not reversible.
When it runs, in this order: your attachment files are deleted from storage, then your account record is deleted, which cascades through the database and removes every task, context, place, project, list, resource, inbox item, attachment record and search index entry belonging to you. Those deletions replicate out to any device still syncing, so the copies on your devices go too. Finally your sign-in identity is deleted, so the email address and password hash are gone.
Analytics events are unaffected, because they were never linked to your account in the first place — they carry a random installation identifier, not an account identifier.
There are no backups for the deletion to leave behind. Our database provider's plan does not include automated backups, and we take none of our own, so once the deletion runs no other copy of your data exists on our side. You should know what that costs you as well as what it buys you: erasure here is genuinely complete, and there is equally no restore point if you delete something by accident. The 30-day grace period is the whole safety net. Anything you would be upset to lose is worth keeping a copy of yourself.
If you would rather not use the app for this, email support@nowable.io from your account's address and we will schedule it for you.
11. International transfers
The developer responsible for Nowable is established in Israel, which the European Commission recognises as providing an adequate level of data protection, so personal data may be transferred there on that basis.
Our API runs on servers in Amsterdam and our analytics run on PostHog's European Union instance.
We have not appointed an EU representative. Nowable is not yet offered to people in the European Economic Area — testers are invited one at a time, and none are in the EEA — so the Article 27 obligation to appoint a representative in the Union does not apply to us today. We will appoint one, and name them in this section, before we invite anyone in the EEA. Until then the rights in section 2 are extended to everyone regardless, because they are the right way to run this, not because a regulation is forcing them.
Two categories of data leave the EEA for the United States: the text sent for interpretation to OpenRouter and Google, and the text sent for indexing and search to Voyage AI, both described in section 5. Those transfers rely on the transfer terms in each provider's standard agreement — the terms we accepted on signing up, not clauses we negotiated ourselves. Ask us about any particular provider and we will tell you which mechanism its terms rely on.
12. Security
- Your content is not end-to-end encrypted. It is encrypted in transit with TLS, and Supabase encrypts it at rest with AES-256 under keys Supabase manages. That protects against a stolen disk or a leaked database dump. It does not protect against us: our server handles your text in readable form — that is how capture and search work at all — so the developer could query your tasks, notes and attachments in plaintext. We do not. Nothing automated reads your task notes, and what we look at in practice is metadata: storage totals, error counts, whether a request succeeded. The difference between "we don't" and "we can't" is worth knowing, and on this point it is the first one.
- All traffic between the app and our servers is encrypted with HTTPS. The app ships with no App Transport Security exceptions of any kind, so iOS itself refuses to let Nowable open a plain HTTP connection — the enforcement is the operating system's, not ours.
- Passwords are never stored in readable form. They are hashed by our authentication provider and must be at least twelve characters.
- Attachment storage is a private bucket. There are no public links and no shareable URLs.
- Synchronisation is scoped per account by a signed token, so one account's data cannot be requested by another.
- Accounts are created only by invitation. Open sign-up is disabled at the provider level.
- The database on your device is stored under iOS file protection at the default class, complete until first user authentication: unreadable after a restart until you unlock the phone once, and readable to the app from then on. That is what lets Nowable wake in the background when you arrive somewhere, and it is weaker than the strictest class, which would break that feature. Past that point it rests on the security of your device — set a passcode, it is doing real work here.
No system is perfectly secure, and we will not claim otherwise. If you believe you have found a vulnerability, email support@nowable.io and we will respond.
13. Children
Nowable is not directed at children. It is not intended for anyone under 16, and we do not knowingly collect data from them. Access is by invitation only. If you believe a child has an account, tell us and we will delete it.
14. Changes to this policy
When this policy changes, the date at the top changes with it. If a change materially affects how your data is handled — a new category of data, a new third party, a new purpose — we will tell account holders by email before it takes effect, and where consent is required we will ask for it rather than assume it.
15. Contact
Questions, requests, complaints and vulnerability reports all go to the same place:
Data controller: Alon Yakobovich, Israel. Postal contact details are available on request to the address above.