Where you are is the one thing Nowable needs most, and the one thing it never sends us.
Nowable surfaces the tasks you can actually do right now, which means it has to know where you are, how you are moving, and what time it is. It works that out on your phone and keeps the answer there. This page explains how, and what happens to the rest.
Your location stays on your phone
Arriving somewhere
What it does. When you arrive at a place you have saved, Nowable tells you which of your contexts just became active and how many tasks that makes possible.
How. Nowable asks iOS to watch regions around your saved places. Crossing one wakes the app, which reads a condensed local cache of your conditions — no network client is involved in that path at all — decides on the device which contexts are now active, and posts a local notification. No coordinate, no region crossing and no timestamp of your movement is transmitted anywhere.
So a record of where you go, and when, does not exist on our servers to be requested, leaked or sold.
Your other devices do not learn where you are
How. Which contexts are currently active is deliberately excluded from synchronisation. It stays on the device that computed it. Your live position and your motion activity are read from iOS, evaluated, and discarded — never uploaded, never logged.
Your iPad does not know you just walked into the office.
Policy: section 3
Notifications hold no push token
How. Nowable uses local notifications only. It does not register for Apple push notifications, so there is no token, and no server that could reach your phone unprompted.
Policy: section 3
The exception, stated plainly. The coordinates of a place you save yourself do synchronise, because that is content you created — the same as a task title. It is your live position that never leaves the device.
Policy: section 4.2
What the AI sees, and what it never sees
Two features send text off the device: capturing a task in plain language, and searching by meaning. Both are things you invoke. Neither carries your account identifier, your email address or your location, and the request travels from our server rather than your phone, so the provider never sees your IP address.
| Sent for interpretation | Never sent |
|---|---|
| The sentence you typed when capturing a task | Your task notes |
| Your context, project and list names, project descriptions, recent task titles, and your time-of-day bucket names | Note bodies and inbox item bodies, when capturing |
| The names of your places and devices, when you describe a condition | Place coordinates and addresses |
| Titles and bodies, and your search query, for meaning-based search | Attachments of any kind |
| Your location, your email address, your account identifier, any device identifier |
The model returns a structured result. We keep the result and do not retain a copy of the prompt. Search vectors are stored on our server, never synchronised to any device, and the vector built from a search query is used once and discarded.
Nothing you write trains a model. Our OpenRouter account excludes from routing every endpoint that trains on request data, and every endpoint that publishes prompts to public datasets — a rule applied per request, not a promise. We stop short of requiring zero-retention endpoints, which would refuse requests whenever none was available, so the provider serving a request may hold the text briefly under its own terms.
If those services are unavailable, nothing breaks. Capture stores exactly what you typed, and search falls back to plain text matching on your device. You can use Nowable indefinitely without ever triggering either service.
Policy: section 5, text sent to AI services
What we can see on the server
Your live position never reaches us. Your content does, because that is what makes it survive a lost phone — and it is not end-to-end encrypted. It travels over TLS, and Supabase encrypts it at rest with AES-256 under keys Supabase manages, which defends it against a stolen disk or a leaked database dump. It does not defend it against us. Our server has to handle your text in readable form to interpret what you capture and to build the search index, so the developer could query your tasks, notes and attachments in plaintext. We do not: nothing automated reads your task notes, and what we look at in practice is metadata — storage totals, error counts, whether a request succeeded.
That is a promise about conduct, not a guarantee enforced by mathematics. It is worth knowing which one you are relying on.
Policy: section 12, security
What we measure
From the app: that it was opened, how long a visit lasted and how many screens it touched, how many tasks the Do screen had to offer and how many contexts were active when you looked, when you create a task or project, when you finish a task and roughly how old it was, the first task you finish from the Do screen, and how long it took to interpret a sentence you typed. Durations and counts are coarse buckets — "30 seconds to 2 minutes", "4 to 10 tasks" — never exact figures. Automatic event capture is off and session recording is not in the app at all.
Before you sign in these are tied to a random installation identifier generated on your device. After you sign in they are tied to a code derived from your account — the SHA-256 digest of your account identifier, not your email and not anything that identifies you outside Nowable — and the events from before you signed in are attached to it. Signing out returns you to anonymous and mints a fresh installation identifier. This changed on 10 September 2026: anonymous events could not answer whether people keep using the app or stop, which is the question the analytics exist for.
Because we can recompute that code from your account, we can find those events and delete them when you delete your account. Someone holding the analytics data alone could not turn it back into an account; someone who also held a list of our account identifiers could match them, and we would rather say that than let you infer a stronger guarantee.
From the server, counts and durations only, under one fixed identifier shared by every user, so they cannot be attributed to anyone. No text you wrote is ever attached to an analytics event.
Policy: section 6, analytics
What you control, and where
| You want to | Where |
|---|---|
| Grant or revoke location, motion, camera, photos, files, calendar or notifications | Settings → Nowable. Refusing any one of them leaves the rest of the app working |
| Delete your account and everything in it | Settings → Delete account. A 30-day grace period runs first, and signing in during it cancels the deletion |
| Turn analytics off | Settings → Diagnostics. Immediate: anything captured and still waiting to be sent is discarded rather than sent, and the account-derived code is released. Until 10 September 2026 this switch existed but did nothing — that was a defect and it is fixed |
| Get a copy of your content | Settings → Export & import. Email us from your account's address if you would rather we produced it |
| Exercise any other data protection right | Section 2 of the Privacy Policy, which lists them and what we do with each |
One permission prompt needs explaining. iOS may ask you for calendar access. In the current build Nowable does not read any calendar events — the code path that would use them is not connected. Nothing from your calendar is read, stored or transmitted today, and the policy will be updated before that changes.
Policy: section 4.3
This page is a summary written for reading. The Privacy Policy is the complete and binding version: it also covers who is responsible, every third party that receives data, legal bases, retention periods, international transfers and security. Where the two differ, the policy governs.