Privacy Policy for Nurca

Last updated: July 2026

Privacy is a feature, not an afterthought. Nurca is built local-first: your data lives on your device unless you choose to back it up. We do not sell your information. We do not track you for advertising. This policy explains what we collect, why, and what we do not do.

1. Overview

Nurca (the "App") is a local-first application. Your Personal Content resides on your device, and we can access it only if you create an Account for backup or synchronization. We do not sell your personal information. This Privacy Policy forms part of the Terms of Use and uses the definitions set out there.

2. Information stored on your device

The App stores the following locally on your device:

your product collection, ratings, and any photographs you attach;
your routine check-offs and flare-log entries, including notes you write;
your preferences, including skin type, concerns, sensitive-skin mode, and reminder settings.

The App functions fully offline. This information does not leave your device unless you sign in.

3. Information we process if you create an Account

Creating an Account is optional and is used only for cloud backup, synchronization across devices, and any additional services offered. If you sign in:

the information described above is copied to our backend (hosted by Supabase) so it can be restored or synchronized. It is protected by row-level security, so each record is accessible only to your Account;
photographs you attach are stored in a private storage bucket accessible only to your Account;
we store the email address associated with your Account, and the anonymous account identifier our backend uses to link your records to it. If you sign in with Apple or Google, that provider also gives us the identifier it issues for you. If you subscribe, our subscription provider holds an anonymous app-user identifier so it can tell us whether your Account is subscribed. We collect no other identifying information — no name, no phone number, no address, no advertising identifier.

4. Health-related information

Notes you write in the flare log may describe your skin or health. This information:

remains on your device unless you sign in for backup;
is never used for advertising;
is never sold or shared;
is not analyzed to infer health conditions on our servers.

5. Purchases

Any subscription is processed by Apple or Google and managed through RevenueCat. We receive an anonymized confirmation that an Account holds an active subscription. We never receive or store your payment details.

6. What we do not do

We do not use advertising, trackers, or analytics software for profiling or marketing purposes.
We do not sell or share your personal information with third parties for their own purposes.
We do not read your photo library; photo access is used only when you select a photo, and camera access only while you scan.

Exception: We may use minimal, anonymized crash reporting or performance monitoring (e.g., to fix bugs) that does not identify you personally or track you across apps or websites. If we add such tools, we will update this policy and notify you.

7. Your choices and controls

You have the following rights and controls:

Export: You may export all of your data as a file at any time from Account and Backup within the App.
Delete: You may delete your Account and all associated server data from the same screen; deletion is immediate and removes every associated record and stored photograph.
Opt out: You may use the App without creating an Account. Without an Account, no data leaves your device.

8. Data retention

Information on your device remains until you delete it or remove the App. Information backed up to our servers remains until you delete your Account. Exported copies are yours to keep or delete.

9. Service providers and international transfers

If you create an Account, your data is stored on servers hosted by Supabase, which acts as a data processor on our instructions and only for the purposes described in this policy. Our Supabase project is hosted in Canada.

We have a Data Processing Agreement in place with Supabase that includes Standard Contractual Clauses for international data transfers. You may request a copy of this agreement by contacting support@nurca.app.

If you subscribe to Pro, RevenueCat processes the subscription on our behalf. It receives your purchase history and an app-user identifier so it can tell us whether your Account is subscribed. It does not receive your shelf, your notes, your photographs, or your flare entries. Payment itself is handled by Apple or Google; neither we nor RevenueCat receive your card details.

These two — Supabase and RevenueCat — are the only third parties that process your information. There is no analytics provider, no crash-reporting service, no advertising network, and no data broker.

If you use the App without an Account, none of your data leaves your device and no transfer takes place.

10. Children's privacy

The App is not directed at, and may not be used by, anyone under 16. Users confirm they meet this age requirement in the App before they can proceed. We do not knowingly collect personal information from anyone under 16. If we learn we have collected such information, we will delete it promptly. If you believe someone under 16 has provided us with personal information, contact support@nurca.app.

11. Changes

If this Privacy Policy changes materially, we will notify you through the App before the change takes effect. Your continued use after the change constitutes acceptance of the updated policy.

12. Contact

For privacy questions, or to request a copy or deletion of your data: support@nurca.app

You may also delete your Account and all backed-up data yourself, at any time, from Account and Backup within the App.