Privacy policy

Island friends and messages

The game stores map placements and directions, owned items, visits, exploration memories, island photos and friend messages. A companion day requires finishing that day’s health-plan actions and opening the game on the same day. Gifts transfer an owned, unplaced item to a friend. Island messages can be read by the island owner and their friends. The sender and island owner can delete a message; account export includes sent and received messages, and account deletion removes both. Friends cannot access your health records.

Who is responsible for your data

Nobino is operated by Novelist Labs Limited, the data user responsible for your personal data under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong. Contact us about privacy at hello@novelistlabs.com.

What you choose to share

Nobino stores your profile, character choices, diary entries, photos, conversations, confirmed companion memories, follow-ups, health plans and plan check-ins, and — if you use them — health documents, cycle entries, game progress, referral activity and notification settings. They are linked to your account and used to provide your selected features.

Operational activity

For signed-in accounts, Nobino records visited feature pages, daily visit counts and last-used times linked to the account ID. Authorised administrators use these to operate the service. These records do not contain diary text, conversation content or photos, and are included in account export and removed on account deletion. Administrator configuration changes also have an audit record.

AI data sharing

When you create an account, you agree to share information with AI providers so AI features work from the start. You can turn AI data sharing off at any time in Privacy settings. While it is on and you request AI help, its text, attached photos and relevant health context are sent to OpenRouter and the model provider it selects. Context can include your profile, current medicines and supplements, recent entries, confirmed memories, active health plans and their check-ins, and conversation history. Manual recording does not send those records to AI.

Health documents

Health documents you upload, including their file names, are encrypted before they are stored, and administrator tools cannot open them. A document is sent to AI for extraction only when you ask for it and give consent for that specific document. Extracted details are shown as a draft for you to review, and nothing is saved until you confirm.

Cycle tracking

Cycle tracking is optional. Cycle entries are shared with AI only if you give a separate consent for them in cycle settings, independent of the general AI switch; you can withdraw it at any time. Otherwise cycle entries are used only to show your own calendar and estimates.

Notifications

If you allow notifications, Nobino stores your device push token or browser push subscription to send the reminders and follow-ups you have set up. You can turn notifications off at any time in the app or in your device or browser settings.

Subscriptions and purchases

Pro subscriptions are bought through Apple or Google, and Nobino does not receive your card details. RevenueCat processes purchase receipts for us, linked to your account ID, so we can confirm your subscription status.

Storage and service providers

Nobino relies on a small number of service providers: Clerk for account sign-in, Railway for application hosting and the PostgreSQL database, OpenRouter and the model provider it selects for optional AI features, RevenueCat for subscription receipts, and PostHog for product analytics when you turn them on. A connected health provider is accessed only when you choose to connect and import. External providers have their own privacy practices; their processing and retention are not controlled solely by deleting data here.

Transfers outside Hong Kong

Your personal data is processed outside Hong Kong. Railway hosts the application and database in Singapore. Clerk, RevenueCat and PostHog process data in the United States. When AI is on, OpenRouter (United States) forwards requests to the model provider it selects, which may process them in the United States or other countries. Data protection law in those places may differ from Hong Kong; we use these providers only to run the features described here.

Product analytics

Product analytics is off unless you turn it on in Privacy settings, and can be turned off again at any time. When on, Nobino sends PostHog screen templates and feature counts using a temporary random visit identifier held in memory. We do not send your account ID, sign-in cookies, IP address, diary entries, photos, conversations, health data, name or email address. Page addresses are reduced to a fixed list of templates. Session recording and automatic input capture are disabled. PostHog processes these metrics in the United States.

Cookies and preferences

Sign-in uses session cookies. Your language preference is saved in your browser and in a cookie so pages open in your language. Nobino does not include advertising or third-party session-replay analytics.

Access, retention and deletion

Records remain available until you remove them or delete your account. You can edit and delete entries, photos and memories, and cancel follow-ups. Privacy settings provide a record export; photos can be downloaded separately. Deletion removes active app records and related records, but does not promise immediate erasure from infrastructure backups or external providers. While deletion is pending, account access and new writes are blocked. We retain the account identifier only while it is needed to retry deletion. After completion, we retain a one-way digest and deletion timestamps to prevent delayed sessions or provider events from recreating records; this is a deletion-control record, not health content. When you delete a device-imported entry, we retain only its source identifier until account deletion to prevent sync from recreating it.

Your rights in Hong Kong

Under the Personal Data (Privacy) Ordinance you may ask to access and correct your personal data. You can view, edit, export and delete most records yourself; for other requests, write to hello@novelistlabs.com, addressed to the Data Protection Officer, Novelist Labs Limited. We will respond within 40 days and may charge a fee for a data access request only as the Ordinance allows. We will not use your personal data in direct marketing without your consent.

GDPR rights

If you are located in the European Economic Area or the United Kingdom, you have certain rights under the General Data Protection Regulation: the right to access your personal data, the right to rectify inaccurate data, the right to erasure ("right to be forgotten"), the right to data portability, the right to object to processing, and the right to restrict processing. To exercise any of these rights, contact us at hello@novelistlabs.com. We will respond within the timeframes required by applicable law.

CCPA rights

If you are a California resident, you have rights under the California Consumer Privacy Act: the right to know what personal information we collect and how we use it, the right to delete personal information, the right to opt out of the sale of personal information (Nobino does not sell personal information), and the right to non-discrimination for exercising your privacy rights. To exercise your CCPA rights, contact us at hello@novelistlabs.com.

Age eligibility

Nobino requires a minimum age of 13. We use your saved age or birth date, or record when you confirm that you are 13 or over. A full birth date is optional. This confirmation is a self-declaration, not identity verification. The confirmation timestamp is included in account export and erased with your profile when your account is deleted.

Children's privacy

Nobino is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at hello@novelistlabs.com.

Contact