Privacy Policy

Who operates Nim & Me

The data controller for Nim & Me is Libby Crossland. Privacy questions and rights requests can be sent to libbycrossland23@gmail.com.

Account information we collect

• Your email address and a securely hashed password, or a Google account identifier if you sign in with Google.
• A first name or nickname, if you give one.
• Your timezone, so reminders arrive at the right local time.
• App preferences: chosen conditions, which symptoms you track, theme, reminder settings, Today layout choices.
• Your companion (its species, name, items and reward points).

Health information you choose to record

Everything below is optional and entered by you. Nothing is imported automatically from any health service.

• Symptoms and severity scores, including symptoms you create yourself.
• Check-ins and mood, several times a day if you want.
• Energy, pacing and calibration data derived from what you log.
• Sleep, naps, hydration, food and drink tags, activity, and life-context tags.
• Cycle events and flare periods.
• Medications, doses, schedules, supply and refill dates, and whether a dose was taken.
• Appointments, including your own notes and questions for clinicians.
• Free-text notes wherever the app offers a text box.
• Approximate location-based weather for a day, if you enable weather (see below).

Reminder, device and technical information

• If you turn reminders on: a push subscription for that device (an endpoint URL supplied by your browser vendor plus encryption keys). You can turn this off at any time.
• Feedback you send through the app: your message, the category, the page you were on, app version, browser user agent, platform and screen size.
• Server and error logs used to keep the app working. These hold technical information such as error type, message, route and component — not your health entries.

What we do not collect

• No advertising or marketing profiles, and no sale or sharing of your data with advertisers.
• No third-party analytics or tracking scripts are used in the app.
• No precise GPS tracking. Weather uses a coarse location only, and only if you switch it on.
• No connection to NHS, GP or pharmacy systems.
• Your health entries are never sent to any AI or large language model service; the app contains no AI feature today.

Why we process it, and our lawful bases

• To provide the account and the app you asked for — performance of a contract with you (UK GDPR Article 6(1)(b)).
• To keep the service secure, fix faults and act on your feedback — our legitimate interests (Article 6(1)(f)).
• To send authentication and account emails — contract and legitimate interests.
• For the health information you record, and for health-related reminders, we rely on your explicit consent (Article 9(2)(a)). You give that consent by ticking a separate health-data consent statement during setup — it is not bundled with agreeing to the Terms, and it is not inferred from you entering a symptom. We record the exact wording, its version and the date and time you agreed, and you can see or withdraw that consent at any time in Settings. Withdrawal does not affect processing done before withdrawal.
• Recording that consent, and keeping the evidence of it, is also required of us by law (Article 6(1)(c)).

Where your data is stored, and who processes it

• Supabase — the database, authentication and file storage behind Nim & Me. It holds your account and everything you log.
• Lovable — the platform that hosts and serves the app and its server functions.
• Google — only if you choose to sign in with Google; it receives the sign-in request and returns your account identifier and email.
• Supabase's email sending service — sends confirmation, password reset and other authentication emails. It receives your email address and the contents of those emails.
• Your browser vendor's push service (for example Google FCM for Chrome or Apple's push service for Safari) — delivers reminder notifications to your device. It receives the notification text and the device endpoint. Notification content is encrypted in transit to your device.
• Open-Meteo — receives an approximate latitude and longitude to return weather for a day, only if you enable weather. No account details are sent.

Some of these providers operate infrastructure outside the UK, so your data may be transferred internationally and protected by those providers' standard transfer safeguards. We do not claim UK-only hosting.

Cookies and local storage

Nim & Me uses no advertising or analytics cookies. Your browser's local storage holds your sign-in session (so you stay logged in), your theme and theme-pack choice, which Today sections you have expanded, and a milestone marker. Clearing site data signs you out and resets those preferences.

Keeping and deleting your data

• We keep what you log for as long as your account exists — a tracker is only useful if the history stays.
• Settings → Danger zone → “Erase all my data” deletes every log, symptom, medication, appointment, reminder subscription and companion record, and keeps your login.
• Settings → Danger zone → “Delete my account” deletes all of that plus your profile and your authentication account.
• Feedback you have sent, and technical error records, are not removed when you delete your account: they stay attached only to an account identifier that no longer resolves to a person, so we can still act on beta reports. They hold your message and basic app details, not your health entries.
• Technical and error logs are retained for a short period for security and debugging, and backups held by our hosting providers may persist for a limited time before rolling out of retention.

Security

Access to your data is restricted per-account at the database level, so one account cannot read another's records. Traffic between your device and our servers uses HTTPS, and passwords are stored hashed by our authentication provider. Nim & Me is a beta product built by a small team: we do not hold security certifications, and we do not offer end-to-end encryption of your entries.

Your rights

Under UK GDPR you can ask for access to your data, correction, erasure, restriction, objection, portability, and you can withdraw consent for health-data processing. The app gives you self-service export (Settings → Export) and deletion. For anything else, contact libbycrossland23@gmail.com.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by calling 0303 123 1113.