Privacy Policy

What this is.

Nuvelo (we, us, our) operates the Nuvelo iOS application and the nuvelo.app website. This policy explains what we collect, what we do with it, who else sees it, and what we never do with it. It is meant to be readable. If something is unclear, write to [email protected] and we will fix it.

Using Nuvelo means agreeing to the terms here. If you do not agree, do not use the service.

What we collect.

Only what the app needs to work. Nothing collected to sell.

• AccountYour email and a hashed password. If you sign in with Apple or Google, we keep only a keyed hash of the ID they give us, never the ID itself. If you add a passkey, its public key and a label (your device's name). If you turn on two-factor sign-in, your authenticator secret, encrypted.
• IdentityYour name and date of birth, asked during setup. Optionally your biological sex, gender identity, pronouns and fitness profile. Used to personalise the briefing and calibrate health benchmarks.
• Apple HealthOnce you allow it, the app sends your daily readings to our servers each time you open Today or Body: sleep time and bedtime, resting heart rate, heart rate variability, steps, active calories, exercise minutes, distance, weight, body fat, blood pressure and blood oxygen, with the name of the app or device each reading came from. Nuvelo never writes to Apple Health.
• WearablesIf you connect them: Oura (sleep, readiness, activity, blood oxygen) and Fitbit (sleep, resting heart rate, heart rate variability, activity).
• Health entriesLab reports you upload and the markers read from them. Cycle entries, workouts and supplements you log.
• FinanceStatements and receipts you add, and what is read from them: transactions, accounts and balances, installments. Goals, scenarios and your cash runway. We keep what is read from a statement, not the file itself. Receipts are read on your phone; only the text reaches us.
• State of residenceOnly if you turn on the Use Tax Tracker, with an optional local rate. Used to pick your state's use tax rate and agency page.
• Approximate locationOnly if you turn on weather. Your position rounded to about 1 km, from your phone while the app is open, or a US ZIP code you type, which our servers turn into an approximate point using a public table. Used to fetch the local forecast for your briefing and training plan.
• Your wordsQuestions and notes you send to Decisions and Focus.
• DeviceYour time zone, a push notification token, and an Apple App Attest key that proves requests come from the real app. No crash reports, analytics or advertising identifiers.
• WaitlistOn nuvelo.app: your email only, encrypted.

What we do with it.

• BriefingsGenerate your daily reading, Life Score, tasks and the next-best decision.
• AnalysisOrganize your lab results next to your lab's own reference ranges and flags, and summarize statements, spending and recovery patterns. Nuvelo does not diagnose or interpret lab results.
• NotificationsA push when something changes: a shift in your health readings, a spending warning, a payment deadline, an installment paid off, or a lab analysis finishing. You can turn notifications off in iOS Settings.
• EmailTwo kinds only: a password reset link when you ask for one, and a one-time welcome when you join the waitlist. No newsletters.
• Use tax estimateOptional, off by default. If you turn on the Use Tax Tracker, Nuvelo flags purchases from out-of-state online sellers that did not charge sales tax and estimates the use tax you may owe, using your state's published rate. This runs on Nuvelo's servers from the statement transactions you already uploaded, using the seller's state shown on each line. No one outside Nuvelo receives it. Estimates are for information only and are not tax advice.
• Anonymous benchmarksOptional, off by default. If you turn on "Share anonymous benchmarks" in Privacy settings, Nuvelo uses your recent 30-day averages for heart rate variability, resting heart rate, sleep duration and body fat, calculated on our servers from the readings you already sync, in weekly group statistics so people can see how a reading compares with others of a similar age and sex. Your daily readings are never included in or shown through these statistics. A group is published only when at least 100 people are in it, results are averaged across many people and rounded, and no individual value is ever shown. Turning the setting off removes you from the next weekly update; statistics published before then are not changed. These statistics are only shown inside Nuvelo and are never sold or shared outside Nuvelo.
• SecurityYour network address is used, in memory only, to limit repeated sign-in attempts and requests. Our server logs do not record network addresses.

How the intelligence works.

Nuvelo uses outside AI services to read your documents and write your insights. Each one gets only what the feature needs and returns a result, and none of them is allowed to use your data to train its models. Providers may keep data for a limited period for safety monitoring, under their terms.

• AnthropicFeatures: every AI feature first: the briefing, Life Score, daily tasks, Decisions, Focus, training plans, money insights, what-if scenarios, health change summaries, lab result explanations, and reading lab reports, statements and receipts. Receives: your question and profile context. The full lab report PDF, including anything printed on it such as your name and date of birth. Lab markers: name, value, unit, lab range and flag, and for some analyses earlier values. Statement text, with account and card numbers cut to the last 4 digits. Photos and scans of statements, as they are. Receipt text read on your phone.
• OpenAIFeatures: the same features, only when Anthropic is unavailable. Receives: the same as Anthropic, for the request it takes over.
• GoogleFeatures: finding published sources for lab recommendations through Google Search. Receives: marker names and the recommendation text, with your results removed. For these searches, Google keeps the request for 30 days.
• TypeSafeFeatures: sorting and labeling: transaction types, recurring charges, spending warnings, lab test names, supplements, workouts and health changes. Receives: transaction descriptions, merchants, categories and amounts. Weekly and monthly spending totals. Lab test names, units and ranges, without your values. Supplement names. Workout names, notes, length and heart rate. Health changes: the metric, its recent average, your usual average and the change. When another AI service fails, its error message, which can include part of the request. Hosted in the US. May use service usage metrics to improve its service.
• PubMedWhen Nuvelo looks for published research behind a lab recommendation, the US National Library of Medicine receives search terms built from marker names and the recommendation, never your results or anything that identifies you. The abstracts it returns are checked against the recommendation by Anthropic, or OpenAI as backup.

Profile context means the health and money summary Nuvelo builds for you: sleep, bedtime, heart rate, heart rate variability, blood oxygen, steps, activity, weight and body fat, recovery and recent health changes, with the source of each reading; net worth, cash, savings and investments, spending left this month, cash flow, your runway's balance and low point, warnings, the next installment, and your active goal; your tasks, recent insights and supplements; and, if you turn on weather, the local forecast, never your location. It does not include your name, email, date of birth, password or account ID. Training plans also use your workouts and fitness profile. In text sent to these services, account and card numbers are cut to the last 4 digits. Photos and PDFs you upload are sent as they are.

Your permission. Nothing goes to these services until you allow it on the AI consent screen in the app, and our servers refuse to send anything without it. You can turn it off any time in Account, Privacy, AI processing. Turning it off stops future sharing. It does not recall data already processed. When we change what is shared, the app asks again before sharing anything.

• Never soldWe do not sell your data to third parties under any circumstances.
• Never trained onWe do not use your personal data to train AI models. Your data is yours.
• Not adviceNuvelo's outputs are informational. They do not constitute medical, legal, or financial advice.
• Consult a humanAlways confirm health and money decisions with a qualified professional.

Who else is involved.

• Apple HealthOptional. See What we collect for the readings sent and when.
• Oura, FitbitOptional. Connected through the provider's own sign-in; our servers fetch your readings nightly and when you refresh.
• MedlinePlusThe US National Library of Medicine's MedlinePlus Connect service supplies the "What this test measures" text for your lab markers. It receives only a standard lab test code (LOINC), never your results, your name or anything else about you.
• National Weather ServiceOnly if you turn on weather. Receives your location rounded to about 1 km and returns the forecast. Nothing else about you. Weather is shown only for locations in the US.
• AppleSubscriptions through your Apple ID; we never see your card. Apple Push delivers notifications. App Attest checks that requests come from the real app.
• CloudflareSits in front of the app's server and nuvelo.app, so it sees your network address. Its Turnstile check protects the waitlist form and receives your network address when you submit it.
• ResendSends our two emails. Receives your email address and the message.
• HostingerRuns the server in the United States where your data is stored.
• BackblazeStores our encrypted database backups in the United States. It cannot read them.

How it is stored.

• Encrypted at restAll your health and money data and personal details are encrypted with AES-256-GCM before they reach the database: your profile and email, health readings, lab reports, workouts, cycle entries, supplements, transactions, balances, goals and the rest. What stays readable is what lets the system work: dates, statuses and settings. Lookups, such as finding your account by email, use keyed hashes, so the database never needs the readable value.
• KeysThe encryption keys are kept in an encrypted secrets file on the server, separate from the database, and are never stored in it.
• Connected accountsAccess tokens for Oura and Fitbit are encrypted with AES-256-GCM.
• UploadsStatement files are not kept: we keep what is read from them. A lab report file is held encrypted only until its analysis finishes, then removed. The report and its results stay, encrypted.
• In transitEvery connection between your device and our servers is encrypted (HTTPS).
• SessionsAccess tokens last 15 minutes and are held only in memory on your device. Refresh tokens are kept in the iOS Keychain on this device only and hashed before they reach our database. Resetting your password signs you out everywhere.
• PasswordsHashed with bcrypt. We cannot read your password.
• Sign-in optionsAuthenticator-app two-factor and passkeys. An optional Face ID or Touch ID lock on the app.
• HostingA PostgreSQL database on a server we run in the United States.
• BackupsThe database is backed up continuously, encrypted, to Backblaze in the United States. Backups are kept for up to 90 days, then deleted.

What you can do.

• ExportDownload everything we hold about you as a JSON file from inside the app, once an hour.
• DeleteDelete your account in the app. You have 30 days to change your mind: signing back in restores everything. After that, our nightly job erases your account and all its data. Copies in backups expire within 90 days. Our AI cost records, which hold no content, are kept without any link to you.
• DisconnectDisconnect Oura or Fitbit in the app; we delete the access token. Readings already synced stay in your account until you delete it. You can also remove Nuvelo's access in the provider's own settings.
• Auto-deleteOff by default. Set a window of 30, 60 or 90 days and our nightly job clears lab analyses, insights and AI usage logs older than that. Lab reports, markers and everything else stay until you delete them.
• Stop AI sharingTurn off AI processing at any time in Account, Privacy, AI processing.

Write to [email protected] for anything the app does not cover. We respond within 30 days.

Cookies and tracking.

• Websitenuvelo.app sets no tracking cookies and runs no analytics. Its fonts load from Google Fonts, which sees your network address. Cloudflare Turnstile protects the waitlist form.
• iOS appNo tracking cookies, no analytics, no advertising identifiers, no cross-app tracking.
• No adsWe do not run advertising. There is nothing to target.

Adults only.

Nuvelo is for people 18 and older. The app asks for your date of birth during setup and does not let anyone younger continue. If we learn that we hold data from someone under 18, we delete it.

Changes to this policy.

When we update this policy we revise the date and version above. When a change affects what is shared with AI services, the app asks for your permission again before sharing anything.

Contact.

• Email[email protected]
• Webnuvelo.app