Privacy Policy
The Nuvella app is provided by Nuvella Labs ("we", "us"). This policy explains what the app collects and why.
This policy describes what the Nuvella app and its server actually do with your information. In short: we use your location to route you, keep live-walk coordinates for at most a day, collect route data only if you opt in, and never sell your data or show you ads.
What we collect, and why
An app-generated identifier
On first launch the app creates a random identifier for your phone. It is not your phone's hardware or advertising ID. It lets the server keep your account, your subscription status and your free-route allowance. We also record your platform (iOS or Android) and when the device was last seen.
Your email address (optional)
You can use Nuvella without an email. If you sign in, we store your email address to run your account, and our sign-in provider sends you a one-time code.
Location, to compute routes
To plan a route, the app sends your start point and destination to our server. They are used to compute the route and are not written to our database. Location permission is optional: without it the app works in browse mode and you choose a start point yourself.
Share My Walk
When you start a shared walk, your phone sends its position to our server while the walk is live, so the people you sent the link to can see it. We store your latest position, its accuracy, the destination name you chose, and when the walk started, was last updated and was first opened by someone you shared it with. The link stops working 24 hours after the walk's last update, and the coordinates are deleted automatically by a clean-up that runs every few hours after that. The walk record itself (destination name and times, without coordinates) stays with your account until you delete the account.
Anyone who has the link can see the walk while it works, so share it only with people you trust. If someone you shared with follows the walk inside the Nuvella app, we store that app's push-notification token so it can be told if the walk goes quiet. We do not learn who they are.
Trusted contacts
Phone numbers you add as trusted contacts are stored only on your phone. When you choose to message them, your phone's own messaging app sends the message. They are never uploaded to us.
Community reports
If you report a hazard, we store its location, category, optional note (up to 280 characters) and time, linked to your account so you can remove it and so it can be moderated. Other users see the report on the map without any information about who made it. Reports stop showing on the map after 14 days; the record is kept until you remove the report or delete your account.
"Felt unsafe" signals
Using an SOS or decoy-call feature, or tapping that you feel unsafe, sends that location and the kind of signal to our server. It is held in server memory, not linked to your account, gently steers future routes away from that spot, and fades over a few weeks. It is not stored in our database.
Route data, only if you opt in
Off unless you turn it on in the Safety Dashboard, under "Contribute route data". If you agree, we record how routing performed so it can improve for everyone:
- which routes were offered and which one you took, plus the conditions that shaped them (time of day, darkness, weather);
- where you left the route and rejoined it, and how the walk ended;
- your optional post-walk rating (Fine, Uneasy or Unsafe), and which stretch felt wrong if you choose to say.
Approximate areas, never your exact position. Your phone rounds every location to a grid cell about 55 m across before anything is sent, so your precise coordinates never leave your device for this purpose. This data is kept for at most 400 days and then deleted automatically. You can withdraw consent at any time by switching the setting off, which erases what we already hold and clears anything still waiting on your phone. It is linked to your account so that deleting your account deletes it too.
Purchases
Subscriptions are processed by Apple or Google, and managed through RevenueCat. We receive your subscription status, never your payment details.
Error reports and server logs
If our server hits an error, a report goes to our error-monitoring service with coordinates, email addresses and identity stripped out first. The app itself does not send crash reports to us; Apple and Google may share anonymous crash statistics with us under your phone's settings. Like any web server, ours keeps access logs (IP address, the address requested and the time) to operate and protect the service.
Who else handles your data
We use these providers to run the service. They process data for us and may not use it for their own purposes:
| Provider | What it receives |
|---|---|
| Supabase | Your email address, if you sign in, to send the sign-in code. |
| Apple, Google, RevenueCat | Your purchase and subscription status, keyed to the app-generated identifier. |
| OpenFreeMap | Map tiles are downloaded directly by your phone, so this map host sees your IP address and the area you are looking at. |
| Place search (Photon by Komoot, on OpenStreetMap data) | The text you type into search, sent from our server, not linked to you. |
| Open-Meteo | A location on your route, sent from our server to get the current weather, not linked to you. |
| Expo, Apple and Google push services | Push tokens and notification text, to deliver notifications. |
| Error monitoring (Sentry) | Server error reports, scrubbed as described above. |
| Our hosting provider | Everything our server stores, on our behalf. |
People who open a Share My Walk link load the map library from unpkg.com and map imagery from CARTO in their own browser.
What we never do
- No ads, no advertising or tracking SDKs, and no sale or sharing of your data for advertising.
- We do not build profiles from your location history.
- We never use demographic data, yours or an area's, to decide a route.
How long we keep it
| Data | Kept |
|---|---|
| Share My Walk coordinates | 24 hours after the walk's last update, plus up to a few hours until the clean-up runs |
| Route data (opt-in) | At most 400 days, or until you switch it off |
| "Felt unsafe" signals | In server memory only; fades over a few weeks |
| Account, devices, walk records, community reports | Until you delete your account (or remove a report) |
Your choices and rights
- Delete your account in the app or by email. See how to delete your account. Deletion removes your account, devices, walks, reports and any route data you contributed.
- Location permission is optional, and background location is used only during Share My Walk.
- Route data is opt-in and can be switched off at any time.
- Access or correction. Email us to ask for a copy of the data we hold about you, or to correct it. Depending on where you live (for example California, the EU or the UK) you may have further rights; we honour these requests for everyone.
Children
Nuvella is not directed at children under 13, and we do not knowingly collect their information.
Changes
If we change what we collect, we will update this page and its effective date before the change takes effect, and ask again where your consent is needed.