Your data, your terms.

1. Introduction

Welcome to Nov Pax ("Company", "we", "our", "us"). We are committed to protecting your personal information and your privacy. This Privacy Policy applies to all information collected through our website and our digital wellness application, Sanctuary (collectively, the "Services").

By accessing or using our Services (including joining our early-access flow or participating in our Beta program), you agree to this Privacy Policy.

2. Information We Collect

We collect information that falls into three categories:

A. Personal Information You Disclose to Us

We collect personal information that you voluntarily provide when you express interest in our products or services, when you participate in activities on the Services (such as the Beta Program), or otherwise when you contact us.

• Identity Data: Name, email address.
• Authentication Data: Securely hashed and salted passwords, and similar security information.
• Beta Feedback: Text responses, bug reports, and survey answers provided during the testing phase.

B. Information Automatically Collected

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact details) but may include device and usage details.

• Log and Usage Data: Service-related, diagnostic, usage, and performance information (e.g., time of access, pages viewed, clicks).
• Device Data: IP address, browser type, device settings, operating system, and language preferences.
• Location Data: General location data (such as city/state) derived from IP addresses.

C. Wellness & Usage Data (App Specific)

As a digital wellness platform, Sanctuary may process information about your usage habits (e.g., session times, focus duration) to provide analytics. We do not sell this information. It is used strictly to visualize your progress within the app.

3. How We Use Your Information

We process this information for purposes based on legitimate business interests, the fulfillment of our contract with you, compliance with our legal obligations, and/or your consent.

• To facilitate account creation and logon process.
• To manage early-access signup: To send updates or invite access when a spot opens.
• To improve the Sanctuary algorithm: We use aggregated, anonymized usage insights to refine our wellness algorithms.
• To send administrative updates: We may send product, service, and new feature updates and details about changes to our terms, conditions, and policies.
• To protect our Services: For fraud monitoring and prevention (e.g., blocking disposable emails or bot traffic).

4. How We Share Your Information

We only share information with the following third parties who help us operate the Services:

• Cloud Infrastructure: Vercel (Hosting) and Supabase (Database & Auth).
• Analytics Providers: Vercel Analytics and PostHog (for pseudonymous product usage and performance analytics).
• Marketing-site advertising: Google AdSense may process device, usage, and approximate-location signals on public Nov Pax marketing pages to select, deliver, and measure advertising. AdSense is not enabled inside the Sanctuary app itself.
• Legal Obligations: We may disclose this information where we are legally required to do so in order to comply with applicable law, governmental requests, or a judicial proceeding.

We do not sell, rent, or trade personal data to third parties for marketing purposes.

5. Data Retention & Beta Specifics

• Beta Data: Please note that data generated during the v0.1 / Beta Phase may be temporary. We reserve the right to wipe database entries during major version updates.
• General Retention: We will only keep personal data for as long as it is necessary for the purposes set out in this privacy policy.

6. Security of Your Information

We use administrative, technical, and physical security measures to protect personal data. These measures include SSL encryption, secure database storage via Supabase (PostgreSQL), and limited access protocols. However, please also remember that we cannot guarantee that the internet itself is 100% secure.

7. Your Privacy Rights

Depending on your location (including users in the EEA, UK, California, or Florida), you may have certain rights regarding personal data:

• Right to Access: Request a copy of the data we hold about you.
• Right to Deletion: Request that we delete personal data (e.g., remove your early-access signup information).
• Right to Opt-Out: You can unsubscribe from our marketing emails at any time by clicking the "unsubscribe" link in the emails we send.

To exercise these rights, please contact us at privacy@novpax.org.

8. The Sanctuary Companion Browser Extension

Sanctuary Companion is our Chrome extension: a side panel that shows and controls the same 20-20-60 focus loop as the web app. It works against your own account, and its data handling is deliberately narrow.

• It has no separate login. The extension does not ask for, see, or store your credentials. It calls the Sanctuary API using the session cookie your browser already holds for novpax.org, and it has no permission to read that cookie itself.
• It talks to one place. Every request goes to novpax.org — to read your current session and to start or end one. No analytics service, no third party, no other host.
• It does not read your browsing. The extension checks only whether a Sanctuary tab is open, so the tab and the panel never play the breathing audio at the same time. It does not read, store, or transmit your browsing history, page contents, or activity on any other site.
• What it stores on your device: only the identifiers of reset reminders it has already shown, so the same reminder is never repeated. These live in browser session storage and are cleared when you close Chrome.
• Reminders are scheduled locally. The extension asks the API when your next reset is due and sets a local alarm for that time. It holds no push subscription of its own.

Uninstalling the extension removes all of the above from your device. It does not affect your Sanctuary account or the data described elsewhere in this policy; use the rights in section 7 for that.

9. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals.